Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

What Questions Should an RFP Ask About AI Agent Access to PII?

Ask first what the model receives when the agent opens a screen full of identifiers it is permitted to see, then ask who approves, what is recorded, where values resolve and whether your data trains anyone's model. The answer to look for is that identifiers are replaced before the model reads the screen and the task still completes.

Record fields pass through a circular inspection boundary and emerge as a structured set of procurement checks.

Ask first what the model receives when the agent opens a screen full of identifiers it is permitted to see, then ask who approves, what is recorded, where values resolve and whether your data trains anyone's model. The answer to look for is that identifiers are replaced before the model reads the screen and the task still completes. Procurement teams in banks, health systems and school districts are writing requirements for AI agents that will work inside customer, patient and student systems, and the questions they inherit from software RFPs concern access. Access is the wrong first variable for an agent: one permitted to open a record reads the whole record, and every later control operates on what it read. This page explains why the RFP must ask what the agent reads, sets out ten questions each tied to a source, describes the evidence a vendor should attach, proposes scoring and the answers to decline, reports what two vendors document, and states what changes in a governed environment. It draws on research on who decides which data an AI agent can access and research on which SOC 2 controls apply to AI agents.

Key findings

  • OMB Memorandum M-25-22 requires federal AI contracts to permanently prohibit vendors from using nonpublic agency data and outputs to train publicly or commercially available AI models without explicit consent, a clause any buyer can borrow (Office of Management and Budget, 2025).
  • The EU AI Act's Article 14 requires that high-risk systems be effectively overseen by natural persons during use, with the ability to interrupt the system through a stop button or similar procedure (artificialintelligenceact.eu, 2024), and Article 26 requires deployer logs of at least six months (European Commission AI Act Service Desk).
  • Microsoft's Entra documentation describes governing the identity and access lifecycle of agents, with agent identities created with limited permissions; it says nothing about what an agent reads on screen (Microsoft Learn, 2026).
  • Palo Alto Networks documents Prisma Browser web page data masking as visual concealment of text for the human user, with up to four characters left unmasked; it says nothing about what a model reads (Palo Alto Networks, 2026).
  • Gartner states that applying uniform governance across AI agents will lead to enterprise AI agent failure, so RFP questions should distinguish agents and tasks (Gartner, 2026).
  • The record a buyer should require, every screen as the model received it and every action and approval, is the type described in research on what an AI Control Record is.

Why must an RFP ask what the agent reads, and not only what it can access?

Software RFPs ask about access because, for software, access is the exposure. An agent inherits a user's access and then does something software did not: it reads the entire rendered record into a model's context in order to act. Microsoft's Entra documentation illustrates the gap. It describes governing the identity and access lifecycle of agents, with access assigned through access packages and agent identities created with limited permissions (Microsoft Learn, 2026). It says nothing about what an agent reads on a screen once access is granted. An RFP that stops at identity has specified who the agent is and left open what it receives.

OWASP's two relevant entries name the two halves of the problem. Sensitive information disclosure concerns data the model holds leaving through any output (OWASP, 2025); excessive agency concerns an agent granted more functionality or permission than its task requires (OWASP, 2025). The first depends on what the model received; the second on what it can do with it. Both are downstream of the read, and so is data minimisation, the GDPR's requirement that personal data be limited to what is necessary for the purpose (EUR-Lex, 2016).

Gartner's statement that uniform governance across AI agents will lead to failure (Gartner, 2026) adds a procurement consequence: the questions must be answered per agent and per task, not once for a platform. The first of the ten below asks about the read.

What are the ten questions, and why does each matter?

Each question is asked about a named agent on a named workflow, in writing. The source after each is cited elsewhere on this page.

  1. When the agent opens a screen it is permitted to see, which fields does the model receive, verbatim or replaced? Everything the model holds can leave through its outputs (OWASP LLM02, 2025).
  2. Can the agent complete this task when identifiers are replaced before the read, and will you show one run? Data must be limited to what is necessary for the purpose (GDPR Article 5(1)(c), 2016).
  3. Where and at what moment do real values resolve, and can the agent reach them anywhere else? Capability beyond the task is the condition for excessive agency (OWASP LLM06, 2025).
  4. Who, by name, approves each payment, submission or record change, and can that person interrupt the run? Oversight by natural persons with a stop procedure is the standard (EU AI Act Article 14, 2024).
  5. What record of each screen, action and approval is produced, how long is it kept, and does it export to our SIEM? Deployers must keep logs of at least six months (EU AI Act Article 26).
  6. Is our data, including agent outputs, used to train your models or any third party's, and is the prohibition permanent in the contract? The clause is mandatory for federal buyers (OMB M-25-22, 2025).
  7. How is the agent's identity and access lifecycle governed, and can its access ever exceed the user's? Agent identities and their permissions are a documented object (Microsoft Entra documentation, 2026).
  8. Does your masking act on what the model reads or on what the human sees? Browser masking is documented as visual concealment for the user (Palo Alto Networks Prisma Browser documentation, 2026).
  9. Is the control configured per agent and task, or uniformly? Uniform governance is a predicted cause of failure (Gartner, 2026).
  10. Which of the 25 agent privacy risks MLCommons has catalogued does your control address, and which does it not? The taxonomy gives a shared list to answer against (MLCommons, as reported by PPC Land, 2026).

What evidence should a vendor attach to each answer?

A written answer is a claim; ask for the artifact behind it. Take a student record screen in a student information system: name, student ID, date of birth, home address, guardian phone, IEP status and attendance. The task is to update one day's attendance code and send the absence notice to the guardian. Unprotected, the model read all seven fields. Protected, it received STUDENT_001, ADDR_001 and PHONE_001 for the ID, address and phone, with IEP status withheld because the task did not need it; the attendance code changed, and the notice reached the real phone when PHONE_001 resolved at the approved send. The two screens side by side are the evidence for questions one to three.

For question four, the evidence is the named person's confirmation of the change and the send, and a demonstrated interruption of a run. Article 14 requires that overseers can disregard, override or reverse the output and interrupt the system (artificialintelligenceact.eu, 2024); Article 26 requires oversight assigned to persons with competence, training and authority (European Commission AI Act Service Desk). For question five, it is an export of the record into the buyer's own logging, with retention stated against the six-month floor.

For question six, the evidence is contract language of the kind M-25-22 mandates: a permanent prohibition on training publicly or commercially available models on the buyer's nonpublic data and outputs without explicit consent (Office of Management and Budget, 2025). For questions seven to ten, it is documentation and a completed mapping. Research on what the EU AI Act requires for human oversight of AI agents details the oversight evidence.

How should a buyer score the answers, and which should it refuse?

Score the ten questions unequally. Question one carries the most weight, because the answers to three, five, eight and ten are determined by what the model received. A vendor whose model receives the full screen can answer the other nine well, and those answers then describe controls on a model that holds the data.

Refuse four kinds of answer. An access answer to a read question: roles, permissions or agent identities offered for question one, because identity governance is documented as governing access, not the read (Microsoft Learn, 2026). A human-display answer to a model-input question: masking documented as concealing text for the human user does not state what the model received (Palo Alto Networks, 2026). An output-filter answer to a disclosure question that ignores the model's memory and other channels (OWASP, 2025). And a platform-wide answer to a per-agent question.

Two further notes. The EU AI Act's high-risk obligations for stand-alone Annex III systems are deferred to December 2, 2027 under the Omnibus agreement, effective once it is published in the Official Journal (Gibson Dunn, 2026); score oversight and logging answers against the standard now. And score question ten on candor: a mapping against the 25 risks MLCommons has catalogued, as reported by PPC Land (PPC Land, 2026), that names risks the control does not address is worth more than one that claims all 25.

What do the vendors themselves say?

Two vendors in the pages reviewed document controls an RFP answer will cite. Microsoft's Entra ID Governance page states: "With Agent identities, you can govern and manage the identity and access lifecycle of agents." Access is assignable directly via access packages: groups, OAuth API permissions and Entra roles. The page notes that "When created, agent identities have limited permissions," and marks Copilot Studio auto-creation of agent identities as preview (Microsoft Learn, 2026). The documentation covers identity and access; what an agent reads on screen or in a browser is not described in the pages reviewed.

Palo Alto Networks' Prisma Browser administration documentation for web page data masking states: "This control allows you to mask textual content within webpages." Masking follows predefined PII and PCI types or a custom regex, applies only to tabs or frames whose URL matches configured conditions, and may leave up to four characters unmasked. The stated limit is full support on Prisma Browser Desktop only, with none listed for the extension or mobile (Palo Alto Networks, 2026). The masking is visual display concealment for the human user; what a model or agent reads from the page is not described in the pages reviewed.

Both documents answer questions seven and eight respectively; neither answers question one. A vendor citing either as evidence that the model did not receive an identifier is citing documentation that does not make that statement.

What does a governed environment change?

In a governed environment, question one has a documented answer: the identifiers on a permitted screen are replaced with tokens before the model reads it, the task still completes, and the remaining nine questions are answered about a model that never held the values.

The mechanism is a class of control that sits between the rendered page and the model. Identifiers and other sensitive values on each screen are replaced with consistent tokens before the model receives the screen, so the same student reads as STUDENT_001 across every page of the run. The real value resolves only at an approved destination at the moment of an approved action, such as the recipient field of the absence notice. A named person confirms which values are tokenized and approves consequential actions, including record changes, submissions and payments, and can stop the run. Every screen as the model received it, in token form, and every action and approval is recorded and exported to the organization's own logging.

Against the ten questions, this answers one through five directly with the artifacts described above: the screen as the model received it, the run completed on tokens, the resolution point, the named approver and the exported record. It bears on question six by reducing what any training use could capture, though the contractual prohibition M-25-22 describes is still needed (Office of Management and Budget, 2025). It does not answer question seven, which remains an identity matter, and it does not reach data the agent obtains outside the rendered page.

Where does RedactSure sit?

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company. Agents work inside a governed environment in the customer's own cloud. On every rendered page, including the student record screen described above, substitution happens at the render layer before any model reads the screen, so the student ID reaches the model as a consistent token such as STUDENT_001 for the whole run, and an account number on a banking screen as ACCT_001. Real values resolve only at approved destinations at the moment of an approved action, which for the attendance task is the recipient field of the absence notice when the send is approved. A named person confirms the tokenization policy and approves every payment, submission and record change, the arrangement RedactSure calls Supervised Delegation. Every screen as tokens, every action and every approval lands in the AI Control Record and exports to the customer's SIEM. The design is model agnostic, requires no per-application integration, and leaves user permissions unchanged; an RFP's identity questions are answered by the customer's identity provider.

Deployments are in pilot. A pilot on the reader's own workflow would produce the artifacts for questions one to five on one record type, beginning with the screen as the model received it. Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

This page rests on OMB Memorandum M-25-22, the GDPR on EUR-Lex, the EU AI Act's Article 14 via artificialintelligenceact.eu and Article 26 via the European Commission's AI Act Service Desk, Gibson Dunn's analysis of the AI Act Omnibus agreement, Microsoft's Entra ID Governance documentation on agent identities, Palo Alto Networks' Prisma Browser documentation on web page data masking, OWASP's entries on sensitive information disclosure and excessive agency, Gartner's May 2026 press release on uniform governance, PPC Land's report of the MLCommons Agent Privacy Risk Taxonomy, and published RedactSure research pages on SOC 2 controls, EU AI Act oversight, data access decisions and the AI Control Record. All sources were read as of October 16, 2026.

No hands-on testing of any product was performed. The MLCommons taxonomy is cited as reported by PPC Land; the primary page was not reachable when this page was prepared. Where Entra or Prisma Browser is described as not addressing what a model reads, the statement means not described in the pages reviewed. Vendor features change and the page carries its date. The AI Act deadline is stated as Gibson Dunn reports it, pending publication. Statements about RedactSure describe its current design, with deployments in pilot. The student record screen describes a record type, not any organization; the fields and token names are illustrative.

Whether a given agent, contract or control meets an organization's obligations under FERPA, HIPAA, the GDPR or the EU AI Act is a determination for its counsel, its assessors and its own security and compliance officers, not for a research page.

What the record shows

An RFP for an AI agent that will touch PII should ask what the model receives before it asks anything else, because the vendor documentation reviewed here governs identity, access and what a human sees, and leaves the model's input unaddressed. Ten questions, each tied to a regulation, a standard or a vendor's own documentation, give a buyer a written basis for comparing vendors on the read, the resolution point, the named approver, the record and the training prohibition, with evidence attached to each. RedactSure's environment is one implementation of the control that answers the first question. The test is to name one agent and one task on one record type, send the ten questions, and ask every vendor for the screen as the model received it.

Frequently asked questions

Why is "what does the model receive" the first question rather than "what can the agent access"?

Because access describes what the agent may open and the read describes what the model holds. An agent permitted to open a record reads it in full unless something changes the screen first, and every later risk, disclosure, retention, inference and audit, operates on what the model holds. Identity documentation reviewed here governs access and says nothing about the read, so an RFP that asks only about access has not specified the exposure.

Can a buyer outside government use the M-25-22 training clause?

Yes. M-25-22 binds federal agencies, requiring contracts to permanently prohibit the vendor from using nonpublic agency data and outputs to train publicly or commercially available AI models without explicit consent. The clause is contract language, and a bank, health system or school district can require the same wording. It should cover outputs as well as inputs, and name any third-party model provider the vendor uses.

What should the vendor show for the human oversight question?

A named person confirming a consequential action and a demonstration of interrupting a run. Article 14 requires that overseers can disregard, override or reverse the output and interrupt the system through a stop button or similar procedure, and Article 26 requires deployers to assign oversight to persons with competence, training and authority. A statement that a human is "in the loop" without a name, a step and a stop is not evidence, and the RFP should say so in advance.

Does browser masking answer the PII question?

Not as documented. Prisma Browser's web page data masking is described as masking textual content within web pages for display, with up to four characters left unmasked and support limited to the desktop browser. The page does not state what a model or agent reads. A vendor citing display masking should be asked whether the masked or unmasked text reaches the model, and should show the screen as the model received it.

How long should the record be kept?

At least six months is the floor the EU AI Act's Article 26 sets for deployer logs of high-risk systems, and a buyer can require longer under its own retention policy. The RFP should ask what the record contains, every screen as the model received it and every action and approval, whether it exports to the buyer's own logging, and who controls retention and deletion. A record held only by the vendor, or one that shows actions without the screens the model received, is a weaker answer than one exported to the buyer's own systems.

Should the questions be the same for every agent we buy?

The ten questions can be the same; the answers should not. Gartner's position is that uniform governance across AI agents will lead to failure, and an agent updating attendance codes and an agent moving money differ in what the model needs and who must approve. Ask each question about a named agent on a named workflow, and expect the tokenization policy, approver and record to differ across them.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.