Data Report · By Chris Sowa · Published
Last updated
Which Enterprise AI Agents Can Work on Screens With PII Today, and What Does Each One Read?
Seventeen enterprise agents can work on screens that carry PII today, and for most of them the vendor's documentation says the model receives whatever the user or service account may see, with approval and records documented unevenly. The point to check for each is whether values are replaced before the model reads the screen while the task still completes.
Seventeen enterprise agents can work on screens that carry PII today, and for most of them the vendor's documentation says the model receives whatever the user or service account may see, with approval and records documented unevenly. The point to check for each is whether values are replaced before the model reads the screen while the task still completes. Buyers now hold a long shortlist: agents embedded in Microsoft, Salesforce, ServiceNow and SAP; platforms from AWS, Google, Glean, UiPath and IBM; CRM and service agents from HubSpot, Moveworks and Kore.ai; browser or personal agents from Anthropic, OpenAI and Meta. Each can open a customer account, a claim or a patient record and act on it. The privacy officer's question is simpler: what does the model receive, who approves, and what record comes back. This page answers it from the vendors' own documentation in one table split across three sections. It draws on research on what Claude in Chrome can access in a browser and research on what Microsoft Copilot Studio agents can see.
Key findings
- OpenAI's computer use guide states that the Agents API runs the browser in an OpenAI-hosted environment and the agent observes screenshots (OpenAI, 2026).
- Salesforce's Trailhead states that data masking for LLMs is currently disabled for agents; its ISVforce guide recommends a confirmation prompt before a custom action proceeds (Salesforce Trailhead, 2026; Salesforce, 2026).
- Google Cloud documents that deployed agents can access all resources their service account can (Google Cloud, 2026).
- UiPath and Kore.ai each document a PII layer applied before the model processes inputs (UiPath, 2026; Kore.ai, 2026).
- OpenAI's ChatGPT Work admin FAQ states that the Compliance Logs Platform retains data for 30 days and its records do not establish a complete audit trail (OpenAI, 2026).
- No vendor page reviewed describes a record of the screen as the model received it; see research on what an AI control record is.
What does "working on a screen with PII" mean, and what does the documentation record?
An agent works on a screen with PII when it reads a rendered page that carries a person's identifiers and acts on it: a customer account, a claims screen, a patient record, a service desk case. Two designs produce that reading. Platform-embedded agents read records through the platform's APIs under a role, a service account or the user's identity, so the model receives whatever that identity may see. Computer-use and browser agents read the page itself, as a screenshot or an accessibility tree, so the model receives whatever is on the screen.
OpenAI's hosted browser documentation states the second design plainly: the agent observes browser screenshots and decides the next action from what it sees, and the developer's application approves each new website origin (OpenAI, 2026). It does not describe redaction of the screenshot before the model reads it. Microsoft states the first: Copilot can only summarize or reference content the user is authorized to access (Microsoft Learn, 2026).
Take one record: a customer account screen showing name, date of birth, account number, address, balance and a note field. Under the first design the model receives the fields its identity may read, on most platforms all of them. Under the second it receives the rendered screen. The table that follows has three columns: what the model receives, who approves, and what record the customer can obtain, each per the vendor's documentation. Where the pages do not say, the cell reads "not described in the pages reviewed."
What do the agents embedded in Microsoft, Salesforce, ServiceNow, SAP and AWS read?
These agents run inside the platform that holds the record, so the model's reading is bounded by a configured identity.
| Agent | What the model receives, per documentation | Who approves, per documentation | Record available to the customer |
|---|---|---|---|
| Microsoft 365 Copilot | Only content the user is authorized to access | Not described in the pages reviewed | Audit records of prompts, responses and referenced content |
| Copilot Studio computer use | The web and desktop application screens it automates | Not described in the pages reviewed | Not described in the pages reviewed |
| Salesforce Agentforce | The record as stored; masking for LLMs currently disabled for agents | Confirmation prompt per custom action, recommended as always on | Audit trail tracks a prompt through each step |
| ServiceNow AI agents | Not described in the pages reviewed | Supervised mode requires user input or approval | AI Passport audit record, announced for Q4 2026 |
| SAP Joule agents | Data the user is authorized to access; agents can reach external systems | Not described in the pages reviewed | Not described in the pages reviewed |
| Amazon Bedrock AgentCore | Not described in the pages reviewed | Policy can require an approval before a transfer | Audit logs attribute every action to an agent or a human |
Microsoft documents computer use for web and desktop applications in Copilot Studio (Microsoft Learn, 2026). ServiceNow documents Supervised mode (ServiceNow, 2026); AI Passport is a press release with expected availability in Q4 2026, so the capability is announced and its configuration not yet documented in the pages reviewed (ServiceNow, 2026).
What do Gemini Enterprise, Glean, UiPath, watsonx Orchestrate, Breeze, Moveworks and Kore.ai read?
Two of this group document a masking layer before the model; the rest document identity and policy.
| Agent | What the model receives, per documentation | Who approves, per documentation | Record available to the customer |
|---|---|---|---|
| Gemini Enterprise agents | All resources the service account can access; the context the team provides | Not described in the pages reviewed | Not described in the pages reviewed |
| Glean agents | Data permitted by agent access policies at runtime | Not described in the pages reviewed | Not described in the pages reviewed |
| UiPath agents | Text with PII replaced by placeholders before the LLM, values restored in the response | Not described in the pages reviewed | Not described in the pages reviewed |
| IBM watsonx Orchestrate | Not described in the pages reviewed | Instructions can direct escalation to a human; approval not documented | Not described in the pages reviewed |
| HubSpot Breeze agents | CRM data, with Sensitive Data property values withheld from AI | Not described in the pages reviewed | Not described in the pages reviewed |
| Moveworks (under ServiceNow) | Not described in the pages reviewed | Confirmation required for destructive actions | Not described in the pages reviewed |
| Kore.ai agents | Inputs with names, emails and phones masked before processing | Not described in the pages reviewed | Not described in the pages reviewed |
Glean's agent access policies govern what data agents can read and what actions they can execute at runtime (Glean, 2026). HubSpot documents that restrictions prevent Sensitive Data property values from being used by AI (HubSpot, 2026). Moveworks, now part of ServiceNow, documents confirmation for destructive actions in its plugin checklist (Moveworks, 2026).
What do Claude in Chrome, ChatGPT Work, Dots and Muse read?
The third group reads the screen directly, in the user's browser or on a computer the vendor hosts.
| Agent | What the model receives, per documentation | Who approves, per documentation | Record available to the customer |
|---|---|---|---|
| Claude in Chrome | What is on the page | Automatically approve by default, pausing when needed; asks before high-risk actions such as publishing, purchasing or sharing personal data | Not described in the pages reviewed |
| ChatGPT Work | Pages in an OpenAI cloud browser; website sign-in through it is not available in Enterprise or Edu workspaces | Allowing a website does not approve every action on that site | Compliance Logs Platform retains data 30 days; not a complete audit trail |
| OpenAI Dots | Not described in the pages reviewed | Not described in the pages reviewed | Not described in the pages reviewed |
| Meta Muse | Runs on its own dedicated computer in the cloud; cannot see stored passwords or payment methods but can use stored credentials | Checks with the person before sensitive actions like sending an email or making a purchase | Full audit trail the user can review |
Anthropic's help center states that Claude sees what is on the page and can act on it (Anthropic, 2026); its pilot announcement covers high-risk actions (Anthropic, 2025). OpenAI's ChatGPT Work overview supplies the sign-in and website cells (OpenAI, 2026); for Dots, its safety, security and privacy post was the page reviewed (OpenAI, 2026). Meta's announcement supplies the Muse cells (Meta, 2026).
What do the vendors themselves say?
The documentation falls into four patterns. The first is permission inheritance: Microsoft, SAP and Google Cloud each state that the agent reads what its identity may read, SAP adding that agents can reach external systems (SAP Learning, 2026), and Google Cloud's Gemini at Work post adding that the agent keeps session, semantic, procedural and episodic memory, with no retention period stated (Google Cloud, 2026).
The second is masking before the model, documented by UiPath and Kore.ai for text inputs; behavior on a rendered screen is not described in the pages reviewed. Salesforce documents masking for LLMs as currently disabled for agents.
The third is approval as a setting or a recommendation rather than a default: Salesforce's confirmation flag, ServiceNow's Supervised mode, Anthropic's and Meta's pauses for high-risk or sensitive actions, and AWS's Policy, which can require that an approval was granted before a transfer (AWS, 2026). IBM's page mentions escalation to a human and does not document approval before actions (IBM, 2026).
The fourth is the record. AWS's Well-Architected lens calls for audit logs that attribute every action to an agent or a human actor (AWS, 2026); OpenAI documents a 30-day log that is not a complete audit trail. None describes the screen as the model received it.
What does a governed environment change?
In a governed environment, every agent on the shortlist reads the customer account screen as tokens, so the first column becomes the same for every row and the task still completes.
The mechanism is a class of control that sits between the rendered page and the model. Identifiers on the screen are replaced with consistent tokens before any model reads the page, whichever agent is reading: the customer account renders as ACCT_001 for the account number and CUST_001 for the name, with the balance and note field intact because the task needs them. Real values resolve only at the approved destination at the moment of an approved action, such as the account update committed in the system of record. A named person confirms what is tokenized and approves every consequential action, which supplies the second column where the vendor documents no approver. Every screen as the model received it, every action and every approval is recorded and exported, which supplies the third.
This bears on the title question because the first column is the hard one to change. Permission inheritance is a property of the platform (Google Cloud, 2026), and vendor masking layers, where documented, apply to text passed to the model (UiPath, 2026). Substitution at the render applies to the screen itself. The control covers rendered pages and not the vendors' own connectors, memory stores or model training.
Where does RedactSure sit?
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company. Its design places the agent the buyer selects inside a governed environment in the customer's own cloud. On every rendered page, substitution happens at the render layer before any model reads the screen, so a customer account, a claim or a patient record reaches the model as consistent tokens such as ACCT_001 or PATIENT_001 for the whole run, regardless of which vendor's agent is reading. Real values resolve only at approved destinations at the moment of an approved action. A named person confirms the tokenization policy and approves every payment, submission and record change, the arrangement RedactSure calls Supervised Delegation. Every screen as tokens, every action and every approval lands in the AI Control Record and exports to the customer's SIEM. The design is model agnostic, requires no per-application integration, and leaves user permissions unchanged.
Deployments are in pilot. A pilot on the reader's shortlist would show, for the chosen agent, the screen as the model received it, the approvals, and the exported record. Everyone else controls where data can go. RedactSure controls what the AI can see.
Methodology and limitations
This page rests on vendor documentation for seventeen agents: Microsoft Learn pages on Copilot data protection and Copilot Studio computer use; Salesforce's Trailhead and ISVforce guide; ServiceNow's Workflow Studio page and AI Passport press release; Moveworks' plugin checklist; SAP Learning's Joule course; AWS Policy and Well-Architected pages; Google Cloud's agent access page and Gemini at Work post; Glean's access policy page; UiPath's PII masking page; IBM's agent behavior page; HubSpot's Sensitive Data page; Kore.ai's guardrails page; Anthropic's Claude in Chrome help center and pilot announcement; OpenAI's computer use guide, ChatGPT Work overview, admin FAQ and Dots post; and Meta's Muse announcement. It also draws on published RedactSure research pages on Copilot Studio, Claude in Chrome and the AI control record. All sources were read as of October 16, 2026.
No hands-on testing of any product was done for this page. Every cell reports what the cited page states; "not described in the pages reviewed" means the pages cited here do not address the cell, not that the product lacks the capability. Vendor features change often, and AI Passport is announced rather than documented, and the page carries its date. Statements about RedactSure describe its current design, with deployments in pilot. The customer account screen describes a record type, not any organization; the token names are illustrative.
Whether a given agent's reading of a given record meets an organization's obligations is a determination for its counsel, assessors and its own security and compliance officers, not for a research page.
What the record shows
Seventeen enterprise agents can work on screens with PII today, and their documentation answers the buyer's three questions unevenly. On what the model receives, the dominant pattern is permission inheritance: the agent reads what its identity may read, for a service agent on a customer account the whole record; two vendors document masking for text inputs, one documents masking disabled for agents, and the browser agents read the page itself. On who approves, most document a setting or a recommendation; several document nothing. On the record, none describes the screen as the model received it. Substitution at the render, as RedactSure's environment implements it, makes the first column the same for every row. The test is to name one agent and one record, run one task, and ask for the screen the model received.
Frequently asked questions
Which agents on the list document masking before the model reads the data?
UiPath documents in-flight PII masking that replaces entities with contextual placeholders before the LLM and restores values in the response. Kore.ai documents a PII layer that masks names, emails and phone numbers before the agent processes inputs. Both descriptions concern text passed to the model; behavior on a rendered screen is not described in the pages reviewed. Salesforce's Trailhead states that data masking for LLMs is currently disabled for agents.
Does "what the user can see" mean the model sees less than the user?
No. Permission inheritance means the model's ceiling is the user's or the service account's permissions. On a customer account screen the user can see every field, so the model receives every field. The control narrows what the agent can reach, which matters when the identity is scoped to one record type, but it does not reduce what the model reads from a record it may open.
Why are so many approval cells empty?
Because the vendor pages reviewed for this table do not describe an approver for consequential actions. Where approval is documented it is usually a setting the customer turns on, such as Salesforce's confirmation flag or ServiceNow's Supervised mode, or a vendor-defined category of high-risk or sensitive action, as with Anthropic and Meta. An empty cell is not a finding that the product lacks approval; it is a finding that the buyer must ask the vendor, before the pilot.
What record should a buyer expect to receive from the vendor?
The documentation ranges from audit records of prompts, responses and referenced content, to attribution of actions to an agent or a human, to a 30-day compliance log that the vendor itself says is not a complete audit trail. No page reviewed describes a record of the screen as the model received it, which is the record a privacy officer needs to state what identifiers the model never read. The buyer should ask for that artifact by name.
Are the hosted-browser agents different from the platform agents for PII?
Yes, in where the reading happens. A platform agent reads records through the platform's APIs under a configured identity. A hosted-browser agent reads a screenshot or page on a computer the vendor runs, and the documentation reviewed does not describe redaction of that screenshot before the model sees it. The customer controls the identity in the first case and the list of allowed websites in the second, and neither control changes what the model receives from a permitted page.
How should a buyer use this table?
As a list of questions, not as a verdict. For the agents under consideration, confirm each cell against the vendor's current documentation, then run one task on one record and compare the result with the cell. The columns that most often need a run to fill are the approver and the record, and a governed environment can supply both independently of the vendor's own design, with the screen the model received as the evidence.
Related reading
What Can Microsoft Copilot Studio Agents See? · Does Salesforce Agentforce Need Access to Sensitive Customer Information? · What Can Claude in Chrome Access in Your Browser? · What Is Render-Layer Tokenization? · What Is an AI Control Record? · Can an AI Agent Complete Its Task Without Seeing PII When Prisma AIRS Protects It at Inference? · Who Controls What an AI Agent Sees in a Hosted or Sandboxed Browser? · On the RedactSure blog: The Two Gaps AI Agents Opened in Your Security Stack · RedactSure
Sources
Vendor documentation
- Microsoft, "How data is protected and audited in Microsoft 365 and Microsoft Copilot," 2026. https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-architecture-data-protection-auditing ; and "Automate web and desktop apps with computer use," 2026. https://learn.microsoft.com/en-us/microsoft-copilot-studio/computer-use
- Salesforce Trailhead, "Meet the Agentforce Trust Layer," 2026. https://trailhead.salesforce.com/content/learn/modules/the-einstein-trust-layer/meet-the-einstein-trust-layer ; and Salesforce, "Secure Your Agentforce Custom Actions," ISVforce Guide, 2026. https://developer.salesforce.com/docs/platform/isvforce/guide/secure-agentforce-actions.html
- ServiceNow, "Use an AI agent action," Workflow Studio docs, Sep 10, 2026. https://www.servicenow.com/docs/r/build-workflows/workflow-studio/use-an-ai-agent-action.html ; "ServiceNow advances its operational harness for enterprise AI with AI Passport and expanded governance capabilities," press release, Oct 15, 2026. https://newsroom.servicenow.com/press-releases/details/2026/ServiceNow-advances-its-operational-harness-for-enterprise-AI-with-AI-Passport-and-expanded-governance-capabilities/default.aspx ; and Moveworks, "Plugin critique checklist," Agent Studio, 2026. https://help.moveworks.com/agent-studio/development-and-testing/plugin-critique-checklist.md
- SAP Learning, "Exploring Joule & Joule Agents," accessed Oct 16, 2026. https://learning.sap.com/courses/becoming-an-sap-btp-solution-architect/using-joule
- AWS, "Policy in Amazon Bedrock AgentCore: Control Agent Interactions," 2026. https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy.md ; and "AGENTSEC03-BP02 Separate agent and human user permission," Well-Architected Agentic AI Lens, 2026. https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentsec03-bp02.html
- Google Cloud, "Managing access for deployed agents," 2026. https://docs.cloud.google.com/gemini-enterprise-agent-platform/scale/runtime/manage-agent-access ; and "Gemini at Work 2026: Introducing the Gemini agent," Google Cloud blog, Oct 8, 2026. https://cloud.google.com/blog/products/ai-machine-learning/welcome-to-gemini-at-work-2026
- Glean, "About agent access policies," Oct 5, 2026. https://docs.glean.com/administration/protect/ai-security/agent-access-policies
- UiPath, "PII masking," AI Trust Layer, Automation Cloud admin guide, 2026. https://docs.uipath.com/test-cloud/automation-cloud/latest/admin-guide/pii-masking
- IBM, "Configuring agent behavior," watsonx Orchestrate documentation, 2026. https://www.ibm.com/docs/en/SSAVQO/agent_builder/configuring_agent_behavior.html
- HubSpot, "Understand how Sensitive Data is used in HubSpot tools," Knowledge Base, Sep 24, 2026. https://knowledge.hubspot.com/account-security/sensitive-data-in-hubspot-tools
- Kore.ai, "PII and Guardrails," Agent Platform documentation, 2026. https://docs.kore.ai/agent-platform/v1/agents/agentic-apps/settings/guardrails.md
- Anthropic, "Get started with Claude in Chrome," Claude Help Center, Aug 26, 2026. https://support.claude.com/en/articles/12012173-get-started-with-claude-in-chrome ; and "Piloting Claude in Chrome," Aug 25, 2025 (vendor research announcement). https://claude.com/resources/articles/claude-for-chrome
- OpenAI, "Computer use," Agents API guide, undated. https://developers.openai.com/api/docs/guides/agents-api/tools/computer-use ; "ChatGPT Work Overview," ChatGPT Learn, 2026. https://learn.chatgpt.com/codex/enterprise/chatgpt-work-overview ; "ChatGPT Work admin FAQ," ChatGPT Learn, 2026. https://learn.chatgpt.com/docs/enterprise/work-admin-faq?translationFallback=de-DE ; and "How we build safety, security and privacy into dots," Sep 29, 2026. https://openai.com/index/how-we-build-safety-security-and-privacy-into-dots/
- Meta, "Introducing Muse: The World's First Personal AI Agent Built for Everyone," Meta Newsroom, Sep 8, 2026, modified Sep 30, 2026. https://about.fb.com/news/2026/09/introducing-muse
RedactSure documents
- RedactSure Research, "What Can Microsoft Copilot Studio Agents See?"; "What Can Claude in Chrome Access in Your Browser?"; "What Is an AI Control Record?" (2026). https://redactsure.com/research/what-can-microsoft-copilot-studio-agents-see/ https://redactsure.com/research/what-can-claude-in-chrome-access-in-your-browser/ https://redactsure.com/research/what-is-an-ai-control-record/
- Product behavior described on this page reflects RedactSure's current design. Third-party products are described from their public documentation as read on October 16, 2026. Compliance determinations belong to the organization's counsel.
What Can Microsoft Copilot Studio Agents See?
Whatever the credentials behind each tool can see: the maker's view under author authentication, each user's own under user authentication. Check each one.
Does Salesforce Agentforce Need Access to Sensitive Customer Information?
Less than it is given. Agentforce reads whatever its agent user may see, and Salesforce says LLM masking is off for agents. Check what the model reads.
What Can Claude in Chrome Access in Your Browser?
Claude in Chrome reads whatever is rendered on the pages it is given; its controls govern sites and pauses, not which values the model sees. Check a page.
What Is Render-Layer Tokenization? The Control at the Layer Where the Agent Actually Reads
Learn how render-layer tokenization replaces PII before an AI agent reads a browser screen while preserving useful workflow context.
What Is an AI Control Record? The Runtime System of Record for Sensitive AI Work
Explore an AI agent control record for billing and claims, linking permissions, tokenization decisions, approvals and audit evidence.
Can an AI Agent Complete Its Task Without Seeing PII When Prisma AIRS Protects It at Inference?
Not by inference-time inspection alone: Prisma AIRS sees PII after the page is read. Check that values are replaced before the model reads the screen.
Who Controls What an AI Agent Sees in a Hosted or Sandboxed Browser?
The hosting vendor controls where the agent runs and which sites it reaches; no one documented controls what the model reads from a page. Set page policy.
The Two Gaps AI Agents Opened in Your Security Stack
Explore AI agent security through two questions: which PII reaches the model, and who approves consequential billing and claims actions.
Book an AI Agent Security Review →
Bring your hardest questions.
Bring one sensitive workflow and the decisions your team needs to keep in its hands.
Book a demoAbout the author
Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.