Connecting an AI agent to a business system can make useful work faster. A sales team might let an agent retrieve open opportunities from Salesforce. A finance team might allow it to read invoice status in NetSuite. Administrators set access rules for which people, agents, systems and actions are allowed.
Those controls matter, but they all apply to the request. A second risk sits in the data the system sends back.
Real business records are not tidy. Over years, people paste sensitive details into notes, descriptions, comments, and other free-text boxes. Someone types an account number into a case note because it is convenient at the time. The account number sits inside the note rather than in a field of its own, and an access check on the request does not see what the note will contain. A reasonable question can return data the business didn't mean to share. Once that account number reaches the agent, it also reaches the AI model behind it, and it can turn up in anything the agent writes next.
- Case
- 00081422
- Subject
- Billing discrepancy, March invoice
- Status
- Open
- Notes
- Customer called again. Confirmed account
- 4417 9021 6634 8890 and SSN 402-11-7735
- for verification. Escalating to billing.
Access rules decide before the answer exists
The reason is timing. Access rules decide on a call before the query runs, so they only ever see the request. A control that checks only the outgoing request has nothing to inspect on the way back.
A filter that reads the answer to hide what should not be seen
SecureAuth Agent Authority adds a separate response filter for exactly this gap. After an allowed request comes back from the connected business system, the filter reads the answer before it reaches the agent. It looks for the recognisable patterns you configure, things like the shape of an account number or an email address, and where it finds one it rewrites that part of the text with a mask.
The aim is narrow and practical: reduce the chance that sensitive details in returned business data reach an agent that doesn't need them.
- Notes
- Customer called again. Confirmed account
- 4417 9021 6634 8890 and SSN 402-11-7735
- for verification. Escalating to billing.
- Notes
- Customer called again. Confirmed account
- [REDACTED] and SSN [REDACTED]
- for verification. Escalating to billing.
Where sensitive data hides in a response
Finding those details reliably takes more than scanning the obvious text boxes. Business systems answer with structured information, meaning content arranged into named fields and lists. Sensitive material often hides in places a shallow check misses.
- In the labels of a listA list keyed by email address puts the personal data in the labels. Agent Authority reads labels and values, including content nested several levels deep.
- In error messagesA failed lookup often repeats the email address or account number it couldn't find. Agent Authority checks error responses the same way as successful ones.
- Inside a document stored in a fieldOne field can hold a whole JSON document as a block of text. Agent Authority decodes it, applies the same rules inside it, and encodes it back.
- Contacts
- m.torres@northgate-health.com Billing lead
- d.aluko@northgate-health.com AP approver
- Contacts
- [REDACTED] Billing lead
- [REDACTED] AP approver
What happens on failure, and what gets logged
If redaction can't run, Agent Authority blocks the answer by default
By default, a filter that fails causes the request to be refused rather than letting the answer pass along unchecked. A temporary problem does not quietly switch protection off.
Agent Trail records each masking without keeping the data
The audit record shows which rule matched and how many pieces of text were masked. It does not keep the original text. That gives security and compliance teams evidence the filtering happened, without creating a fresh store of the very data the filter existed to hide.
Where this fits
Response filtering does not replace careful decisions about which agents may reach which systems. It covers a different gap: allowed requests can return sensitive text that was never reviewed.
By reading the whole answer, masking the patterns you configure, and recording the action without keeping what it found, SecureAuth Agent Authority reduces that risk.
FAQ
What is data redaction and masking?
Data redaction and masking hides sensitive values, such as account numbers or Social Security numbers, before data is shared. In Agent Authority, it applies to the answers business systems send back to AI agents: each match becomes a placeholder such as [REDACTED], and the rest of the answer reaches the agent unchanged.
What is the difference between data redaction and data masking?
Redaction removes a sensitive value from data before it's shared. Masking replaces the value with a placeholder or a partial value, so the record keeps its shape. Agent Authority replaces each match to your configured patterns with a placeholder, which defaults to [REDACTED], and the rest of the record reaches the agent unchanged.
How do you reduce the risk of AI agents leaking sensitive data?
Two controls work together: access control on each request, and data redaction and masking on each response. Access control decides the systems and actions each agent can reach. Data redaction and masking checks what those systems send back and masks values that match your patterns before the agent, and the AI model behind it, sees them.
Can data redaction handle structured and unstructured data?
Structured data is content arranged into named fields and lists, such as a record returned by Salesforce. Unstructured data is free text, such as a case note. Agent Authority checks both. It reads the labels and values in structured answers, including documents stored inside a field, and checks free text against the patterns you configure. An optional AI judge, running on a model connection you add, can also check responses.