Redact, Don't Block: Inline Redaction vs Blocking AI Tools

Q: Doesn't redaction break the task?

Rarely. Most sensitive spans are incidental to the request — identifiers, keys, names — and a placeholder preserves the structure the model needs. Where the data is the task, the warn tier records the decision instead of blocking it.

Q: Isn't blocking safer for regulated data?

Only if the block holds. Netskope's data says it does not: violations doubled while blocking became universal, because regulated data moved to personal accounts. Redaction on the sanctioned tool keeps the data home and keeps the user on a surface you can see.

Q: Can Microsoft Purview redact Copilot prompts?

No. As documented in August 2026, Purview DLP for Copilot can block prompts, web searches and labelled content; it cannot redact, and it cannot scan files uploaded directly into a prompt. Redaction for Copilot and for third-party assistants requires an inline layer in the browser or on the endpoint.

Q: What latency is acceptable for inline inspection?

Below the threshold a user notices — tens of milliseconds at the 99th percentile, not the average. Ask any vendor for the p99 figure measured in production; AccuroAI's is under 38 ms.

Nine in ten organisations now block at least one generative AI application; the average blocks ten. That is Netskope's finding from a year of telemetry published in January 2026. In the same year, the same organisations recorded an average of 223 GenAI data-policy violations a month — roughly double the year before — and 47% of their GenAI users were on personal, unmanaged accounts. Blocking is the default control in enterprise AI security, and the leakage it was meant to stop has doubled while it was in place.

That is not a coincidence, and it is not a failure of effort. It is what blocking does. When a tool is useful and banned, people use it from a personal account on a personal device, where nothing you own can see it. The control does not reduce the risk; it removes your visibility of the risk. This post argues for the alternative — inspect the prompt inline and redact the sensitive part — and lays out the evidence, the economics, and which vendors actually ship it.

The leak is in the prompt, not the app

The problem with blocking at the application level is that the application is not the unit of risk. The prompt is. Check Point's AI Security Report 2026 (July) measured high-risk prompts doubling over the year from 2% to 4% — from about one in fifty interactions to one in twenty-five — and reaching one in seventeen in business services. Harmonic Security's analysis of 22.4 million enterprise prompts across 665 tools in 2025 found 2.6% contained sensitive data, with 71% of the exposure running through ChatGPT and the largest categories being legal and M&A material, source code, and financial projections. Zscaler's ThreatLabz counted 410 million DLP violations tied to ChatGPT alone in 2025. Okta's May 2026 survey found 16% of knowledge workers have shared login credentials with an AI tool — more than 20% among those using unsanctioned tools.

Read those together: around 96–97% of prompts are fine, and the 3–4% that are not carry the data you would least like to lose. Blocking the application to stop the 4% throws away the 96% and pushes the 4% somewhere you cannot see it. Redacting the sensitive span inside the prompt — the key, the customer name, the deal terms — keeps the 96% intact, neutralises the 4%, and logs both.

Why blocking pushes people underground

This is not a new lesson. Forrester's Jeff Pollard, on shadow AI: "Use blocking judiciously (if at all), because if you remember the shadow IT lessons of the past, you know that blocking things just drives use further underground and you lose insight into what's happening." Gartner's Max Goss, April 2026: "Many organizations resort to blocking or restricting the use of AI agents, but this is not a long-term solution. If employees are unable to work in the sanctioned tools, they will likely go around the organization's controls and start using shadow AI which presents far greater risks." Cyberhaven, whose job is measuring data movement, put it in its February 2026 report: "Broad attempts to block AI usage rarely reduce risk. Instead, they push usage outside formal controls, further reducing visibility and oversight."

The behavioural data backs them. KPMG and the University of Melbourne's 2025 global study of 48,000 workers found 57% hide their AI use and present AI output as their own, and almost half admit to using AI in ways that contravene company policy. Cyberhaven's telemetry shows where they go: 32% of ChatGPT use, 58% of Claude use and 61% of Perplexity use in enterprises runs through personal accounts. Microsoft's 2024 Work Trend Index had 78% of AI users bringing their own AI tools to work. A block list does not change any of those numbers; it just makes them invisible.

What blocking costs

The productivity evidence is consistent and now well replicated. Brynjolfsson, Li and Raymond's study of 5,179 customer-support agents (NBER, later in the Quarterly Journal of Economics) found a 14% average productivity gain and 34% for novices. Noy and Zhang's experiment in Science cut time on professional writing tasks by 40% while raising quality 18%. The Harvard–BCG "jagged frontier" study of 758 consultants found 12% more tasks completed, 25% faster, at higher quality — with the important caveat that performance fell on tasks outside the model's competence. Microsoft's six-month randomised trial across 66 firms and 7,137 workers found regular users saving roughly two hours a week on email alone.

Those gains are concentrated in the tasks people actually paste things into. Block the sanctioned tool and you forfeit the gain; the work moves to a personal account where none of your controls apply. You pay twice.

Redact, warn, block — in that order

Inline redaction is a specific control, not a slogan. The prompt is inspected before it leaves the device or the browser; spans that match a classifier — a payment card number, a secret key, a patient identifier, a client name in a privileged document — are replaced with placeholders or tokens; the rest of the prompt goes through unchanged; the model answers; the event is logged with the user, the tool, the data class and the action. The employee keeps working. The raw value never leaves.

Three tiers cover almost every policy:

Redact when the data is incidental to the task — the customer's email address in a support ticket being summarised, the API key that happened to be in the file. This is the default for most classes and most users.
Warn when the data may be the point — a financial projection pasted for analysis — so the user confirms and the decision is recorded. Coaching at the moment of action changes behaviour; a policy PDF does not.
Block for the narrow set where no sanctioned path exists: regulated data to an unapproved tool, source code to a consumer account, anything to a service that trains on inputs. Block should be the exception that proves the rest of the policy is permissive enough to live with.

The latency budget is what makes this viable. Inspection that adds seconds gets disabled within a week; inspection under the threshold of perception gets forgotten. AccuroAI runs 40+ classifiers and 60+ secret types inline at under 38 ms p99 across the browser, desktop apps, IDEs and agents, with redact, warn and block configurable per data class, team and tool — and the reduction in shadow AI that follows is the measurable result: 94% in 30 days, because people stop needing the personal account.

Who actually ships redaction

Vendors use "DLP for AI" loosely, so here is what the documentation says, as of August 2026.

Vendor	Block	Warn / coach	Inline redaction of the prompt
Microsoft Purview DLP for Copilot and Copilot Chat	Yes — block sensitive prompts (preview), web search on sensitive prompts, labelled files, external email	No override documented; the user sees a "blocked" message	No. And "DLP can't scan the contents of files that you upload directly into prompts"; policy changes take up to four hours
Microsoft Purview endpoint and browser DLP for third-party AI sites	Yes — block paste and upload to AI sites	Yes — warn with override; block-with-override for risky users via Adaptive Protection	No
Netskope One (AI Guardrails and DLP)	Yes — allow or block prompts and responses by category, keyword and semantic match	Yes — real-time user coaching	Not documented for the outbound prompt; Netskope's "entity redaction" applies to incident forensic data
Zscaler AI Access Security	Yes — hard stop for credentials, regulated data, source code	Yes — caution prompts; browser isolation with paste and upload disabled	Yes — "sensitive elements are automatically replaced before the prompt reaches the model"
Nightfall AI	Yes	Yes — real-time notifications to self-remediate	Yes — "scan and redact sensitive data from ChatGPT prompts in real time"
Prompt Security (SentinelOne)	Yes — "from full content blocking to selective data masking"	Yes — non-intrusive coaching	Yes — "redact or warn users before data is sent without blocking access to the tool entirely"
AccuroAI	Yes — per data class, team and tool	Yes — warn with recorded acknowledgement	Yes — inline, <38 ms p99, across browser, desktop, IDE and agent surfaces

The pattern worth noticing: the first-party control for the most widely deployed enterprise assistant, Microsoft 365 Copilot, is block-only. If your policy for Copilot is "block sensitive prompts", you have chosen the control that the evidence above says drives the behaviour you are trying to prevent — inside the one tool you sanctioned.

What to change this quarter

Pull your block list and your violation counts side by side. If violations are flat or rising while the list grows, the list is not working; the personal-account share will tell you where the usage went.
Reclassify policies by data class rather than by application: redact by default, warn for judgement calls, block for the narrow set with no sanctioned path.
Put inspection where the prompt is — browser, desktop app, IDE, agent — not only at the network edge, because personal accounts and desktop apps do not cross your proxy.
Report the number that matters to the board: not "apps blocked" but "sensitive spans redacted, prompts that continued, personal-account share falling."

FAQ

Doesn't redaction break the task?