A courts clerk workflow agent occasionally drafts responses that echo sensitive case details from records it retrieved, and reviewers want those outgoing responses screened before they reach an external party. Which capability fits this need?

Model Armor operates on the content flowing through an agent's prompts and responses, which makes it the right layer for catching sensitive case details the model surfaces in an outgoing draft before that draft reaches an external party. Sensitive Data Protection is built for discovering and classifying sensitive data at rest, typically in stored records or datasets, which addresses a different problem: it can help find sensitive fields inside the courts records themselves, but it isn't positioned to screen a live, generated response in the conversational path the way a content guardrail is. Agent Gateway logs and monitors tool-call traffic, which is valuable for visibility and auditing but doesn't inspect the semantic content of a drafted response for leakage the way a dedicated content-screening layer does. Agent Identity governs what the agent's principal is permitted to access when it retrieves records in the first place, which matters for containing what the agent can reach, but it does nothing once the agent has legitimately retrieved a record and then drafts a response that echoes too much of it. A scope caveat: content screening reduces the risk of leakage but doesn't replace access controls that limit what sensitive data the agent can retrieve in the first place. As an operational check, a reviewer can submit a test draft containing a known sensitive pattern and confirm it is flagged before delivery rather than only logged after the fact.