Every agent edit, on the record.
Version control for agent edits, inside the tools your teams already use. Agents edit Word documents live on SharePoint as tracked changes; every change is recorded, attributable, diffable, and revertible, in your tenant, under your key.
Windows, Mac and Word on the web. No Copilot license required. Any MCP client.
2.3 Power budget
The module shall operate from a nominal 12 V supply and shall not exceed 5 W4.5 W average, 6 W peak for no longer than 200 ms, under the load profile defined in Appendix B.
Compliance shall be demonstrated by the test method in section 7.2 using the fixture described in TR-114.
- Replace limit in 2.3
applied - Add test fixture ref
applied - Comment on Appendix B
applied - Update table 4 row 2
conflict - Rewrite 7.2 step 3
conflict
Agents can read your documents. They still can't edit them properly.
As of September 2026, Microsoft's Word tools for agents (in Agent 365 and Work IQ) let an agent create a new document, read a document's text and comments, and add or reply to comments. They do not edit an existing document in place, they do not write tracked changes, and they do not work inside a live co-authoring session.
So agents today either produce a new file you have to merge by hand, or a comment a human has to act on. Redtrail is the missing edit layer: the agent works through the user's own open document, and Word does the merging, the same way it does for a second human in the file.
What agents can do to a Word document today
- ✓Create a new document from HTML
- ✓Read plain text and comments
- ✓Add a comment or reply to one
- ✕Edit an existing document in place
- ✕Write the edit as a tracked change
- ✕Join a live co-authoring session
- ✕Keep a per-change history of what the agent did
Based on the published Word MCP server tool list in Microsoft Agent 365 (preview), September 2026. Redtrail adds the bottom four.
A seat in the document for your agent
An add-in in the user's Word session, a stateless relay, and any MCP client. The document never leaves SharePoint. The relay never keeps content. History is opt-in and encrypted with your key.
Open the document in Word
The add-in signs in silently with the user's Entra ID and registers the open document with the relay. One seat per person, several documents at once.
Connect your agent
Claude Code, Claude.ai, Cowork, Cursor or Copilot Studio signs in to the same relay with the same identity. Tool calls route to that user's open Word session.
Edits land as tracked changes
Reads are answered immediately. Writes re-resolve a stable anchor, verify the text they expect, and apply as revisions. Every write becomes a signed history event.
The mechanism, and the record
The co-authoring seat is how the agent gets into the document. The change history is why your quality, legal and engineering teams will let it.
A co-authoring seat
The agent edits through the user's own Word session, so Word handles merging with everyone else in the file. No file download, no re-upload, no lock.
Tracked changes, attributed
Every write is a revision with an author, so reviewers accept or reject it like any other. Auto-apply is only possible when tracking is on. That rule lives in the add-in, not in a setting.
Change history: log, blame, revert, replay
Each agent operation is an event with the exact anchor, the text it expected, and what it wrote. Point at any sentence and see which agent, which instruction, which session. Revert one event or replay a series onto a sibling document.
Stable anchors, never paragraph indices
Writes target content-control tags, heading paths, search hits with context hashes, comment ids or change ids. The anchor is re-resolved at execution time and the expected text is verified before anything is applied.
Never a silent overwrite
If a human changed the anchored text since the agent read it, the write is reported as a conflict and shown in the task pane. Conflicts are surfaced, never merged automatically.
Any MCP client
Claude Code (one-command plugin), Claude.ai and mobile, Cowork, Cursor, VS Code and Copilot Studio through a remote MCP connector. Registers with Microsoft Agent 365 as a bring-your-own MCP server.
Git-style accountability for documents
Word's tracked changes disappear on accept. SharePoint versions are whole-file and say only "user X edited". Redtrail keeps a per-change ledger of what each agent did, keyed to the document itself, so it survives rename, move, copy and Save As.
logEvery agent operation, grouped by session and instruction.
blameFor any range: which agent, which user, which instruction, when.
revertUndo one event as a new tracked change that references the original.
replayApply a series of events onto a template or sibling document; conflicts reported per event.
$ redtrail log --doc Power-Subsystem-Spec.docx --since 2d # wave 7 · "Tighten §2.3 power budget" · Claude Code on randys-macbook · via randy@ 01J9P…3KQ replace heading:2 Requirements/2.3 Power matched 14:02 01J9P…3KR insert search:"test method in section 7.2"#0 matched 14:02 01J9P…3KS comment contentControl:appendix-b matched 14:02 01J9P…3KT replace contentControl:table-4-row-2 conflict 14:02 01J9P…3KU replace heading:7 Verification/7.2 Method conflict 14:02 # base version 12.0 → result 13.0 · chain verified · 2 events not applied $ redtrail blame --doc Power-Subsystem-Spec.docx --anchor 'search:"6 W peak"' 01J9P…3KQ Claude Code · via randy@ "Tighten §2.3 power budget" 2026-09-03 14:02
Four questions every admin asks
Who can use it, what can it touch, what did it do, and how do I turn it off. Each has a one-click answer in the admin console, and the audit stream goes wherever your SIEM already listens.
Who can use it
- Seats by Entra ID group
- Agent and client allowlist per tenant
- Named devices: "Claude Code on randys-macbook"
What can it touch
- Site and library allowlists
- Sessions outside scope are refused at the relay
- Tenant policy for unattended fork decisions
What did it do
- Per-operation audit: user, agent, document, anchor, hash chain
- No content in the audit stream
- CSV export, webhook, Event Hub, Log Analytics, OpenTelemetry to Agent 365
How do I turn it off
- Kill switch per tenant, user, session and agent grant
- Live session list
- Export then hard-delete history, with a receipt
Who sees document content
Agent platforms process content in plaintext by design. Our relay never stores it. For the strictest tenants an end-to-end mode keeps the relay from seeing it at all.
| Agent | Path | Content visible to the relay |
|---|---|---|
| Claude Code, Cursor, Cowork with the local plugin | End-to-end mode (v1.1, on request) | No |
| Claude.ai, mobile, Cowork via remote connector | OAuth grant | Yes, in transit only. Zero retention. |
| Copilot Studio, Power Automate, other cloud agents | OAuth grant | Yes, in transit only. Zero retention. |
The v1 relay is TLS-only, stateless, keeps no payload logs, and signs audit metadata. The data-flow diagram and the full list of what we store is on the security page.
A seat is a sign-in
Billing is per person who connects an agent. The Word add-in itself is free on the Microsoft Marketplace.
Free
- One document per session
- Tracked-change edits from any MCP client
- Task-pane approval queue
- Session-local change log
Team
- Unlimited documents and sessions
- Hosted change history: log, blame, revert, replay
- Seats by Entra group, agent allowlist
- Kill switch, live session list
- Region choice: US or EU
Enterprise
- Customer-held history key in your Azure Key Vault
- Site and library allowlists
- Audit export: CSV, webhook, Event Hub, OpenTelemetry to Agent 365
- Self-hosted relay (Docker or Azure template)
- End-to-end mode for local agents
Frequently asked questions
Do the agent's edits show up as tracked changes?
Yes. Every write the agent makes is applied with change tracking on, so it appears as a revision that reviewers accept or reject like any other. If tracking is off, the agent's writes wait in the task-pane queue for a human to approve them one by one. Automatic application is only possible while tracking is on.
Who is the author of the tracked change?
In v1 the revision is authored by the person whose Word session the agent is working through, and the task pane and history record which agent and which instruction produced it ("Claude Code on randys-macbook, via Randy"). Revisions attributed to a dedicated agent identity require a Word session signed in as that agent, which is on the v2 roadmap.
Does your relay see my document content?
In the standard path, yes, in transit: the agent platform you chose processes document text in plaintext by design, and the relay carries it between the agent and your Word session over TLS. The relay is stateless and keeps no payload logs. History events are encrypted at rest under a per-tenant key, or under a key you hold in your own Key Vault on the Enterprise tier. An end-to-end mode for local agents such as Claude Code, where the relay only ever sees ciphertext, is planned for v1.1 and available to early customers on request.
Does it work on Mac and in the browser, or only on Windows?
All three. The add-in is built on Office.js, so the same build runs in Word for Windows, Word for Mac, and Word on the web. It is pinned to the lowest Word API level that supports tracked-change objects across the platforms your organisation runs.
Do we need a Microsoft 365 Copilot license?
No. Redtrail works through the user's own Word session and their existing Microsoft 365 sign-in. Registering the relay as a bring-your-own MCP server in Microsoft Agent 365 is optional and gives admins approval and observability inside the Microsoft 365 admin center; it is not required to use the product.
What happens to the history when someone copies the document?
Each document carries a UUID inside the file, so it keeps its history through rename, move, download and re-upload, and Save As. When a copy is detected (the original still exists at its old location), the person in the file is asked whether the copy should fork the history (keeping the parent's events up to that point) or start clean. Unattended sessions follow the tenant's default, which is to fork. We never merge two histories and we never block an edit while the question is open.
Can we export or delete the history?
Yes, per document and per tenant: export as a JSONL archive, pause, or hard-delete with a signed receipt. Tenant off-boarding is export-all then delete-all. On the Enterprise tier, revoking your key makes the stored history unreadable to anyone, including us.
Is there an on-premises or self-hosted option?
The relay is available self-hosted as a Docker image or an Azure deployment template on the Enterprise tier. The document itself always stays in your SharePoint; the only thing we host is the relay and, if you opt in, the encrypted history.
See an agent edit a live document while two people are in it
We are onboarding engineering-document, proposal and quality teams on SharePoint first. Leave a work email and we will send the install link, the security package and a 20-minute demo slot.