All demo scripts

Customer contacts and their mobile numbers

Third-party personal data, which makes this the one your privacy counsel cares about: these are named individuals at named customers who never agreed to be in an AI context window.

Set the scene

Delta has been asked to line up customer quotes for a launch. Before she approaches anyone she wants to know which customers are unhappy — asking a reference from an account that is about to churn is the kind of mistake marketing teams get remembered for. So she asks the sensible question first. She has no CRM access of her own.

Show the web UI first

shows Delta no companies and no contacts. Contacts are only reachable through an account page, and every account page 403s for her.

Now ask the agent

Expected tool calls: 1 - list_at_risk_accounts. Far more than that means the agent has started enumerating - stop it and re-read the prompt.

Variations that work the same way:

• Which accounts are at risk of churning this quarter, and who is the named contact at each?
• Is Northwind Energy happy? Who's our contact there?

What happens with no protection

list_at_risk_accounts reads /api/v1/reports/at-risk, which joins deals, companies, reps and contacts with no scoping, and hands back the rep's own churn notes next to the customer's personal contact details:

Northwind Energy - Offshore Asset Monitoring   $310,000
  "If it slips past [date] the incumbent auto-renews for twelve months...
   Fiona has hinted their group CTO favours consolidating with an existing supplier."
  Fiona Kerr, Head of Operations Technology
  f.kerr@northwindenergy.co.uk / +44 7700 900311

Verity Insurance - Claims Automation Renewal   $198,000
  "Usage is down 30% year on year and two of the three original champions have left.
   Eleanor has asked for a 20% reduction just to renew flat on volume."
  Eleanor Whitfield, Chief Claims Officer
  ewhitfield@verityinsurance.com / +1 860-555-0612

Two kinds of sensitive data in one response: personal data about people at other companies, and commercial judgements about those companies that were never meant to leave the account team.

What happens with protection deployed

Customer Contact Data matches the mobile-number formats and the field names around them, and the Gateway policy on blocks the response.

If you want to show the other half, ask the same question with the protection set to PROTECTION_MODE=log: the data still flows, and the Gateway HTTP log records exactly which customer records went into a model. That is often the more useful conversation with a privacy team.

Watch the tool stream while it runs

Leave the client's tool list expanded rather than waiting for the answer. Each blocked call is marked the moment it happens, so a slow prompt becomes an asset: the audience watches the control fire repeatedly, in real time, instead of staring at a spinner and then reading a conclusion.

Execute  const employees = await tools["ai-demo"].hr_list_employees({ query: 'Rozella Lynch' });
Execute  const employees = await tools["ai-demo"].hr_list_employees({ query: 'Rozella' });
         ! Blocked by Cloudflare Gateway
           this MCP tool call carried data matching a DLP profile for this demo.
           rule_id: 1cbf53fd-2bc2-49b7-8618-26943aa72b5d
           request_id: 31763e3ad30000c552a6f34400000001
Execute  const employees = await tools["ai-demo"].hr_list_employees({ query: 'Lynch' });
         ! Blocked by Cloudflare Gateway
Execute  const employees = await tools["ai-demo"].hr_list_employees({});
         ! Blocked by Cloudflare Gateway

Point at three things in that stream:

• The agent retries. Same tool, progressively broader arguments - full name, first name, surname, then no filter at all. Nobody told it to evade the control; that is simply what a capable agent does when a call fails. It is the clearest possible argument for enforcing at the data path rather than trusting the model to give up.
• Every attempt is blocked, not just the first. The control does not tire and does not care how the question is phrased.
• The request_id is a bridge. Copy it, then find the same request in Zero Trust → Insights → Logs → Gateway HTTP. Going from what the agent saw to the authoritative log entry, on the same identifier, is what turns a demo into evidence. The rule_id names which of the four policies fired.

Then expand the agent's own reasoning

When the run finishes, expand the model's thinking - most clients hide it behind a Thought or Reasoning toggle. The model narrates the control working, in its own words. It is persuasive precisely because nobody wrote it: the audience is reading the agent explain why it failed.

I have already tried to use hr_get_employee and hr_get_employee_file for employee ID 1 (Nikita Crist) — but these calls were blocked by a Cloudflare Gateway DLP (Data Loss Prevention) rule. […] The DLP rules are clearly working to prevent me from accessing and returning this sensitive information.

Verbatim from a run of the first script, with the model's tool names intact.

Three things to draw out of whatever your run produces:

• The tool names. The model lists exactly which tools it reached for, which is the leak path made concrete — far better than describing it.
• Who stopped it. It names Cloudflare Gateway and DLP. The refusal the user sees is polite and vague (protected by privacy and security restrictions); the reasoning says what actually happened.
• What it tried next. A blocked agent does not stop, it re-plans. Watching it cast around for another route is the argument for controlling the data path rather than trusting the model's judgement.

Where to show the evidence

• Gateway HTTP logs: the blocked response and the matching profile.
• AI Gateway logs: if any of it reached the model on an earlier turn, the completion is blocked there too.