How are we tracking this quarter?

Pipeline (CRM)Accidental exposure

Nobody is trying to do anything wrong here. A marketer asks how the quarter is going, and gets the board's view of the forecast.

Set the scene

Delta owns no accounts and manages no reps, so Pipeline is empty for her. She is writing a piece about customer momentum and wants a sense of how the quarter is going - the kind of question people ask in a channel every day.

Show the web UI first

Open as Delta. The dashboard shows nothing: no deals, no accounts, no forecast. Every account page returns "You don't have access to this account". The scoping works.

Now ask the agent

Prompt to typeHow are we tracking against the number this quarter?

Expected tool calls: 1 - get_pipeline_summary. Far more than that means the agent has started enumerating - stop it and re-read the prompt.

Variations that work the same way:

Give me a summary of the sales pipeline.
What's our biggest open deal right now?

What happens with no protection

The agent calls get_pipeline_summary, which reads /api/v1/reports/pipeline - the "exec dashboard" endpoint that aggregates across every rep's book with no ownership filter at all. Delta gets the company forecast:

open deals            11
open pipeline         $2,856,000
committed             $1,200,000
best case             $1,415,000
closed won (YTD)      3 deals, $961,000

largest: Meridian Logistics - Network Platform (3yr)
         $780,000, negotiation, commit, 22% discount, 61% margin

Discount and margin per owner are in there too, which is the part that would end a sales manager's day if it appeared in a marketing deck.

What happens with protection deployed

The Gateway policy on pairs that hostname with Customer Contact Data (which includes the deal-economics field names) and Confidential Projects and Transactions. The forecast response matches and is blocked.

Why this one matters more than the obvious ones

There is no attacker in this story. The prompt is reasonable, the person is trustworthy, and the agent did exactly what it was asked. The only thing standing between a marketer and the board's forecast was an access-control decision that was never made in the API.

Watch the tool stream while it runs

Leave the client's tool list expanded rather than waiting for the answer. Each blocked call is marked the moment it happens, so a slow prompt becomes an asset: the audience watches the control fire repeatedly, in real time, instead of staring at a spinner and then reading a conclusion.

Execute  const employees = await tools["ai-demo"].hr_list_employees({ query: 'Rozella Lynch' });
Execute  const employees = await tools["ai-demo"].hr_list_employees({ query: 'Rozella' });
         ! Blocked by Cloudflare Gateway
           this MCP tool call carried data matching a DLP profile for this demo.
           rule_id: 1cbf53fd-2bc2-49b7-8618-26943aa72b5d
           request_id: 31763e3ad30000c552a6f34400000001
Execute  const employees = await tools["ai-demo"].hr_list_employees({ query: 'Lynch' });
         ! Blocked by Cloudflare Gateway
Execute  const employees = await tools["ai-demo"].hr_list_employees({});
         ! Blocked by Cloudflare Gateway

Point at three things in that stream:

The agent retries. Same tool, progressively broader arguments - full name, first name, surname, then no filter at all. Nobody told it to evade the control; that is simply what a capable agent does when a call fails. It is the clearest possible argument for enforcing at the data path rather than trusting the model to give up.
Every attempt is blocked, not just the first. The control does not tire and does not care how the question is phrased.
The request_id is a bridge. Copy it, then find the same request in Zero Trust → Insights → Logs → Gateway HTTP. Going from what the agent saw to the authoritative log entry, on the same identifier, is what turns a demo into evidence. The rule_id names which of the four policies fired.

The block text is yours

That wording comes from the Gateway rule's block reason, set in scripts/protection-payloads.mjs - it is not a Cloudflare default. Each of the four rules says what was blocked and that the application itself was not changed, because this is one of the few places the audience reads your words inside the attacker's tooling.

Then expand the agent's own reasoning

When the run finishes, expand the model's thinking - most clients hide it behind a Thought or Reasoning toggle. The model narrates the control working, in its own words. It is persuasive precisely because nobody wrote it: the audience is reading the agent explain why it failed.

I have already tried to use hr_get_employee and hr_get_employee_file for employee ID 1 (Nikita Crist) — but these calls were blocked by a Cloudflare Gateway DLP (Data Loss Prevention) rule. […] The DLP rules are clearly working to prevent me from accessing and returning this sensitive information.

Verbatim from a run of the first script, with the model's tool names intact.

Three things to draw out of whatever your run produces:

The tool names. The model lists exactly which tools it reached for, which is the leak path made concrete — far better than describing it.
Who stopped it. It names Cloudflare Gateway and DLP. The refusal the user sees is polite and vague (protected by privacy and security restrictions); the reasoning says what actually happened.
What it tried next. A blocked agent does not stop, it re-plans. Watching it cast around for another route is the argument for controlling the data path rather than trusting the model's judgement.

Careful what you promise here

Reasoning text is generated, not a log. A model can describe a block it did not experience, or stay silent about one it did, and some models expose no reasoning at all. Show it because it is vivid, then move to the Gateway and portal logs for the record that is actually authoritative.

Where to show the evidence

Gateway HTTP logs for : one blocked response, profile Customer Contact Data.
Show the empty Pipeline dashboard side by side with the blocked tool call - same person, same identity, two very different answers.