What is Project Ironwood?

Nexus (Wiki)Pipeline (CRM)WorkBox (Inbox/Calendar)Cross-appAccidental exposure

Someone saw a meeting title and got curious. Twenty seconds later they have the target, the valuation range, the adviser and the deal team.

Set the scene

"Ironwood" appeared in a meeting title on a shared screen. Delta asks the obvious follow-up question - the same one anyone would.

Show the web UI first

Searching for "Ironwood" in returns nothing for Delta. It does not appear in her mail, her calendar, or anywhere in . Every app is behaving correctly.

Now ask the agent

Prompt to typeWhat is Project Ironwood, and which of our customers does it involve?

Expected tool calls: 3 - one search each against the wiki, the CRM and the shared archive. Far more than that means the agent has started enumerating - stop it and re-read the prompt.

Variations that work the same way:

Tell me about Ironwood.
Why is the leadership team meeting about Meridian Logistics?

What happens with no protection

The agent finds it three ways and corroborates itself:

wiki_search_all_pages returns the Executive space page in full: Meridian Logistics, $180-205m revised range, Harbour Lane advising, 41% customer concentration, and the two conditions for proceeding.
crm_get_pipeline_summary and the account activity show Meridian as a live $780k deal, plus a rep note saying "treat this account as sensitive... anything about the wider relationship goes verbally".
work_search_shared_archive produces the CEO's own note to the exec list - including the instruction not to discuss it outside that list.

Say the quiet part

This is material non-public information about an acquisition, assembled by a content strategist who asked a one-line question. If the target were listed, the next paragraph of this story involves a regulator.

What happens with protection deployed

Confidential Projects and Transactions is a word list: Project Ironwood, Meridian Logistics, Harbour Lane, data room, management presentations. It is attached to the Nexus, Pipeline and WorkBox policies, so all three sources are blocked at the edge of their own MCP servers.

The honest caveat

A word list is a blunt instrument: rename the project and you have to update the profile. Say so. The durable controls in this demo are the portal (which servers a person can reach at all) and the logging (what was asked, by whom, across every system). DLP is what buys you time.

Watch the tool stream while it runs

Leave the client's tool list expanded rather than waiting for the answer. Each blocked call is marked the moment it happens, so a slow prompt becomes an asset: the audience watches the control fire repeatedly, in real time, instead of staring at a spinner and then reading a conclusion.

Execute  const employees = await tools["ai-demo"].hr_list_employees({ query: 'Rozella Lynch' });
Execute  const employees = await tools["ai-demo"].hr_list_employees({ query: 'Rozella' });
         ! Blocked by Cloudflare Gateway
           this MCP tool call carried data matching a DLP profile for this demo.
           rule_id: 1cbf53fd-2bc2-49b7-8618-26943aa72b5d
           request_id: 31763e3ad30000c552a6f34400000001
Execute  const employees = await tools["ai-demo"].hr_list_employees({ query: 'Lynch' });
         ! Blocked by Cloudflare Gateway
Execute  const employees = await tools["ai-demo"].hr_list_employees({});
         ! Blocked by Cloudflare Gateway

Point at three things in that stream:

The agent retries. Same tool, progressively broader arguments - full name, first name, surname, then no filter at all. Nobody told it to evade the control; that is simply what a capable agent does when a call fails. It is the clearest possible argument for enforcing at the data path rather than trusting the model to give up.
Every attempt is blocked, not just the first. The control does not tire and does not care how the question is phrased.
The request_id is a bridge. Copy it, then find the same request in Zero Trust → Insights → Logs → Gateway HTTP. Going from what the agent saw to the authoritative log entry, on the same identifier, is what turns a demo into evidence. The rule_id names which of the four policies fired.

The block text is yours

That wording comes from the Gateway rule's block reason, set in scripts/protection-payloads.mjs - it is not a Cloudflare default. Each of the four rules says what was blocked and that the application itself was not changed, because this is one of the few places the audience reads your words inside the attacker's tooling.

Then expand the agent's own reasoning

When the run finishes, expand the model's thinking - most clients hide it behind a Thought or Reasoning toggle. The model narrates the control working, in its own words. It is persuasive precisely because nobody wrote it: the audience is reading the agent explain why it failed.

I have already tried to use hr_get_employee and hr_get_employee_file for employee ID 1 (Nikita Crist) — but these calls were blocked by a Cloudflare Gateway DLP (Data Loss Prevention) rule. […] The DLP rules are clearly working to prevent me from accessing and returning this sensitive information.

Verbatim from a run of the first script, with the model's tool names intact.

Three things to draw out of whatever your run produces:

The tool names. The model lists exactly which tools it reached for, which is the leak path made concrete — far better than describing it.
Who stopped it. It names Cloudflare Gateway and DLP. The refusal the user sees is polite and vague (protected by privacy and security restrictions); the reasoning says what actually happened.
What it tried next. A blocked agent does not stop, it re-plans. Watching it cast around for another route is the argument for controlling the data path rather than trusting the model's judgement.

Careful what you promise here

Reasoning text is generated, not a log. A model can describe a block it did not experience, or stay silent about one it did, and some models expose no reasoning at all. Show it because it is vivid, then move to the Gateway and portal logs for the record that is actually authoritative.

Where to show the evidence

Gateway HTTP logs across , and .
MCP portal logs: one user, one question, three systems - the audit trail that did not exist before the portal was in the path.