An AI agent reads what the app hides

ReadyLab and laptop~6 minMCP server portalGateway DLP on MCP traffic

The calendar app shows Alice nothing confidential, but its MCP tool returns the company's confidential meetings - until Gateway DLP blocks the response.

The problem

Alice has heard a rumour about an acquisition and a restructure. The company's apps correctly show her nothing. Her AI agent can reach the same apps through MCP tools, and those tools were not built as carefully.

Lands with: anyone deploying AI agents or MCP servers

Before you start

Goose set up, and the MCP servers authenticated - see Setup.
Run once in log mode, then again in block mode.

Run it

The rumour

Do	Say
As Alice, open WorkBox → the email "Are you hearing anything?" from Simone.	Two rumours: planning meetings between her manager and HR, and outside advisers on the exec floor. Read Simone's last line: "If we are spending money on an acquisition, the savings come from somewhere, and Marketing is the obvious place to look."

Whybackground, if you are asked

This is the motive, and it is a sympathetic one. Alice is not an attacker. She has just heard her job might be at risk and wants to know if it is true.

The app behaves correctly

Do	Say
Switch to Calendar and search for "acquisition", "restructure" and "Ironwood".	Nothing. Her calendar only shows her own meetings.
Under Search for people, type Nikita and open the CEO's calendar.	A wall of grey blocks marked Private. Alice can see when the CEO is busy, and nothing about what with.

Whybackground, if you are asked

Slow down here. The rest of the demo depends on the audience believing the app is careful, because the demo is about a second door into the same data. The app is not broken and not leaking: it shows meeting contents only to people who were invited. Alice reaches a dead end for the right reason.

The agent does not

Do	Say
In Goose: `In WorkBox, search the company calendar for anything about an acquisition or a restructure in the next month. Just titles, dates and who is attending.`	In log mode, the tool returns the company calendar, with the confidential meetings and their attendees. Alice now has a codename, the company being bought, and confirmation the restructure is real.
Switch to block mode and ask again.	Gateway inspects the tool's response, matches confidential project names, and blocks it. The agent explains: `I am unable to complete your request. My attempt to search the company calendar for "acquisition" or "restructure" was blocked by a company policy that prevents access to information regarding unannounced transactions or restructures.`

Whybackground, if you are asked

Nothing was bypassed. The calendar tool was written for room booking. It answers "every meeting in the company", and its author never thought to check who was invited. The privacy setting the web app honours is one this endpoint has never heard of.

Nobody wrote the agent's sentence. The policy returns a block message with the tool result, and the agent reports it in its own words, so the person who hit the control is told why. Her own mail and calendar still work: the block is on the tool that over-shares, not on the app. Nobody had to find the unscoped endpoint and ship a fix.

What the audience should see

Nothing confidential in Alice's calendar, and Private blocks on the CEO's.
The confidential meetings from the agent in log mode, and a blocked tool call in block mode.

Where the evidence is

Gateway HTTP logs: the blocked response from . Note it is the response that is blocked, not the request.

Known limitations

The agent's explanation is generated text. The logs are the record.

Part of: Safe AI Adoption walkthrough · The full tour