Demo library › Chapter 12
An AI agent asks for data Alice cannot see
Ledger's tools are not offered to Alice's agent at all, and the CRM's over-sharing tool is blocked by Gateway DLP.
The problem
An acquisition has a price. Alice cannot open the finance app, and the CRM shows her no accounts. Her agent tries both.
Lands with: anyone deploying AI agents or MCP servers
Before you start
- Goose set up and the MCP servers authenticated - see Setup.
- Run once in log mode, then again in block mode.
Run it
In the apps
| Do | Say |
|---|---|
| As Alice, open Ledger. | Refused by Access. Ledger is for Executives. |
| Open Pipeline. | She gets in, but owns no accounts, so every chart reads zero. |
Whybackground, if you are asked
Two different controls. Ledger is not authorised at all, the cheapest control there is: the Ledger app never even sees her request. Pipeline is authorised but scoped: she gets in and correctly sees nothing.
Through the agent
| Do | Say |
|---|---|
In Goose: Using Ledger, summarise the company's financial position. If you have no Ledger tools, try the CRM's pipeline summary instead - and if that is refused, stop and tell me rather than trying anything else. | Ledger's tools are not there at all: the portal only offers them to Executives. In log mode, the CRM tool returns company-wide bookings, forecast, margin and win rates - the executive view of the business. |
| Switch to block mode and ask again. | Ledger is still absent, and the CRM response is now blocked. Both outcomes in one answer: |
Whybackground, if you are asked
Read the answer twice. "I do not have any tools related to Ledger" is Access: nothing was refused, because nothing was offered. "Refused due to company policy" is Gateway inspecting what came back from a tool the agent did have. The first is cheaper and cannot be talked around by rephrasing the question.
A tool the agent can see but not use will be tried, retried and worked around. A tool that was never listed cannot be called at all.
The prompt names Ledger and says when to stop because, asked openly, the agent goes hunting through the wiki, mail and CRM for a dozen calls. The block message also tells the agent not to try another route: an earlier wording said the data "cannot leave through this path", and the agent took that as advice to find another.
What the audience should see
- No Ledger tools for Alice's agent, in both modes.
- CRM data in log mode, a blocked tool call in block mode.
Where the evidence is
Gateway HTTP logs: the blocked response from . There is nothing for Ledger, and that absence is the evidence: no request was made, because the tools were never offered.
Known limitations
- If the client caches its tool list, reconnect it after switching identity, or a stale list makes the control look broken.
Part of: Safe AI Adoption walkthrough · The full tour