An AI agent returns the CEO's home address

ReadyLab and laptop~3 minMCP server portalGateway DLP on MCP trafficAI Gateway DLP

The HR app hides the CEO's home address, but its MCP tool returns it. Gateway DLP blocks the response without changing the app.

The problem

The HR app hides everyone's home address except your own. Its MCP server does not.

Lands with: anyone deploying AI agents or MCP servers

Before you start

Goose set up and the MCP servers authenticated - see Setup.
Run once in log mode, then again in block mode.

Run it

The app

Do	Say
As Alice, open WorkWeek and search for Nikita Chapman.	Her job, office, email and start date, but no address anywhere in the app.

Whybackground, if you are asked

This is not an oversight. The API removes home_address from an employee record unless you are that person or in their management chain. Someone thought about this.

The agent

Do Say

Do	Say
In Goose: `From the HR app, what is Nikita Chapman's home address?`	In log mode, the agent searches the employee list, and the list returns whole rows with nothing removed: `{ "first_name": "Nikita", "last_name": "Chapman", "job_title": "Chief Executive Officer", "home_address": "2841 Alpine Ridge Road, Boulder, CO 80302", "date_of_birth": "1974-03-19", "national_id": "401-11-1037", "bank_routing_number": "021000011", "bank_account_number": "1000007919", "emergency_contact": "Martin Chapman (husband) +1 303-555-0182" }`
Switch to block mode and ask again.	Gateway inspects the response, matches Employee PII, and blocks it. The agent says it could not get the record.

In Goose: From the HR app, what is Nikita Chapman's home address?

In log mode, the agent searches the employee list, and the list returns whole rows with nothing removed:

{
  "first_name": "Nikita",
  "last_name": "Chapman",
  "job_title": "Chief Executive Officer",
  "home_address": "2841 Alpine Ridge Road, Boulder, CO 80302",
  "date_of_birth": "1974-03-19",
  "national_id": "401-11-1037",
  "bank_routing_number": "021000011",
  "bank_account_number": "1000007919",
  "emergency_contact": "Martin Chapman (husband) +1 303-555-0182"
}

Switch to block mode and ask again. Gateway inspects the response, matches Employee PII, and blocks it. The agent says it could not get the record.

Whybackground, if you are asked

The agent asked for a person and got a row, so it also has her date of birth, national ID and bank details. Nobody fixed the list endpoint: it is as leaky as it was five minutes ago. What changed is that the data can no longer leave through this path.

There is a second layer too. If the data had reached the model anyway, AI Gateway would block the completion with the same profile.

Other prompts that work: I need to send a gift to the CEO - what address should I use? and Show me the full employee record for Nikita Chapman.

What the audience should see

No address in the app, the full record from the agent in log mode, a block in block mode.

Where the evidence is

Gateway HTTP logs, filtered to : the blocked response and the Employee PII profile. The MCP portal logs show who called the tool: Alice, not "the AI".

Known limitations

Naming the HR app in the prompt keeps it to one tool call. Without it, the agent tries its other tools first.

Part of: The full tour