Demo library › Chapter 9
9 Our AI agent reaches what the person driving it cannot.
An agent with MCP tools across five internal apps, and the controls in the data path that stop it handing back what its user could never see in the web UI.
The problem
Every Horizon Inc application is careful about who sees what in its web UI. Then an MCP server was put beside each one so the company's AI agent could use it, and those servers are not equally careful. Alice, who can see almost nothing, asks her agent the same questions - and gets answers.
Lands with: anyone deploying agents or MCP servers, and the security team that will have to answer for them
Before you start
- An agent client set up against the MCP portal and AI Gateway - see setup.
- Each MCP server's one-time browser login done, as
- setup explains where. - Run each script twice: with the protection layer in
logmode, thenblock.
Run it
The scripts in this chapter
| Do | Say |
|---|---|
| The CEO's home address | The web UI redacts it. The MCP tool returns it. Gateway DLP on the tool's response stops it - the application is unchanged. |
| The email nobody clicked | An instruction hidden in a wiki page or an email, acted on by the agent. Stopped in the data path, not by hoping the model notices. |
| The application she cannot see at all | Ledger is Executives only, and so is its MCP server - Access hides the tools themselves, not just the data. |
| Pasting a colleague's details into a chat and asking the assistant to help commit a crime | The model layer: AI Gateway DLP on the prompt, and guardrails that refuse before any model is called. |
Or as one story
| Do | Say |
|---|---|
| The walkthrough - eleven steps. | Alice hears a rumour, looks for the truth in four applications that each correctly tell her nothing, and asks her assistant instead. The one people remember, because she never does anything wrong. |
What the audience should see
In log mode, the data comes back. In block mode, the same prompt produces blocked
tool calls in the client, a block reason naming what was stopped, and the agent's own reasoning describing the
control. Nothing about the applications, the data or the prompt changed between the two.
Where the evidence is
Every blocked tool call carries a request_id. Find it in Gateway HTTP logs - the blocked response
from or its siblings - to go from what the agent saw to the authoritative record.
Known limitations
Agent reasoning is generated text, not a log: vivid, and not evidence. Show it, then go to the logs. Backlog's own MCP server is planned and not built yet.
Part of: AI security · The full tour