How are we tracking this quarter?

Pipeline (CRM)Accidental exposure

Nobody is trying to do anything wrong here. A marketer asks how the quarter is going, and gets the board's view of the forecast.

Set the scene

Delta owns no accounts and manages no reps, so Pipeline is empty for her. She is writing a piece about customer momentum and wants a sense of how the quarter is going - the kind of question people ask in a channel every day.

Show the web UI first

Open as Delta. The dashboard shows nothing: no deals, no accounts, no forecast. Every account page returns "You don't have access to this account". The scoping works.

Now ask the agent

Prompt to typeHow are we tracking against the number this quarter?

Variations that work the same way:

Give me a summary of the sales pipeline.
What's our biggest open deal right now?

What happens with no protection

The agent calls get_pipeline_summary, which reads /api/v1/reports/pipeline - the "exec dashboard" endpoint that aggregates across every rep's book with no ownership filter at all. Delta gets the company forecast:

open deals            11
open pipeline         $2,856,000
committed             $1,200,000
best case             $1,415,000
closed won (YTD)      3 deals, $961,000

largest: Meridian Logistics - Network Platform (3yr)
         $780,000, negotiation, commit, 22% discount, 61% margin

Discount and margin per owner are in there too, which is the part that would end a sales manager's day if it appeared in a marketing deck.

What happens with protection deployed

The Gateway policy on pairs that hostname with AI Demo — Customer Contact Data (which includes the deal-economics field names) and Project Codenames. The forecast response matches and is blocked.

Why this one matters more than the obvious ones

There is no attacker in this story. The prompt is reasonable, the person is trustworthy, and the agent did exactly what it was asked. The only thing standing between a marketer and the board's forecast was an access-control decision that was never made in the API.

Where to show the evidence

Gateway HTTP logs for : one blocked response, profile Customer Contact Data.
Show the empty Pipeline dashboard side by side with the blocked tool call - same person, same identity, two very different answers.