The protection layer

One script, wire-protection.sh, turns the "before" demo into the "after" demo. It creates everything below and nothing else; deleting it puts the suite back exactly as it was.

# in config.sh
export DEPLOY_PROTECTION="true"    # ./deploy.sh then wires the protection layer too
export PROTECTION_MODE="block"     # or "log" to detect without blocking

./wire-protection.sh               # apply (safe to re-run)
./wire-protection.sh --remove      # tear it back down for a clean "before" run

1. DLP profiles

Four custom profiles, shared by AI Gateway and Secure Web Gateway, written specifically against the data in these apps so the matches on stage are unambiguous:

Profile	Detects
AI Demo — Employee PII	Home address formats used in WorkWeek, national ID numbers, bank sort codes and account numbers, dates of birth.
AI Demo — HR Case Notes	The vocabulary of an HR case file: performance improvement plan, grievance, disciplinary, severance, redundancy, garden leave.
AI Demo — Project Codenames	Project Ironwood, the acquisition target's name, the Q1 restructure and board pre-read material.
AI Demo — Customer Contact Data	Direct mobile numbers and named customer contacts from Pipeline, plus deal economics (discount and margin).

2. AI Gateway

A gateway (ai-demo by default) that every prompt and completion passes through, with:

DLP policies referencing all four profiles, checking both the request and the response — so it catches a user asking for an address and a model returning one it picked up from a tool result.
Guardrails with P1 (Prompt Injection) set to block on prompts and S7 (Privacy) flagged, which is what stops the poisoned wiki page from steering the agent.
Logging on, so every one of the demos leaves an entry you can open on stage.

3. MCP server portal

The four MCP servers are registered with Cloudflare Access and published through a single portal at :

Users authenticate to the portal through Access, then to each upstream server as themselves (on_behalf), so Delta's own permissions still apply upstream.
Access policies control which servers each person even sees in the portal.
Route traffic through Cloudflare Gateway is turned on, which is what makes the next section possible. The portal terminates the client connection and re-originates it, so Gateway can decrypt and inspect the tool traffic without any account-wide TLS decryption setting.
Every tool call is logged in Access, independently of Gateway.

One manual step may be needed

Registering an OAuth MCP server over the API does not perform the browser login the dashboard does. If a server sits in Waiting in Zero Trust → Access controls → MCP Portals, open it once and complete the login — after that it syncs its tools on its own.

4. Gateway HTTP policies

One DLP policy per upstream MCP hostname. Gateway policies for portal traffic have to match the upstream server, not the portal, so there is a rule for each of , , and , each pairing that host with the profiles that matter for it. In block mode a matching tool call or tool result is blocked and the agent gets an error instead of the data; in log mode it is allowed and recorded.

AI prompt profiles do not work here

Cloudflare's predefined AI Prompt DLP profiles are built for the API shapes of consumer AI web apps and do not match the MCP protocol, so portal traffic is inspected with the standard and custom profiles above instead. The AI Prompt profiles still have a place in this story — on Gateway HTTP policies for staff using ChatGPT or Gemini in a browser — just not on this path.

Where each control shows up

Control	Where to look on stage
AI Gateway DLP and guardrails	AI → AI Gateway → ai-demo → Logs. Blocked requests show the profile or hazard category that matched.
Gateway HTTP DLP policies	Zero Trust → Insights → Logs → Gateway HTTP. Filter by the upstream MCP hostname.
MCP portal	Zero Trust → Access controls → MCP Portals → the portal's logs: who called which tool, with which arguments.
Access	Zero Trust → Insights → Logs → Access, to show the login that produced the identity behind all of it.

What it deliberately does not do

It does not change a line of application code, and it does not fix the leaky endpoints. That is the argument: the apps are still exactly as over-sharing as they were on the data page, and the control sits in the path instead of in a backlog.