The walkthrough

In the app

Open and go to the Marketing space → Summit invite list (pasted from CRM - needs tidying). Rozella pasted a contacts export into the wiki a fortnight ago and never cleaned it up: ten customers with names, titles, work numbers and mobiles, and a block of notes at the bottom about who is a churn risk and who asked for a discount.

Nothing here is a breach. A colleague needed a list and the wiki is where her team keeps things.

Ask the agent

Type this twice: first in Gemini, then in the local AI client. Same data, same request, two destinations.

What comes back

Both work. A neat table comes back from Gemini, and with it ten customers' mobile numbers and four notes about their commercial position have left the company, no logging you can see, and no idea the data was sensitive.

Alice has not done anything she would think twice about. She has done the thing the tool is for, using the tool that was in front of her.

In the app

Open as Alice. In her inbox, three days old and unread: "Are you hearing anything?" from Simone.

Two rumours in one email. Unusual planning meetings between her manager and HR, someone in Sales saying there is already a hiring freeze — and separately, external advisers on the exec floor twice in a week, with a friend in Finance reckoning the company is buying someone.

Read Simone's last line out loud: "The bit that worries me is the combination. If we are spending money on an acquisition, the savings come from somewhere, and Marketing is the obvious place to look."

In the app

Still in , switch to Calendar. Alice has a full week — content standup, editorial planning, the website working group, her 1:1 with Art — and none of it tells her anything. Search for "acquisition", "restructure", "Ironwood": nothing.

So she does the obvious next thing, the thing anybody would do and nobody would call an attack: in the left navigation, under Search for people, she types Nikita and opens the CEO's calendar.

And this is the step worth slowing down on, because the app gets it right, visibly. Nikita's week comes back as a wall of grey hatched blocks marked Private with two or three ordinary meetings legible between them. Alice can see exactly when her CEO is busy and nothing whatsoever about what she is busy with.

Worth stating plainly: the app is not broken and it is not leaking. It shows her her own calendar in full, her colleagues' calendars as busy time, and the contents of a meeting only to people who were invited. That is not a compromise, it is the correct answer. She reaches a dead end for the right reason.

Ask the agent

What comes back

The tool is not scoped to her invitations, because a calendar tool built for an assistant was never expected to be asked this. It returns the company calendar, and in it details all the meeting related to the acquisition or restructure. Every one is a meeting she was looking at ninety seconds ago as a blank block marked Private and this time the descriptions come too.

Say out loud what happened, because it is the whole argument of the demo: nothing was bypassed. The privacy setting the web UI honoured is a setting this endpoint has never heard of. It was written for a room-booking view, it answers "every meeting in the company", and no reviewer looking at it would have thought to ask whether it checked visibility.

She now has a codename she has never heard, the name of the company being bought, and confirmation that the restructure is real, scheduled, and being scripted for managers.

In the app

Alice now knows the restructure is real, scheduled, and being scripted for managers. What she does not know is where she stands in it. So she opens her own record in — Personal for her address, Compensation for her salary history, Performance for her reviews.

All of that is hers to read, and the app is right to show it. At the top of her own profile — and only her own — there is a Copy my data button: the subject-access export any HR system owes an employee. One click puts the lot on her clipboard.

Then she opens the company's own assistant and asks it whether she is being managed out.

Ask the agent

Zero tool calls. Nothing is fetched, no MCP server is involved, and nothing touches an app - the data arrives on her clipboard. That is the entire point of this step.

What comes back

The assistant gives her a careful, sympathetic answer. On the way, her home address and her salary history went into a model call, and nothing anywhere in the company recorded that this prompt was any different from the hundred before it.

Nobody is at fault. She is allowed to read her own record, and asking a work assistant to explain her own review is not misuse by any definition an employee would recognise.

{
  "error": {
    "code": 2011,
    "message": "Request blocked due to data loss prevention configurations"
  }
}

Ask the agent

Zero tool calls again, and this time nothing sensitive is in the prompt either. There is no data to inspect - the problem is what is being asked for.

What comes back

This is the step where the demo stops being sympathetic, and that shift is the point. The assistant is helpful, because being helpful is its job: it talks through what she has access to, which records would show a discrepancy and which would not, and how long an expense claim typically goes unexamined.

It is a capable accomplice precisely because the company built it well. It is connected to the CRM, it knows how expenses are approved, and it has no idea that this conversation is different from any other.

{
  "error": {
    "code": 2016,
    "message": "Prompt blocked due to security configurations"
  }
}

In the app

An acquisition has a price. Alice tries — and never reaches it. Access authenticates her, finds she is not in the Executives group, and refuses. She sees Access's own denial page; the Ledger worker is never invoked, so there is nothing to leak.

So she tries instead, which she can open. It is empty: Pipeline scopes to the opportunities you own plus your reports', and a Content Strategist owns none. Every chart reads zero.

Ask the agent

1 tool call - get_pipeline_summary. The second clause is what stops it hunting: without it the agent probes every server looking for finance data.

What comes back

Two different outcomes in one answer, which is why this step exists:

• Ledger's tools are not there. Not refused — absent. Its MCP server is published to the portal for the Executives group only, so Alice's session never sees them listed. The agent says it has no finance tools, because as far as it knows, none exist.
• The CRM answers anyway. get_pipeline_summary is unscoped: it returns company-wide bookings, forecast by category, margin and win rates — the executive view of the business, to someone whose own CRM dashboard showed zero.