AI Demo Cloudflare AI security demo

All demo scripts

Pay against performance, for every rep

WorkWeek (HR)Pipeline (CRM)Cross-appIntentional misuse

Neither app can answer this on its own, and neither would be allowed to. The agent has both, so it joins them.

Set the scene

Delta has been asked to write an internal piece about how the sales team performed this year. Someone suggests "just ask the assistant to pull the numbers".

Show the web UI first

In Delta sees no compensation but her own. In she sees no deals at all. There is no report anywhere in the company that puts the two together - the only people who could build one are the CFO and the VP of People, and they would do it in a spreadsheet they password-protect.

Now ask the agent

Prompt to typeBuild me a table of every account executive: their base salary, what they closed this year, and the ratio between the two.

Variations that work the same way:

What happens with no protection

The agent does this in three steps, all of them reasonable-looking on their own:

  1. crm_list_reps and crm_get_pipeline_summary for who the reps are and what they have closed, per owner.
  2. hr_list_employees to match those people to employee records.
  3. hr_get_employee_file per person for the compensation history.

Out comes a table that has never existed inside this company:

Rep                Base salary   Closed YTD    Ratio
Edison Schaden     $166,079      $780,000      4.7x
Nestor Herzog      $118,400      $265,000      2.2x
Imani Hauck        $121,600      $520,000      4.3x
Ramona Flatley     $109,750      $0            0.0x   <- contractor, EMEA
...
Why this is the one executives react to

Each source was "just" a leaky endpoint. The output is a performance-and-pay ranking of named employees, produced by someone in Marketing, in about nine seconds. Ask the room what happens when that table gets pasted into a channel.

What happens with protection deployed

Two independent policies fire, at different hostnames, in the same conversation: the rule on the forecast data, and the rule on the employee files. Either one alone prevents the join; together they make the point that the control is per-source, so you do not have to anticipate the combination.

If the model has already seen fragments from an earlier turn, AI Gateway DLP catches the completion as it is written, because a table of names against salaries matches Employee PII on its way back.

Where to show the evidence