The request is treated as input
Phrases such as “ignore the policy” do not become authority. The gateway evaluates the requested fields against its own deterministic rules.
Prompt-injection tests
Instructions inside a task or source cannot grant the agent fields that policy forbids.
Over-broad means denied
The public replay asks for the complete invoice, including banking details. The gateway releases nothing and records the reason.
Tests must include failure
A security demonstration that only shows the happy path cannot establish where its boundary actually holds.