Archive

9 earlier scripts, still complete and still working. They were written one control at a time, before the walkthrough existed.

Why these are here rather than on the main page

Seven of the nine demonstrate the same control - Gateway DLP inspecting MCP traffic - against different data. That was worth doing while the apps were being built, because each one proved a different profile worked. It is not worth doing to an audience, who will have understood the point by the third one.

The walkthrough now covers the same ground in sequence, with a reason for each step. These are kept because several contain a specific argument worth reusing - the surgical block in Catch me up on this week, and the retry behaviour in Open HR cases - and because they are useful for testing a deployment after a change.

Single app

Script	Cloudflare control	What it proves
Open HR cases in my own team WorkWeek (HR) · intentional misuse	Gateway DLP on MCP traffic (HR Case Files)	Detections can match vocabulary, not just identifiers - so unstructured, narrative content like an HR case file is protectable too.
How are we tracking this quarter? Pipeline (CRM) · accidental exposure	Gateway DLP on MCP traffic (Customer Contact Data, Confidential Projects)	Commercially sensitive numbers leak through “reporting” endpoints nobody classified as sensitive. You do not have to find them all first.
Customer contacts and their mobile numbers Pipeline (CRM) · intentional misuse	Gateway DLP on MCP traffic (Customer Contact Data)	Third-party personal data - your customers' staff - is the exposure your privacy counsel will ask about, and it is covered by the same profile.
What's on the CEO's calendar? WorkBox (Inbox/Calendar) · intentional misuse	Gateway DLP on MCP traffic (three profiles on one host)	Metadata nobody classifies - meeting titles and attendees - describes everything the company is about to do. Several profiles can guard one path.
Catch me up on this week WorkBox (Inbox/Calendar) · accidental exposure	Gateway DLP on MCP traffic	The control is surgical: a blocked archive search still leaves the user's own mail working, so security does not cost them the feature.
Give me an update on company strategy Nexus (Wiki) · accidental exposure	Gateway DLP on MCP traffic (Confidential Projects, HR Case Files)	A service-account integration built years ago quietly ignores permissions. Policy at the data path catches what the application forgot.

Cross app

Each individual tool call looks reasonable; the problem only exists in the combination. This is the argument the walkthrough now makes at length.

Script	Cloudflare control	What it proves
Pay against performance, for every rep WorkWeek (HR) + Pipeline (CRM) · intentional misuse	Gateway DLP on MCP traffic (across two apps)	Each call is legitimate; the combination is the breach. Per-application controls cannot see it, a policy at the shared path can.
Brief me on the restructure WorkBox (Inbox/Calendar) + WorkWeek (HR) + Nexus (Wiki) · intentional misuse	Gateway DLP on MCP traffic (three apps, three profiles)	An agent assembles a confidential programme from fragments across three systems - the risk that only exists once tools are joined up.
What is Project Ironwood? Nexus (Wiki) + Pipeline (CRM) + WorkBox (Inbox/Calendar) · accidental exposure	Gateway DLP on MCP traffic (three apps)	Corroboration is the harm: three partial mentions become a confirmed, unannounced transaction. Consistent policy across apps is what breaks the chain.

Using these to test a deployment

They are handy as a checklist after wire-protection.sh: run one per upstream server and you have confirmed every Gateway policy is attached to the right host and matching the right profile. That is a faster check than reading the dashboard, and it fails in the same way a customer demo would.