# Check the whole MCP session, not just each tool call, for the untrusted input plus private data plus outbound mix

PaperChase agent use case (free feed entry), version 1.0. Source: [u/Former-Economy404](https://www.reddit.com/r/mcp/comments/1xikqwl/anyone_enforcing_policy_across_a_whole_session/), 2026-10-29.

## What they did

Reading a table was allowed and replying to a ticket was allowed, yet together they sent secrets to whoever could read the ticket. The author's list: a human before anything leaves the organisation, never run the agent with a key that skips row-level security, read-only mode where possible, a fresh session when the trust level changes, and narrow outbound access. A separate thread about agents in Cloudflare reaches the same conclusion: prompts ask an agent to behave, scoped tokens actually limit it.

## Worth knowing

A generic SQL tool cannot be policed per call, because one query looks like another to the rule. Decide per session which of the three ingredients the agent gets, and drop one.

## Workflow template

```text
Apply this workflow to [your project]:
1. List for each agent session: does it see untrusted text, private data, and can it send anything out?
2. If all three are true, remove one: read-only, no outbound, or a fresh session after untrusted input.
3. Never give the agent an admin or service role key; use scoped tokens.
4. Put a human approval in front of anything leaving the organisation.
5. Test with an instruction hidden inside a ticket or document.
Stop and ask me before anything irreversible: deploys, payments, sends or deletes.
```

## Steps

1. **List for each agent session: does it see untrusted text, private data,.** List for each agent session: does it see untrusted text, private data, and can it send anything out?
2. **If all three are true, remove one: read-only, no outbound, or a fresh .** If all three are true, remove one: read-only, no outbound, or a fresh session after untrusted input.
3. **Never give the agent an admin or service role key; use scoped tokens.** Never give the agent an admin or service role key; use scoped tokens.
4. **Put a human approval in front of anything leaving the organisation.** Put a human approval in front of anything leaving the organisation.
5. **Test with an instruction hidden inside a ticket or document.** Test with an instruction hidden inside a ticket or document.

## Credit

Workflow reported by u/Former-Economy404: https://www.reddit.com/r/mcp/comments/1xikqwl/anyone_enforcing_policy_across_a_whole_session/
Related: https://www.reddit.com/r/mcp/comments/1xhyii1/how_much_do_you_let_your_agents_touch_in/
Related: https://www.reddit.com/r/AI_Agents/comments/1xi4a8i/how_are_you_protecting_actiontaking_ai_agents/

Summary and template written by PaperChaseWebb in our own words. Questions: mgmt@paperchasewebb.com