# AGT-003: Inspect sensitive data retrieved through connectors mid-workflow


- Area: Agent & MCP Governance

- Verification: Live test
- OWASP adoption tier: AT3, AT4, AT6

- URL: /r/AGT-003

**Acceptance criteria:** Detect when an agent picks up sensitive content from one connnected tool and attemps to share it with a separate tool, even if the user prompt was benign.

**Why it matters:** Connectors pull sensitive data into a conversation even when the user's question is harmless.

**How to verify:** When an agent picks up sensitive information from one tool or dataset and attempts to share it with a different tool, the even is blocked if it violates policy.

**OWASP adoption context:** Embedded assistants, integrated platforms, citizen workflows and MCP extensions can retrieve sensitive data after a benign prompt; inspect the returned payload.

**Mappings:**
- NIST CSF 2.0: PR.DS-02, DE.CM-09; SOC 2: CC6.7, C1.1; ISO 27001: A.8.12 — Inspecting connector payloads reveals sensitive information entering a workflow even when the prompt is benign, supplying runtime evidence for transfer, confidentiality and leakage controls. Detection alone does not restrict later disclosure; finding sensitive content also does not establish poisoned context.
SOC 2: C1.1: The Confidentiality category and relevant information must be in scope.
ISO/IEC 27001: A.8.12: Operate inspection within a leakage-protection workflow with defined alert triage, warnings, blocking or another protective response.
- NIST AI RMF: MEASURE 2.10 — Where retrieved content includes personal data, the findings inform examination of privacy risk within the AI workflow. Recognizing sensitive content is one input to that examination, not a complete privacy-risk assessment.