Interesting, so how does this work with regards to purposeful but naive changes? If, for example, we have a Notion integration, and a non-technical user can add a feature to it via prompt, would it be possible for them to accidentally add something that sends a bunch of internal-only proprietary data to Notion? Would this system prevent or flag that in some way?

Gatekeepers can specify the sensitivity of their data. A Gatekeeper can actually flag an observation (a read operation) as being so sensitive that the agent should be prohibited from writing anywhere else after having seen that.

This is what allowed us to connect Cloudflare OS to our own sensitive internal data sources, containing things like customer data, revenue info, etc. Once you connect to one of those, the system enforces no data can be shared out of it.

That said, the policies are a bit blunt right now, maybe overly restrictive. We're going to be evolving it further.