Zero trust for AI agents: no request is trusted because the last one was. Every request is inspected on its own — which agent, which AI tool, from where, for what — before any data comes back.
Select an agent, send it a request and see what happens with and without Ascent. The rules, the refusals, the nine inspections and the audit trail are Ascent’s own model, applied to a fictional company’s synthetic records — a faithful simulation in your browser, not a live deployment, and it never asks for your data.
1 · What each agent is allowed to see
Northwind Outfitters runs four AI agents on one set of data.
Each agent has its own identity, the AI tool it was registered for, and its own permissions. These are the rules. Below, every request is still inspected on its own.
Company-wide guardrailApproved AI tools only: only ChatGPT and Agentforce agents may reach company data. It is checked before any permission, and no approval can override it.
agentCustomer profilesPayment detailsEmployee records
ChatGPT · usually from the office networkRedactedReal values need a person's approvalRedactedReal values need a person's approvalNo access
Agentforce · usually from the office networkReal valuesOffice network onlyNo accessNo access
Claude · usually from the office networkRefusedClaude isn't an approved AI toolRefusedClaude isn't an approved AI toolRefusedClaude isn't an approved AI tool
ChatGPT · usually from homeNo accessNo accessReal valuesOffice network only
Masking and stand-in values only ever apply to protected fields; the rest are always readable. A permission can’t reveal one protected field and hide another on the same record, which is why payment details are kept separately.
2 · Select your agent
Same request. Different agent. Different answer.
3 · Choose a request
Sent from
Customer Support Agent: “Look up the customer on support ticket #5120.”
Without Ascent
RETURNEDevery field
Every field in the clear: the customer's name, email and phone come back exactly as stored.
A shared login reads the customer profiles table directly. Every agent uses the same one.
customer id
C-10482
name · protected
Jordan Reyes
email · protected
jordan.reyes@example.com
phone · protected
+1 415 555 0100
company
Lakeside Clinics
plan
Enterprise
open tickets
0
Assumes a common starting point: agents share one credential that can read these tables. Many teams restrict more than this; the point is what the credential could return, not that it is always misused.
With Ascent
ALLOWredacted
Allowed, with redacted values.
Customer Support Agent (ChatGPT) asked to read redacted from Jordan Reyes’s record, from the office network.
customer id
C-10482
name · protected
************
email · protected
************************
phone · protected
***************
company
Lakeside Clinics
plan
Enterprise
open tickets
0
Nine inspections — where it passed and where it stopped
01CredentialWho is callingpassedA valid credential for support-agent.
02GuardrailsCompany-wide, firstpassedRegistered for ChatGPT, an approved AI tool, with an owner.
03PermissionsWhat this agent may dopassedPermission found: Support masked reader.
04ConditionsWhere, when, howpassedNo conditions on this permission.
05Data rulesWhich datapassedNo data-level rules on this record.
06ApprovalsOnce, for a reasonpassedNot needed.
07ViewsHow much of itpassedServed redacted values.
08Automatic responsesWatching the patternpassedNo workflow objected.
09The recordThe data itselfpassedRecord returned.
Audit record
record
#88410 at 10:14:00
who
support-agent
did
read redacted
result
allowed
stopped at
07 Views
values logged
none — the audit trail records access, never the data
The same request from every agent, from the office network
agentresultstopped atwhy
ALLOWredacted—Allowed, with redacted values.
DENY03 PermissionsRefused: nothing allows this agent to do this, and the default is no.
DENY02 GuardrailsRefused by a company-wide guardrail: Claude is not an approved AI tool at this company.
DENY03 PermissionsRefused: nothing allows this agent to do this, and the default is no.
Containment
Stopping one request is enforcement. Stopping the agent is containment.
Enforcement
One request is allowed or refused. The next request is inspected again, from scratch.
Containment
The agent is switched off, or a temporary approval is taken back. Nothing already read is unwound, but every request after it gets a different answer — and the other agents carry on.
The Sales / CRM Agent is allowed real customer contact details. Then it starts pulling every customer, one after another. No single request breaks a rule — so what catches it is an automatic response watching the rate: more than 19 real-value reads in a minute on one credential.
0 real-value reads served · 0:00 elapsed
Audit trail
Nothing recorded yet.
Accuracy
What this simulation simplifies.
Ascent inspects requests, not prompts. It never reads what an agent was asked. It decides a specific request for specific data, which is what each request button here stands for.
“Registered for ChatGPT” is a declaration. An administrator records which AI tool an agent’s identity was issued for, and the guardrail checks that record. It is not a detection of which model is really behind a credential.
A small company. Four agents, three kinds of data, a handful of records. Reach reports, signed evidence reports and behavioural findings are part of the product and are not shown here.
Fixed where the product varies. A redacted number is a random number of the same size in the product; here it is fixed. The export’s clock is simulated, approvals don’t expire while you watch, and the rate limit is this company’s choice rather than a product default.
“Without Ascent” is one common setup, not every company: agents sharing a credential that can read the underlying tables.
Try it on your own instance today. No credit card.
