Keep cardholder data out of an AI agent's reach

A PAN can surface in a chat message, a support ticket, or a warehouse query. These policies support PCI DSS-aligned masking and least-privilege controls on the agent channel.

For: Teams whose AI tooling can reach systems that store cardholder data

PCI DSS 3.4.1 wants the PAN masked when displayed, and 7.2.x wants programmatic access to stored cardholder data restricted by role. An agent respects neither on its own: it will echo a full card number back in a summary, and it will query whatever the connector's scope allows. The gateway supplies both controls on the agent channel.

mask-pan-egress runs Luhn-validated PAN detection over responses and masks to BIN-plus-last-four, so a card number never reaches the model in full — the core of the 3.4.1 control. guard-warehouse-sql blocks the DML, DDL, and export constructs that would relocate stored cardholder data out of a warehouse. query-allowlist narrows what a CRM agent can query at all, and gate-money-movement-refund-cap caps refunds and payments so a misread instruction can't move money past a ceiling.

The honest limit: these reduce PAN exposure and privilege over MCP. They do not protect data at rest, encrypt transmission, add MFA, or scope your cardholder-data environment. The pci-dss bundle is the agent-channel slice of a PCI program — a strong, demonstrable slice, not the whole assessment.