# Keep cardholder data out of an AI agent's reach

A PAN can surface in a chat message, a support ticket, or a warehouse query. These policies support PCI DSS-aligned masking and least-privilege controls on the agent channel.

For: Teams whose AI tooling can reach systems that store cardholder data

PCI DSS 3.4.1 wants the PAN masked when displayed, and 7.2.x wants programmatic access to stored cardholder data restricted by role. An agent respects neither on its own: it will echo a full card number back in a summary, and it will query whatever the connector's scope allows. The gateway supplies both controls on the agent channel.

`mask-pan-egress` runs Luhn-validated PAN detection over responses and masks to BIN-plus-last-four, so a card number never reaches the model in full — the core of the 3.4.1 control. `guard-warehouse-sql` blocks the DML, DDL, and export constructs that would relocate stored cardholder data out of a warehouse. `query-allowlist` narrows what a CRM agent can query at all, and `gate-money-movement-refund-cap` caps refunds and payments so a misread instruction can't move money past a ceiling.

The honest limit: these reduce PAN exposure and privilege over MCP. They do not protect data at rest, encrypt transmission, add MFA, or scope your cardholder-data environment. The `pci-dss` bundle is the agent-channel slice of a PCI program — a strong, demonstrable slice, not the whole assessment.

## Policies in this guide

- [Slack: Mask Card Numbers in Message and Search Responses](https://www.intentbasedpolicy.com/policies/slack/mask-pan-egress) — Masks payment-card numbers (PANs) in Slack content returned to agents by message-read, thread-read, canvas-read, history, and search tools.
- [Stripe Refund Group Gate and Amount Cap](https://www.intentbasedpolicy.com/policies/stripe/gate-money-movement-refund-cap) — Denies Stripe refund tool calls — money out, irreversible — unless the caller's IdP groups include finance or billing-admin.
- [Block Destructive and Mutating Snowflake SQL](https://www.intentbasedpolicy.com/policies/snowflake/guard-warehouse-sql) — Inspects the SQL text that Snowflake MCP tools carry in their query argument and denies any statement in a mutating or destructive class — DROP, TRUNCATE,…
- [Salesforce Query Allowlist](https://www.intentbasedpolicy.com/policies/salesforce/query-allowlist) — Restricts Salesforce SOQL queries so only Account, Contact, and Opportunity records can be retrieved.