Support Ops / CX
Support agents that issue refunds
A support agent resolves tickets and can issue refunds, apply credits, and update the CRM. Every inbound message is untrusted input aimed at something that can move money.
Real example — shipping today
source →Salesforce · Agentforce (Service Agent)
Autonomous service agents resolve cases across chat, email, and SMS — querying history, updating records, resetting passwords, and taking customer-facing actions.
Their own controls — Agentforce runs on the Einstein Trust Layer with standard permissions, sharing rules, and prompt-injection guardrails.
The danger without a gate
A crafted message prompt-injects the agent into refunding thousands, or into reading another customer’s record — with no authorization tied to the actual amount and account, and no tamper-evident proof of what was approved.
How MCPIP handles it, step by step
Read it top to bottom. Each step shows the real command and exactly what MCPIP returns — the same allow / step-up / denied envelope every time.
The agent requests a refund
It asks to refund $1,800 to a customer. The agent only ever sees an opaque alias — account_7fZk — never the real account.
$ mcpip --json authorize skill_issue_refund --arg account=account_7fZk --arg amount_usd=1800{
"error": "step_up_pending",
"challenge_id": "chg_2f91aa",
"correlation_id": "b3d1f0a7"
}MCPIP binds a one-time PIN to this exact refund
Anything over the threshold is held for approval. The PIN is cryptographically bound to this amount and this account — change either later and it’s void.
A human approves it
A supervisor confirms with the PIN; MCPIP seals the decision and the refund runs.
$ mcpip --json complete --challenge chg_2f91aa{
"correlation_id": "b3d1f0a7",
"decision": "allow",
"status": "committed",
"transaction_ref": "txn_5c8a12",
"executed_target_class": "cloud_rest",
"worm_sequence": 48214,
"vended_credential": null
}attackThe attack: a prompt injection bumps the amount to $4,800
A hostile ticket tries to escalate the refund. The new payload drifts from what was approved, so the approval doesn’t apply — denied, opaquely.
$ mcpip --json authorize skill_issue_refund --arg account=account_7fZk --arg amount_usd=4800{
"error": "denied",
"correlation_id": "c81d02f7"
}The result
Refund and CRM automation that can’t be talked into fraud, and is provable after the fact.
The same flow, at a glance
Every command above runs against a local sandbox in one line.
run it yourself — curl … | bash && mcpip up →