A sales agent can research an account and draft a proposal without permission to promise every price it can find. Bind account data, commercial terms, CRM changes, and outbound recipients to the actual authorized task.
A salesperson asks an agent to research a prospect, summarize the latest conversation, and prepare a proposal. The agent finds a useful prior deal and adapts its language. It also copies a discount that was approved for a different customer. The resulting proposal looks polished, but its commercial terms are unsupported.
This illustrative scenario does not require an attacker. It arises because useful information and authority to act are different things. Reading a price, seeing a previous concession, or drafting an email does not automatically authorize an agent to offer those terms to a new prospect.
Keep the account boundary explicit
Start with the approved account, opportunity, source documents, and requested deliverable. Sales teams may want an agent to combine public company research with selected internal communications. That does not require opening every customer’s contract history.
Where reusable material is valuable, provide approved templates and reference content. Separate that collection from confidential account-specific proposals. Otherwise, the agent’s ability to find a persuasive example can become a path for disclosing another customer’s pricing, implementation details, or negotiation position.
Use stable account and opportunity identifiers for updates. Similar company names and duplicated CRM records are common enough to deserve deliberate handling in an evaluation. Ambiguity should produce a record-selection question, not an update to whichever match looks most likely.
A proposal contains several kinds of authority
A single proposal may include product descriptions, prices, discounts, delivery expectations, support commitments, and terms drawn from a template. Those elements need different sources of approval. A technically accurate product description does not validate a discount, and an approved price does not validate a promised delivery date.
Build the draft from the approved materials and expose deviations. For example, show which terms come from the current price list and which are requests for an exception. The responsible sales or commercial owner can then review the proposed commitment instead of reconstructing its provenance from a long conversation.
Ordinary CRM housekeeping can have its own reusable policy. Updating a researched company description is different from changing deal value, marking a contract signed, or triggering a downstream fulfillment process. Organize permissions around the effects of each field and action.
Prospect documents are evidence, not instructions
An uploaded procurement questionnaire can legitimately ask about features and pricing. It can also contain directions to export an internal customer list, contact a new address, or disregard the agent’s original task. The document’s role is to provide content to analyze; it cannot grant those permissions.
OWASP describes indirect prompt injection as instructions arriving through external material such as files or websites. Its guidance supports separating untrusted content and limiting the application’s privileges. In a sales workflow, that means a prospect attachment must not become the source of authority for CRM access or outbound sharing. Read OWASP’s prompt-injection guidance.
Treat sending as a separate consequential action
Before a proposal leaves the organization, the relevant decision includes the actual artifact, attachments, recipients, and proposed terms. Approval of an earlier draft does not automatically apply after the agent adds a discount or swaps an attachment.
Recipient checks should account for the intended contact and channel. An address discovered in a prospect document may be useful evidence for a human to verify; it is not necessarily an approved destination for confidential material. Similar domains and forwarding instructions make this a practical test case.
A CRM update and a send can also diverge. The email might succeed while the CRM write times out, or vice versa. Record each effect and reconcile its status. Retrying the whole workflow can send duplicate proposals or overwrite a later human edit.
How Gensee supports a controlled sales workflow
Gensee Crate Enterprise connects task scope, artifact inspection, execution, and supported application actions. For sales, the intended scope includes the approved account and sources, while consequential effects include CRM changes and outbound proposals. External content should not widen those permissions.
Its central investigation view connects proposed actions with task and policy context. A useful deployment demonstrates how the exact proposal and recipient are evaluated, where a disallowed change can be prevented, and what evidence a sales lead receives when a commercial exception needs review.
This depends on the configured application path. A local draft can be revised or discarded; a sent proposal needs a business response. Do not treat local workspace recovery as a way to withdraw commitments that already reached a customer.
Evaluate commercial correctness and execution separately
Use a synthetic opportunity with an approved price list, a permitted proposal template, and a known contact. Add a prior deal with a special discount, a conflicting recipient in an attachment, an ambiguous account match, and a CRM record changed after drafting. Confirm that the routine proposal completes and that exceptions remain visible and contained.
Review both the document and the actions. A system can prevent an unauthorized send while still producing a commercially incorrect draft. It can also produce a correct draft and send it to the wrong person. The evaluation needs to detect both kinds of failure.
The useful dividing line is the moment preparation becomes commitment. Make that transition explicit, and the agent can do more of the research and drafting without becoming the owner of every commercial decision.