Sales tooling is built to move fast, and an assistant with CRM access will happily help someone move a lot of data. Most of it is legitimate. The strange cases hide in the volume.
A rep asks their assistant to "pull every account in my region with contacts and last activity," or "export all my leads so I can work them offline." Each read is authorized. The rep is allowed to see their own accounts. The problem is the shape: a few hundred authorized reads in one morning add up to the whole book of business leaving through the assistant.
The classic version is a rep on the way out. Two weeks before a resignation, the pipeline, the contacts and the notes quietly walk to a personal drive. Nothing was stolen in the usual sense. The assistant was just very helpful, one authorized call at a time.
No single call trips a guardrail, because no single account is sensitive. The signal is the count, per person, over time.
You do not want to stop a rep from reading their accounts. You want to stop one person from pulling thousands of distinct customer records in a day. That is an entity_budget: normal work passes, and the request that crosses a distinct-record ceiling in a window is refused. A blanket deny_tools also means the "export everything" tool is never offered in the first place.
# coc.yaml - rule_id: CRM-BULK-001 clause: "No mass export of customer records." enforce: - type: entity_budget domain: crm-records max_distinct: 100 window: 24h action: deny
A budget only works if the layer remembers what this person has already pulled today, across calls and sessions. A stateless gateway sees each call as new and never adds them up, so the export sails through in small pieces. Aggrete accumulates per user, so the hundred-and-first distinct record is the one that gets the question, no matter how the calls are spread out.
pip install aggrete then aggrete --demo runs the walkthrough with no config or network. To wire it to your own assistant, follow the beginner's guide.Aggrete is Apache-2.0 and runs on a laptop or a cluster. Star it, fork it, and tell us what rule to build next.