A staff-facing Employee agent is instructed to "always summarise the vet's internal notes when asked," but a custom field called Internal Vet Notes is intentionally excluded from the Agent User's field-level security. When a technician asks for those notes, what should happen, and why is that correct?

Field-level security is enforced at the data-access layer for the Agent User, and no topic instruction can override it, because instructions shape how the model behaves with data it can see, not what data it is permitted to see in the first place. If Internal Vet Notes is excluded from the Agent User's FLS, the field is simply absent from what the action can retrieve, so the agent cannot summarise content it never received, regardless of how the instruction is phrased. This is by design and is a feature, not a bug: intentionally withholding a sensitive internal field from the Agent User is a legitimate way to keep certain content out of agent-mediated conversations entirely. Automatic escalation on every FLS restriction is not how the platform behaves; a blocked field does not trigger a hand-off workflow on its own, the agent simply lacks the data and must respond within what it does have. The requesting technician's own Experience Cloud or internal profile access is irrelevant here, because the action executes as the Agent User, not as the technician; the human's personal permissions do not extend to what the agent can retrieve on their behalf. The exam-relevant takeaway: FLS on the Agent User is a hard, silent ceiling that instructions cannot lift.