In the demo, when no policy was configured, the assistant's request for exchange rates received a 403 Forbidden; after configuring a TBAC policy that only allows access to the GetCurrencyExchangeRate tool, the query returned to normal; the exchange succeeded after two additional policies were added; and after it was marked as requiring approval, human-in-the-loop was triggered, with a push notification sent to the mobile device requiring allow or deny within 60 seconds, with automatic denial on timeout.