Govern what your agents do

Stories

• Stop AI agents from leaking secrets into Slack
  Once an agent posts to Slack, an API key is in channel history and search. Catch it before the send, not after.
• Keep customer PII from walking out of your CRM
  An agent reading Salesforce or HubSpot pulls emails, phone numbers, and addresses into its context and your chat logs. Mask them on the way out.
• Give AI agents read-only access to your CRM
  For a low-risk CRM pilot, give the agent a one-way mirror: it reads every record and changes none. The read-only policies enforce that, and a query allowlist tightens it further.
• Guard the CRM writes your revenue depends on
  You want agents logging activities and creating records, just not closing deals or reassigning owners on their own. Gate the few writes that matter.
• Wall off sensitive Jira projects from AI agents
  Security, legal, and HR projects share the same Jira as your sprint board. Keep agents from reading or writing them, and redact whatever still comes back.
• Slack hygiene for autonomous AI agents
  Slack's OAuth scopes pick capabilities, not the channels they apply to: you can grant an agent 'post messages,' but not 'post only in #status' — one scope covers every channel at once.
• HIPAA-aligned controls for AI agents touching PHI
  A connector into email, a helpdesk, or a warehouse can pull protected health information into an agent's context. These policies support HIPAA-aligned minimum-necessary, access, and de-identification controls on the MCP path.
• Keep cardholder data out of an AI agent's reach
  A PAN can surface in a chat message, a support ticket, or a warehouse query. These policies support PCI DSS-aligned masking and least-privilege controls on the agent channel.
• SOC 2-aligned access control for AI agents
  Auditors increasingly treat an agent as a privileged identity. These policies support the most-tested SOC 2 access, boundary, and change-management criteria — with a per-decision audit trail.
• SOX-aligned controls for AI agents in finance systems
  An agent in the ERP can draft — but it should never post, pay, delete, or approve on its own. These policies support SOX ICFR and ITGC controls on the agent channel.
• Stop an AI agent from sending mail as your employees
  An agent with mailbox access can email outsiders, and quietly set forwarding rules that leak every future message. Gate the send and freeze the rules.
• Keep an AI agent from sharing your files with the internet
  A file connector's most dangerous tool isn't read — it's the one that mints a public share link. Deny anonymous links and fence the folders that matter.
• Let agents query the warehouse without draining it
  Natural-language SQL is one tool call away from a full-table export. Constrain the statement, cap the pull, and mask what comes back.
• Let an AI agent touch Stripe without letting it move money
  Refunds, payouts, and disputes are irreversible the moment they fire. Cap the amounts, gate the approvals, and close the raw-API back door.
• Give an agent GitHub access without letting it merge or leak code
  Source code is crown-jewel data, and a merge or a public repo is a one-call mistake. Keep the agent to drafts and keep secrets out of commits.
• Govern the one search tool that reaches every system
  Enterprise search fans out across everything indexed, so one query can surface what a dozen per-app policies would each have caught. The chokepoint is egress.
• Keep meeting recordings and transcripts need-to-know
  Recordings and transcripts are sensitive by default — comp talk, deal terms, health details. Gate who an agent can pull them for, and mask what it returns.
• Keep payroll and compensation data out of an agent's reach
  An HR connector exposes salaries, bank details, and terminations. Fence the sensitive reads to HR, freeze the writes, and mask financial identifiers.
• GDPR-aligned controls for AI agents handling personal data
  Almost every connector an agent touches holds personal data. These policies support GDPR and CCPA-aligned minimisation and special-category controls on the MCP path.

Apps

• Airtable · 5 policies
• Asana · 4 policies
• Bigquery · 5 policies
• Box · 5 policies
• Confluence · 5 policies
• Databricks · 6 policies
• Docusign · 5 policies
• Dropbox · 5 policies
• Github · 6 policies
• Glean · 5 policies
• Gmail · 6 policies
• Google Calendar · 4 policies
• Google Drive · 6 policies
• Gusto · 5 policies
• Hubspot · 10 policies
• Intercom · 5 policies
• Jira · 8 policies
• Linear · 5 policies
• Monday · 5 policies
• Ms365 · 8 policies
• Netsuite · 6 policies
• Notion · 5 policies
• Onboarding · 3 policies
• Power Bi · 5 policies
• Quickbooks · 6 policies
• Salesforce · 9 policies
• Servicenow · 6 policies
• Slack · 10 policies
• Snowflake · 6 policies
• Stripe · 6 policies
• Tableau · 5 policies
• Zapier · 5 policies
• Zoom · 5 policies

Bundles

• Atlassian · 13 policies
• Crm · 19 policies
• Gdpr Ccpa · 100 policies
• Hipaa · 42 policies
• Im Messaging · 3 policies
• Pci Dss · 24 policies
• Slack · 7 policies
• Soc2 · 173 policies
• Sox · 17 policies

Read it as data

Agents can read this catalog the same way people do: /llms.txt indexes it, /llms-full.txt inlines every policy, and /catalog.json serves it structured. The source of truth is the policy-store repository.