HubSpot Block Deal Closure
Blocks HubSpot CRM-object calls that move a deal into a closed stage (closedwon or closedlost). Both create and update requests are inspected.
Blocks HubSpot CRM-object calls that move a deal into a closed stage (closedwon or closedlost). Both create and update requests are inspected.
Clamps the page size of HubSpot bulk-read tool calls before they reach the HubSpot MCP server, so a single agent request to a covered bulk-read tool can…
hubspotcap-bulk-exportpiidata-minimisationingresssoc2hipaapci-dssgdpr-ccpa
Blocks every archive/deletion-class HubSpot tool call, plus the consent-destroying contact unsubscribe, before it reaches the MCP server.
Blocks HubSpot CRM-object calls that create or change associations between objects (deal↔company, contact↔company, etc.).
Blocks HubSpot CRM-object update calls that set or change a deal's owner.
Blocks HubSpot CRM-object calls that set or change a contact's lifecycle stage.
Makes the HubSpot connection read-only by blocking the write tool.
hubspotaccess-controlgovernanceread-onlyingresssoc2gdpr-ccpa
Sits one privilege tier above hubspot/role-gate-writes: ordinary crm-writers can create and edit CRM records, but two higher-blast-radius write classes are…
hubspotrole-gate-schema-consentaccess-controlleast-privilegesegregation-of-dutiesconsentingresssoc2
Gates every HubSpot write tool behind an IdP group: callers whose JWT groups claim contains crm-writers may create and update CRM records; everyone else gets…
hubspotrole-gate-writesaccess-controlleast-privilegeingresssoc2gdpr-ccpa
Reusable DTwo policies for HubSpot MCP servers — the HubSpot-hosted remote MCP server that the Claude connector uses, plus the older @hubspot/mcp-server local beta and the broader community servers (@shinzolabs/hubspot-mcp, baryhuang/mcp-hubspot). These families use three incompatible tool vocabularies for the same CRM (hubspot-* kebab-case, bare snake_case verbs like search_crm_objects / manage_crm_objects, and shinzo's {domain}_{operation} names), so the policies below match by tool-name suffix to stay portable. Its risk profile is dominated by PII/PHI at scale and irreversible business writes: contact, company, and deal records concentrate names, emails, phones, and addresses, and search/list pagination is a bulk-export channel; deal-stage and lifecycle edits fire live workflow automation; and while the official servers expose no delete, the shinzo community server adds destructive *_archive and consent-destroying unsubscribe tools.
| Policy | Direction | Purpose | Framework bundles |
|---|---|---|---|
| block-deal-closure | ingress | Deny CRM-object calls that move a deal into a closed stage (closedwon / closedlost); all other deal changes and tools pass through. |
soc2, sox |
| protect-associations | ingress | Deny CRM-object calls that create or change object associations (deal↔company, contact↔company, etc.); all other calls pass through. | soc2, gdpr-ccpa, sox |
| protect-deal-owner | ingress | Deny deal-update calls that set or change hubspot_owner_id; deal creates and other fields pass through. |
soc2, sox |
| protect-lifecycle-stage | ingress | Deny contact create/update calls that set or change lifecyclestage; all other calls pass through. |
soc2, gdpr-ccpa |
| read-only | ingress | Block all HubSpot writes (the *-manage-crm-objects tool); read/search/list tools pass through. |
soc2, hipaa, pci-dss, gdpr-ccpa, sox |
| role-gate-writes | ingress | Gate every HubSpot write tool behind an IdP crm-writers group; read-only by default, fail-closed on missing claims. |
soc2, hipaa, pci-dss, gdpr-ccpa, sox |
| role-gate-schema-consent | ingress | Reserve the two highest-blast-radius write classes — portal-schema (property-definition) edits and marketing-consent mutations — for a hubspot-admins group. |
soc2, gdpr-ccpa |
| freeze-destructive-ops | ingress | Deny every archive/delete/void/purge-class tool plus the consent-destroying contact unsubscribe; no identity exemption. | soc2, hipaa, gdpr-ccpa, sox |
| cap-bulk-export | ingress | Clamp bulk-read page size to 50 and truncate ids-style batch reads (transform-only) to cut off the mass-PII export channel. | soc2, hipaa, gdpr-ccpa |
| redact-pii | egress | Redact contact PII (phone, email, fax, SSN) from HubSpot tool responses to [REDACTED]. Transform-only — never denies. |
soc2, hipaa, gdpr-ccpa |
All policies also belong to the thematic bundles/crm bundle.
DTwo prefixes tool names with the MCP server name configured on the gateway. A HubSpot MCP server registered as hubspot surfaces tools like hubspot-manage-crm-objects, while one registered under another name (e.g. hubspot-mcp) would surface hubspot-mcp-manage-crm-objects. The policies in this directory match on the suffix (-manage-crm-objects, _create_property, _archive, etc.) so they stay portable across the remote, local-beta, and community naming conventions — but the remote server collapses all writes into one tool (manage_crm_objects), so create-vs-update and which-object distinctions can only be made by inspecting arguments. Always confirm the exact tool name your gateway sends using the dump-input debug technique before deploying.
Most of these policies are single-purpose and require no IdP claims. The identity-gated ones (role-gate-writes and role-gate-schema-consent) read input.subject.claims.groups with placeholder group names (crm-writers, hubspot-admins). Replace these with your own IdP group names at import time. The group check is fail-closed: a missing subject.claims, missing groups, or a non-list-of-strings groups claim denies the gated write — a missing claim never grants access.
To add a HubSpot policy:
apps/hubspot/<policy-slug>/ with policy.md and a tests.yaml test file.apps: ["hubspot"] in the policy frontmatter, plus any industry / bundle slugs that apply.bundles/crm), link to it from the matching landing page.pnpm manifest from the repo root.See CONTRIBUTING.md for the full process.