dtwo Policy Store

Quickbooks policies

Policies (6)

About these policies

Reusable DTwo policies for Intuit QuickBooks Online (QBO) MCP servers — Intuit's first-party open-source server (intuit/quickbooks-online-mcp-server, ~144 tools), the Intuit-published Claude connector bundled in Claude for Small Business (tool names unverified — confirm via tools/list), the community LibreChat remote server, and the archived hvkshetry mega-tool server. The MCP surface is verb_entity reads (get_*/search_* across 29 entities plus 11 financial reports) and writes (create_*/update_*/delete_*). QBO is the general-ledger system of record: nearly every write is a books-of-record mutation, transaction deletes are hard deletes recoverable only from the audit log, journal entries restate the ledger directly, and money-movement tools trigger real payments and refunds. There are no send/email tools, so the blast radius is the ledger itself plus anything that syncs downstream (payroll, tax filings, lender feeds) — which is exactly why the SOX and PII exposure concentrates on writes, money movement, vendor banking data, and whole-ledger bulk reads.

Available policies

Policy Direction Purpose Framework bundles
freeze-destructive-ops ingress Deny every destructive QBO call — delete_*/void_*/deactivate_* tools and the mega-tool operation ∈ {delete, void, deactivate} — since transaction deletes are unrecoverable hard deletes. sox, soc2
gate-money-movement ingress Gate money-movement creators (create_payment, create_bill_payment, create_refund_receipt, create_transfer, create_deposit) behind a finance group and an amount ceiling. sox, soc2
protect-closed-periods-journal-entries ingress Deny direct journal-entry writes (create_journal_entry/update_journal_entry) for every caller except the controller group. sox, soc2
guard-vendor-banking ingress Deny create_vendor/update_vendor calls that carry bank-account, routing/ACH, or tax-ID (EIN/SSN) fields. sox
cap-bulk-export ingress Clamp the bulk-read levers on every search_* call — strip fetchAll and cap limit at 50 (transform-only). soc2, gdpr-ccpa
redact-pii-egress-employee egress Mask SSN, EIN, bank-account, and home-address PII in get_employee/search_employees/get_vendor/search_vendors responses for callers outside HR/finance. soc2, gdpr-ccpa

Tool naming on the DTwo gateway

DTwo prefixes tool names with the MCP server name configured on the gateway, so a QBO server registered as quickbooks surfaces tools like quickbooks-create-invoice. These policies match on the suffix (_invoice, _payment, delete_, create_vendor, etc.), normalize separators (snake_case, camelCase, hyphen) for portability across the official, LibreChat, and connector servers, and — for the archived hvkshetry mega-tool shape — also inspect the operation/entity_type arguments. The Claude connector's exact tool names are unverified; confirm the live names your gateway sends with the dump-input debug technique before deploying exact-match rules.

Identity claims

The identity-gated policies (gate-money-movement, protect-closed-periods-journal-entries, redact-pii-egress-employee, and the vendor-banking guard where applicable) read input.subject.claims.groups with placeholder group names (e.g. finance, controller, hr). Replace these with your own IdP group names at import time. Missing claims fail closed for grants (no group → not exempt).

Contributing

To add a QuickBooks policy:

  1. Create apps/quickbooks/<policy-slug>/ with policy.md and a tests.yaml test file.
  2. Add a row to the table above.
  3. Declare apps: ["quickbooks"] in the policy frontmatter, plus any industry / bundle slugs that apply.
  4. If the policy fits a bundle (e.g. bundles/sox), link to it from the matching landing page.
  5. Run pnpm manifest from the repo root.

See CONTRIBUTING.md for the full process.