# DTwo Policy Catalog

> A curated catalog of reusable OPA/Rego policies for the DTwo MCP Gateway. Each policy is evaluated on every MCP tool call to allow, deny, redact, or rewrite the request or response — governing what AI agents can do with Slack, Jira, Salesforce, HubSpot and other connected apps.

Policies are small and single-purpose; you compose a security posture by attaching several together. 190 policies span 33 apps and 9 bundles. The canonical source of truth is the policy-store repository on GitHub (https://github.com/dtwoai/policy-store). Full policy text inline: https://www.intentbasedpolicy.com/llms-full.txt. Structured index: https://www.intentbasedpolicy.com/catalog.json.

## Stories (problem-first guides)
- [Stop AI agents from leaking secrets into Slack](https://www.intentbasedpolicy.com/stories/stop-secrets-leaking-into-slack): Once an agent posts to Slack, an API key is in channel history and search. Catch it before the send, not after.
- [Keep customer PII from walking out of your CRM](https://www.intentbasedpolicy.com/stories/keep-customer-pii-inside-your-crm): An agent reading Salesforce or HubSpot pulls emails, phone numbers, and addresses into its context and your chat logs. Mask them on the way out.
- [Give AI agents read-only access to your CRM](https://www.intentbasedpolicy.com/stories/read-only-crm-for-ai-agents): For a low-risk CRM pilot, give the agent a one-way mirror: it reads every record and changes none. The read-only policies enforce that, and a query allowlist tightens it further.
- [Guard the CRM writes your revenue depends on](https://www.intentbasedpolicy.com/stories/guard-high-stakes-crm-writes): You want agents logging activities and creating records, just not closing deals or reassigning owners on their own. Gate the few writes that matter.
- [Wall off sensitive Jira projects from AI agents](https://www.intentbasedpolicy.com/stories/wall-off-sensitive-jira-projects): Security, legal, and HR projects share the same Jira as your sprint board. Keep agents from reading or writing them, and redact whatever still comes back.
- [Slack hygiene for autonomous AI agents](https://www.intentbasedpolicy.com/stories/slack-hygiene-for-ai-agents): Slack's OAuth scopes pick capabilities, not the channels they apply to: you can grant an agent 'post messages,' but not 'post only in #status' — one scope covers every channel at once.
- [HIPAA-aligned controls for AI agents touching PHI](https://www.intentbasedpolicy.com/stories/hipaa-aligned-controls-for-ai-agents): A connector into email, a helpdesk, or a warehouse can pull protected health information into an agent's context. These policies support HIPAA-aligned minimum-necessary, access, and de-identification controls on the MCP path.
- [Keep cardholder data out of an AI agent's reach](https://www.intentbasedpolicy.com/stories/pci-dss-aligned-controls-for-ai-agents): A PAN can surface in a chat message, a support ticket, or a warehouse query. These policies support PCI DSS-aligned masking and least-privilege controls on the agent channel.
- [SOC 2-aligned access control for AI agents](https://www.intentbasedpolicy.com/stories/soc2-access-controls-for-ai-agents): Auditors increasingly treat an agent as a privileged identity. These policies support the most-tested SOC 2 access, boundary, and change-management criteria — with a per-decision audit trail.
- [SOX-aligned controls for AI agents in finance systems](https://www.intentbasedpolicy.com/stories/sox-controls-for-ai-agents-in-finance): An agent in the ERP can draft — but it should never post, pay, delete, or approve on its own. These policies support SOX ICFR and ITGC controls on the agent channel.
- [Stop an AI agent from sending mail as your employees](https://www.intentbasedpolicy.com/stories/stop-ai-agents-sending-mail-as-your-staff): An agent with mailbox access can email outsiders, and quietly set forwarding rules that leak every future message. Gate the send and freeze the rules.
- [Keep an AI agent from sharing your files with the internet](https://www.intentbasedpolicy.com/stories/keep-agents-from-oversharing-files): A file connector's most dangerous tool isn't read — it's the one that mints a public share link. Deny anonymous links and fence the folders that matter.
- [Let agents query the warehouse without draining it](https://www.intentbasedpolicy.com/stories/query-the-warehouse-without-draining-it): Natural-language SQL is one tool call away from a full-table export. Constrain the statement, cap the pull, and mask what comes back.
- [Let an AI agent touch Stripe without letting it move money](https://www.intentbasedpolicy.com/stories/let-agents-touch-stripe-without-moving-money): Refunds, payouts, and disputes are irreversible the moment they fire. Cap the amounts, gate the approvals, and close the raw-API back door.
- [Give an agent GitHub access without letting it merge or leak code](https://www.intentbasedpolicy.com/stories/give-agents-github-without-leaking-code): Source code is crown-jewel data, and a merge or a public repo is a one-call mistake. Keep the agent to drafts and keep secrets out of commits.
- [Govern the one search tool that reaches every system](https://www.intentbasedpolicy.com/stories/govern-enterprise-search-across-every-system): Enterprise search fans out across everything indexed, so one query can surface what a dozen per-app policies would each have caught. The chokepoint is egress.
- [Keep meeting recordings and transcripts need-to-know](https://www.intentbasedpolicy.com/stories/keep-meeting-recordings-need-to-know): Recordings and transcripts are sensitive by default — comp talk, deal terms, health details. Gate who an agent can pull them for, and mask what it returns.
- [Keep payroll and compensation data out of an agent's reach](https://www.intentbasedpolicy.com/stories/protect-payroll-data-from-ai-agents): An HR connector exposes salaries, bank details, and terminations. Fence the sensitive reads to HR, freeze the writes, and mask financial identifiers.
- [GDPR-aligned controls for AI agents handling personal data](https://www.intentbasedpolicy.com/stories/gdpr-aligned-controls-for-ai-agents): Almost every connector an agent touches holds personal data. These policies support GDPR and CCPA-aligned minimisation and special-category controls on the MCP path.

## Apps
- [Airtable](https://www.intentbasedpolicy.com/apps/airtable): 5 policies
- [Asana](https://www.intentbasedpolicy.com/apps/asana): 4 policies
- [Bigquery](https://www.intentbasedpolicy.com/apps/bigquery): 5 policies
- [Box](https://www.intentbasedpolicy.com/apps/box): 5 policies
- [Confluence](https://www.intentbasedpolicy.com/apps/confluence): 5 policies
- [Databricks](https://www.intentbasedpolicy.com/apps/databricks): 6 policies
- [Docusign](https://www.intentbasedpolicy.com/apps/docusign): 5 policies
- [Dropbox](https://www.intentbasedpolicy.com/apps/dropbox): 5 policies
- [Github](https://www.intentbasedpolicy.com/apps/github): 6 policies
- [Glean](https://www.intentbasedpolicy.com/apps/glean): 5 policies
- [Gmail](https://www.intentbasedpolicy.com/apps/gmail): 6 policies
- [Google Calendar](https://www.intentbasedpolicy.com/apps/google-calendar): 4 policies
- [Google Drive](https://www.intentbasedpolicy.com/apps/google-drive): 6 policies
- [Gusto](https://www.intentbasedpolicy.com/apps/gusto): 5 policies
- [Hubspot](https://www.intentbasedpolicy.com/apps/hubspot): 10 policies
- [Intercom](https://www.intentbasedpolicy.com/apps/intercom): 5 policies
- [Jira](https://www.intentbasedpolicy.com/apps/jira): 8 policies
- [Linear](https://www.intentbasedpolicy.com/apps/linear): 5 policies
- [Monday](https://www.intentbasedpolicy.com/apps/monday): 5 policies
- [Ms365](https://www.intentbasedpolicy.com/apps/ms365): 8 policies
- [Netsuite](https://www.intentbasedpolicy.com/apps/netsuite): 6 policies
- [Notion](https://www.intentbasedpolicy.com/apps/notion): 5 policies
- [Onboarding](https://www.intentbasedpolicy.com/apps/onboarding): 3 policies
- [Power Bi](https://www.intentbasedpolicy.com/apps/power-bi): 5 policies
- [Quickbooks](https://www.intentbasedpolicy.com/apps/quickbooks): 6 policies
- [Salesforce](https://www.intentbasedpolicy.com/apps/salesforce): 9 policies
- [Servicenow](https://www.intentbasedpolicy.com/apps/servicenow): 6 policies
- [Slack](https://www.intentbasedpolicy.com/apps/slack): 10 policies
- [Snowflake](https://www.intentbasedpolicy.com/apps/snowflake): 6 policies
- [Stripe](https://www.intentbasedpolicy.com/apps/stripe): 6 policies
- [Tableau](https://www.intentbasedpolicy.com/apps/tableau): 5 policies
- [Zapier](https://www.intentbasedpolicy.com/apps/zapier): 5 policies
- [Zoom](https://www.intentbasedpolicy.com/apps/zoom): 5 policies

## Bundles
- [Atlassian](https://www.intentbasedpolicy.com/bundles/atlassian): 13 policies
- [Crm](https://www.intentbasedpolicy.com/bundles/crm): 19 policies
- [Gdpr Ccpa](https://www.intentbasedpolicy.com/bundles/gdpr-ccpa): 100 policies
- [Hipaa](https://www.intentbasedpolicy.com/bundles/hipaa): 42 policies
- [Im Messaging](https://www.intentbasedpolicy.com/bundles/im-messaging): 3 policies
- [Pci Dss](https://www.intentbasedpolicy.com/bundles/pci-dss): 24 policies
- [Slack](https://www.intentbasedpolicy.com/bundles/slack): 7 policies
- [Soc2](https://www.intentbasedpolicy.com/bundles/soc2): 173 policies
- [Sox](https://www.intentbasedpolicy.com/bundles/sox): 17 policies

## Policies
- [Airtable: Redact PII in Record Reads](https://www.intentbasedpolicy.com/policies/airtable/redact-pii-egress) (airtable, egress): Scans the responses of the Airtable record-read tools — the calls that return row fields values — and rewrites high-confidence PII shapes to a fixed…
- [Asana: Redact PII in Task & Comment Reads](https://www.intentbasedpolicy.com/policies/asana/redact-task-pii) (asana, egress): On the Asana MCP read path, this transform scans the free-text business fields that ride back in task, comment/story, and status-update responses — notes,…
- [BigQuery: Redact PII in Query Results](https://www.intentbasedpolicy.com/policies/bigquery/redact-pii-egress) (bigquery, egress): Scans the content returned by BigQuery's result-returning tools and rewrites high-confidence PII shapes to fixed, non-recoverable redaction tokens before the…
- [Block Agent Email to External Recipients](https://www.intentbasedpolicy.com/policies/ms365/guard-external-send) (ms365, ingress): Blocks agent-initiated Microsoft 365 email sends when any recipient address falls outside a corporate-domain allowlist.
- [Block BigQuery Exfiltration and Cross-Project Writes](https://www.intentbasedpolicy.com/policies/bigquery/guard-warehouse-export) (bigquery, ingress): Inspects the raw GoogleSQL string carried by BigQuery SQL tools and denies any statement that moves data out of the tenant's own project — even when the call…
- [Block Bulk Export & External Staging (Snowflake)](https://www.intentbasedpolicy.com/policies/snowflake/guard-warehouse-export) (snowflake, ingress): Blocks Snowflake SQL-execution tool calls whose query text moves whole tables off the Snowflake perimeter — bulk export to cloud storage or a stage, and…
- [Block Calendar Invites to External Attendees](https://www.intentbasedpolicy.com/policies/google-calendar/guard-external-attendees) (google-calendar, ingress): Denies Google Calendar event-write tool calls — create event / create-event, update event / update-event, and the consolidated manage event — whenever any…
- [Block Destructive and Export SQL on Notion Data Sources](https://www.intentbasedpolicy.com/policies/notion/guard-datasource-sql) (notion, ingress): Inspects Notion data-source query tool calls (notion-query-data-sources on the hosted server, query-data-source on the official local server) and denies any…
- [Block Destructive and Mutating Snowflake SQL](https://www.intentbasedpolicy.com/policies/snowflake/guard-warehouse-sql) (snowflake, ingress): Inspects the SQL text that Snowflake MCP tools carry in their query argument and denies any statement in a mutating or destructive class — DROP, TRUNCATE,…
- [Block Destructive SQL in BigQuery Queries](https://www.intentbasedpolicy.com/policies/bigquery/guard-warehouse-sql) (bigquery, ingress): Inspects the raw GoogleSQL string carried by BigQuery write-capable query tools and denies any statement in a state-changing class — DML…
- [Block External Sends Hidden in Zapier Instructions](https://www.intentbasedpolicy.com/policies/zapier/guard-external-send) (zapier, ingress): Every Zapier MCP tool — in both the agentic and classic modes — accepts a free-text instructions string that Zapier's server-side AI uses to fill any…
- [Block External Team Chat Invites & Members](https://www.intentbasedpolicy.com/policies/zoom/guard-external-chat-invites) (zoom, ingress): Stops a Zoom Team Chat agent from pulling external parties into the organization's chat surface.
- [Block Gmail Filter Creation (Auto-Forward Persistence)](https://www.intentbasedpolicy.com/policies/gmail/guard-mailbox-persistence) (gmail, ingress): Blocks the classic BEC/exfiltration persistence primitive: Gmail filters that can auto-forward or auto-delete mail and outlive the agent session.
- [Block Irreversible Docusign Void and Workflow Kills](https://www.intentbasedpolicy.com/policies/docusign/freeze-destructive-ops) (docusign, ingress): Denies the irreversible destructive operations on the Docusign agent path:
- [Block Linear Webhook Creation](https://www.intentbasedpolicy.com/policies/linear/guard-webhook-persistence) (linear, ingress): Unconditionally denies any Linear tool that creates, updates, or deletes a webhook — linear createWebhook, linear deleteWebhook, and update variants.
- [Block Mail-Rule and Webhook Persistence](https://www.intentbasedpolicy.com/policies/ms365/guard-mailbox-persistence) (ms365, ingress): Unconditionally denies the classic business-email-compromise (BEC) persistence surface in Microsoft 365: creating or updating Outlook mail rules, changing…
- [Block Power BI RLS-Bypass Service-Principal Queries](https://www.intentbasedpolicy.com/policies/power-bi/block-rls-bypass-service-principal) (power-bi, ingress): On Microsoft's remote Power BI MCP server (https://api.fabric.microsoft.
- [Block Public Dropbox Share, Download, and File-Request Links](https://www.intentbasedpolicy.com/policies/dropbox/guard-share-links-external) (dropbox, ingress): Denies, by default, the Dropbox tools that turn an internal file into an internet-visible resource in a single call — before the request ever reaches Dropbox:
- [Block Public Visibility & Guest Delegation](https://www.intentbasedpolicy.com/policies/google-calendar/guard-public-exposure) (google-calendar, ingress): Blocks Google Calendar create and update event calls that would expose the event to the world or hand control of it to guests.
- [Block Secrets in Confluence Pages and Comments](https://www.intentbasedpolicy.com/policies/confluence/block-secrets) (confluence, ingress): Blocks Confluence write calls whose body looks like it contains a live credential — an API key, password, token, or PEM-formatted private key — before the…
- [Block Secrets in GitHub Commits & PRs](https://www.intentbasedpolicy.com/policies/github/block-secrets-commits) (github, ingress): Blocks GitHub write tool calls whose payload looks like it carries a live credential into a repository, gist, pull request, or comment.
- [Block Secrets in Slack Messages](https://www.intentbasedpolicy.com/policies/slack/block-secrets) (slack, ingress): Blocks Slack send-message tool calls whose message body looks like it contains a secret — API keys, passwords, tokens, or PEM-formatted private keys.
- [Block Secrets in Zoom Team Chat](https://www.intentbasedpolicy.com/policies/zoom/block-secrets-chat) (zoom, ingress): Blocks Zoom Team Chat send/update tool calls whose message content looks like it contains a live secret — API keys, passwords, bearer tokens, or…
- [Box: Redact PII from File Content on Egress](https://www.intentbasedpolicy.com/policies/box/redact-pii-egress) (box, egress): Scans the responses of Box content-returning tools and rewrites personally identifiable information to fixed redaction tokens before the response reaches the…
- [Box: Role-Gated Writes (Read-Only Default)](https://www.intentbasedpolicy.com/policies/box/role-gate-writes) (box, ingress): Makes Box read-only by default on the MCP path.
- [Cap Asana Batch Task Mutations](https://www.intentbasedpolicy.com/policies/asana/cap-batch-mutation) (asana, ingress): Caps the blast radius of Asana's official V2 batch write tools. At ingress it:
- [Cap Docusign Directory and Document Egress](https://www.intentbasedpolicy.com/policies/docusign/cap-directory-and-document-egress) (docusign, egress): Bounds the two largest data-out channels in the Docusign MCP landscape:
- [Cap Glean Bulk Search Export](https://www.intentbasedpolicy.com/policies/glean/cap-search-export) (glean, ingress): Clamps the bulk-export parameters on Glean search calls before they reach the Glean MCP server, so a single agent request cannot pull an entire indexed…
- [Cap Google Drive Search & Listing Page Sizes](https://www.intentbasedpolicy.com/policies/google-drive/cap-bulk-export) (google-drive, ingress): Clamps the page size of Google Drive search and listing calls to a documented cap (25 results per call).
- [Cap Intercom Contact Enumeration](https://www.intentbasedpolicy.com/policies/intercom/cap-contact-enumeration) (intercom, ingress): caller is a CRM admin); clamp page size on everything else; allow the rest
- [Cap QuickBooks Bulk Search Exports](https://www.intentbasedpolicy.com/policies/quickbooks/cap-bulk-export) (quickbooks, ingress): Clamps the bulk-read levers on every QuickBooks Online search tool so an agent cannot pull the entire general ledger — or a full customer, vendor, or…
- [Clamp Bulk Airtable Record Reads](https://www.intentbasedpolicy.com/policies/airtable/cap-bulk-record-reads) (airtable, ingress): Airtable bases routinely hold CRM contacts, applicant-tracking pipelines, customer/financial trackers, and — on HIPAA-eligible Enterprise plans — health-ops…
- [Confine Airtable Agent to Allowlisted Bases](https://www.intentbasedpolicy.com/policies/airtable/fence-base-allowlist) (airtable, ingress): An Airtable OAuth grant (or Personal Access Token) with the workspacesAndBases:read scope spans the entire workspace — every base the connected identity can…
- [Confluence: Deny Org-Wide & Public Publication](https://www.intentbasedpolicy.com/policies/confluence/deny-public-publication) (confluence, ingress): Stops a prompt-injected or erring agent from broadcasting Confluence content org-wide or to anonymous external readers.
- [Confluence: Freeze Page & Attachment Deletion](https://www.intentbasedpolicy.com/policies/confluence/freeze-page-deletion) (confluence, ingress): Freezes the two irreversible Confluence deletion tools on the agent channel: confluence delete page and confluence delete attachment.
- [Confluence: Redact PII from Page & Comment Responses](https://www.intentbasedpolicy.com/policies/confluence/redact-pii-egress) (confluence, egress): Scans the responses of Confluence page, comment, and search read tools and rewrites personally identifiable information to fixed redaction tokens before the…
- [Constrain Notion Connected-Tool Search](https://www.intentbasedpolicy.com/policies/notion/constrain-connected-search) (notion, ingress): Notion's hosted MCP server (notion-search) does not just search Notion pages — through Notion AI connectors it also searches connected Slack, Google Drive,…
- [Databricks Default-Deny Unknown Tools](https://www.intentbasedpolicy.com/policies/databricks/default-deny-unknown-tools) (databricks, ingress): Pins an allowlist of the exact Databricks tool names your team audited and denies every other tool name on the Databricks MCP server(s).
- [Databricks: Mask Cardholder PANs in Responses](https://www.intentbasedpolicy.com/policies/databricks/mask-pan-egress) (databricks, egress): Masks payment-card numbers (PANs) in Databricks tool responses before the agent receives them.
- [Databricks: Redact PII in Tool Responses](https://www.intentbasedpolicy.com/policies/databricks/redact-pii-egress) (databricks, egress): Scans the response payloads of the Databricks MCP tools that carry lakehouse data back to the agent and rewrites personally identifiable information to fixed…
- [Databricks: Role-Gate Compute & Job Control](https://www.intentbasedpolicy.com/policies/databricks/role-gate-compute-ops) (databricks, ingress): The community JustTryAI/databricks-mcp-server exposes cluster and job control — create cluster, start cluster, terminate cluster, run job, and export…
- [Default-Deny Unaudited Airtable Tools](https://www.intentbasedpolicy.com/policies/airtable/default-deny-unknown-tools) (airtable, ingress): Maintains a per-tenant allowlist of audited Airtable tool-name suffixes and denies any call whose tool name does not end with an allowlisted entry.
- [Default-Deny Unaudited BigQuery Tools](https://www.intentbasedpolicy.com/policies/bigquery/default-deny-unknown-tools) (bigquery, ingress): Maintains a per-tenant allowlist of audited BigQuery tool-name suffixes and denies any call whose tool name does not end with an allowlisted entry.
- [Default-Deny Unknown Gusto Tools](https://www.intentbasedpolicy.com/policies/gusto/default-deny-unknown-tools) (gusto, ingress): Pins an allowlist of the 36 official Gusto MCP tool names and allows a call only when lower(input.resource.name) is an exact member of that list.
- [Default-Deny Unknown Linear Tools](https://www.intentbasedpolicy.com/policies/linear/default-deny-unknown-tools) (linear, ingress): Pins an audited allowlist of the verified official Linear MCP tool names and allows a call only when the incoming tool name matches an allowlisted name on…
- [Default-Deny Unknown monday Tools](https://www.intentbasedpolicy.com/policies/monday/default-deny-unknown-tools) (monday, ingress): Maintains a per-tenant allowlist of audited monday tool-name suffixes and denies any call whose tool name does not end with an allowlisted entry.
- [Default-Deny Unknown Power BI Modeling Tools](https://www.intentbasedpolicy.com/policies/power-bi/default-deny-unknown-modeling-ops) (power-bi, ingress): Pins a per-tenant allowlist of audited Power BI tool-name suffixes and denies any call whose tool name does not end with an allowlisted entry.
- [Default-Deny Unknown ServiceNow Tools](https://www.intentbasedpolicy.com/policies/servicenow/default-deny-unknown-tools) (servicenow, ingress): Maintains an allowlist of audited ServiceNow tool-name suffixes and denies any tool call whose name does not match an allowlisted entry.
- [Default-Deny Unknown Tableau Tools](https://www.intentbasedpolicy.com/policies/tableau/default-deny-unknown-tools) (tableau, ingress): Fails closed on tool drift. The policy carries a pinned allowlist of the 39 tools in the verified official Tableau web toolset (tableau/tableau-mcp v2.24.
- [Default-Deny Unknown Zapier Tools](https://www.intentbasedpolicy.com/policies/zapier/default-deny-unknown-tools) (zapier, ingress): Maintains an allowlist of audited Zapier tool-name suffixes and denies any tool call whose name does not match an allowlisted entry, with an alert-worthy…
- [Deny Agent Email Sends to External Recipients](https://www.intentbasedpolicy.com/policies/gmail/guard-external-send) (gmail, ingress): Denies Gmail send-class tool calls when any recipient in to, cc, or bcc falls outside a documented corporate-domain allowlist.
- [Deny Email PII](https://www.intentbasedpolicy.com/policies/onboarding/deny-email) (onboarding, ingress): This policy stops a request if it contains an email address. If there's no email address, the request goes through as normal.
- [Deny Graph API Batch Escape Hatch](https://www.intentbasedpolicy.com/policies/ms365/deny-graph-batch) (ms365, ingress): Blocks the Microsoft 365 MCP server's raw-Graph passthrough tool (graph-batch, observed live as ms365-graph-batch).
- [Deny Stripe API-Write Escape Hatch](https://www.intentbasedpolicy.com/policies/stripe/deny-escape-hatches-api-write) (stripe, ingress): Denies the stripe api write meta-tool — the single raw passthrough on the official Stripe MCP server that can execute any Stripe POST, PATCH, PUT, or DELETE…
- [Detect Email PII (Allow with Reason)](https://www.intentbasedpolicy.com/policies/onboarding/detect-email-allow) (onboarding, ingress): A watch-only starter policy.
- [Docusign: Redact SSN, Bank & Card Values on Egress](https://www.intentbasedpolicy.com/policies/docusign/redact-tab-values-egress) (docusign, egress): Scans the responses of Docusign envelope- and agreement-reading tools and rewrites high-confidence regulated identifiers before the response reaches the…
- [Dropbox: Redact PII, PANs, and Secrets in File Content](https://www.intentbasedpolicy.com/policies/dropbox/redact-content-egress) (dropbox, egress): Scans the responses of the Dropbox file-content read tools and sanitises the returned text before it reaches the agent.
- [Fence Confluence Reads & Search to Non-Restricted Spaces](https://www.intentbasedpolicy.com/policies/confluence/fence-restricted-spaces) (confluence, ingress): Fences a configurable set of restricted Confluence spaces (placeholder keys: HR, LEGAL, SEC) out of the agent's read and search paths unless the caller's IdP…
- [Fence GitHub Access to the Company Org Allowlist](https://www.intentbasedpolicy.com/policies/github/fence-scopes-org-allowlist) (github, ingress): Denies any GitHub tool call whose arguments.owner (read from input.payload.args.
- [Fence Glean Search by Datasource](https://www.intentbasedpolicy.com/policies/glean/fence-datasource-scope) (glean, ingress): Glean's search tool fans out across every system the tenant has indexed (Drive, Confluence, Slack, Jira, Gmail/Outlook, GitHub, Salesforce, Gong, HR…
- [Fence Gusto Compensation & Payroll Reads](https://www.intentbasedpolicy.com/policies/gusto/fence-comp-payroll-reads) (gusto, ingress): Denies the highest-sensitivity Gusto read tools unless the caller's IdP-asserted groups include the placeholder group hr-payroll-admins.
- [Fence Intercom Contact & Company PII Reads](https://www.intentbasedpolicy.com/policies/intercom/fence-contact-reads) (intercom, ingress): Gates Intercom's structured-PII read surface — customer contact and company profiles — by IdP group.
- [Fence NetSuite HR & Payroll SuiteQL Queries](https://www.intentbasedpolicy.com/policies/netsuite/fence-hr-payroll-suiteql) (netsuite, ingress): Fences the single biggest exfiltration surface on the NetSuite MCP server — ns runCustomSuiteQL, which runs arbitrary read-only SuiteQL across the entire ERP.
- [Fence Notion Member Directory to Admin & IT](https://www.intentbasedpolicy.com/policies/notion/fence-user-directory) (notion, ingress): Denies calls to the Notion member-directory tool (notion-get-users, matched by the -get-users suffix) unless the caller's IdP groups include an admin or IT…
- [Fence Regulated BigQuery Datasets by Group](https://www.intentbasedpolicy.com/policies/bigquery/fence-sensitive-datasets) (bigquery, ingress): Fences customer-designated regulated BigQuery data domains by data-domain IdP group, at ingress, before any statement or metadata lookup reaches BigQuery.
- [Fence Restricted Google Drive Files and Folders](https://www.intentbasedpolicy.com/policies/google-drive/fence-restricted-folders) (google-drive, ingress): Fences an admin-maintained denylist of restricted Google Drive file and folder IDs — HR records, M&A deal rooms, board packs, payroll — off the agent channel:
- [Fence Roadmap and Initiative Reads (Egress)](https://www.intentbasedpolicy.com/policies/linear/fence-roadmap-egress) (linear, egress): Fences the responses of Linear's roadmap, initiative, and strategy read tools.
- [Fence Sensitive Box Folders by IdP Group](https://www.intentbasedpolicy.com/policies/box/fence-sensitive-folders) (box, ingress): Fences pinned sensitive Box subtrees (HR, Finance, Legal, …) by ID.
- [Fence Sensitive Databricks Schemas](https://www.intentbasedpolicy.com/policies/databricks/fence-sensitive-schemas) (databricks, ingress): Fences off the most sensitive lakehouse namespaces from agents on the read side of Databricks.
- [Fence Sensitive Dropbox Paths by Team](https://www.intentbasedpolicy.com/policies/dropbox/fence-sensitive-paths) (dropbox, ingress): Fences protected Dropbox subtrees by path prefix . Dropbox addresses files and folders by a root-relative path (/Finance/2026/payroll.
- [Fence Sensitive monday Boards by IdP Group](https://www.intentbasedpolicy.com/policies/monday/fence-sensitive-boards) (monday, ingress): monday boards are schemaless business databases: HR/recruiting boards (candidate PII), CRM/deal boards (financial), and IT/security trackers routinely live…
- [Fence Sensitive ServiceNow Tables](https://www.intentbasedpolicy.com/policies/servicenow/fence-sensitive-tables) (servicenow, ingress): Fences off the most sensitive ServiceNow tables from two routes that reach them:
- [Fence Snowflake Sensitive Schemas by Data Domain](https://www.intentbasedpolicy.com/policies/snowflake/fence-sensitive-schemas) (snowflake, ingress): Fences customer-designated sensitive data domains inside a Snowflake warehouse by inspecting the SQL text the agent is about to run — not by tool name, which…
- [Fence Tableau Datasource Scope](https://www.intentbasedpolicy.com/policies/tableau/fence-datasource-scope) (tableau, ingress): Tableau's MCP server is a warehouse proxy: query-datasource runs a VizQL Data Service (VDS) query and returns raw row-level data — PII, PHI, payroll,…
- [Fence Writes to Sensitive Asana Projects](https://www.intentbasedpolicy.com/policies/asana/fence-sensitive-projects) (asana, ingress): Asana is routinely used for HR (hiring, performance, offboarding), legal, M&A, and incident work; those project bodies, comments, custom fields, and status…
- [Fence Zoom Agentic Search to Native Corpora](https://www.intentbasedpolicy.com/policies/zoom/fence-agentic-search) (zoom, ingress): Constrains Zoom's agentic-search tool ( search zoom) so it can only reach Zoom-native content.
- [Force Docusign Envelopes to Draft](https://www.intentbasedpolicy.com/policies/docusign/force-draft-envelopes) (docusign, ingress): Rewrites Docusign envelope-creation calls so the envelope is staged as a (status: "sent").
- [Force Internal Visibility on JSM Comments](https://www.intentbasedpolicy.com/policies/jira/force-internal-jsm-comments) (jira, ingress): Keeps agent-drafted Jira Service Management (JSM) comments off the customer-facing portal by rewriting addCommentToJiraIssue calls to carry a restrictive…
- [Force ServiceNow Comments to Internal Work Notes](https://www.intentbasedpolicy.com/policies/servicenow/force-internal-comments) (servicenow, ingress): Keeps agent-drafted ServiceNow comments off the customer/employee-visible journal by rewriting add comment calls to internal work notes.
- [Freeze Destructive Airtable Deletes](https://www.intentbasedpolicy.com/policies/airtable/freeze-record-deletion) (airtable, ingress): Denies every destructive Airtable tool call unless the caller's IdP token carries the placeholder group airtable-admins.
- [Freeze Destructive and Series-Wide Calendar Changes](https://www.intentbasedpolicy.com/policies/google-calendar/freeze-destructive-events) (google-calendar, ingress): Denies irreversible Google Calendar mutations on the agent channel:
- [Freeze Destructive Asana Operations](https://www.intentbasedpolicy.com/policies/asana/freeze-destructive-ops) (asana, ingress): Denies every destructive Asana tool call unless the caller's IdP token carries the placeholder group asana-admins.
- [Freeze Destructive Box Operations](https://www.intentbasedpolicy.com/policies/box/freeze-destructive-ops) (box, ingress): Freezes deletes and retention tampering on the community self-hosted Box MCP server (box-community/mcp-server-box).
- [Freeze Destructive Dropbox Operations](https://www.intentbasedpolicy.com/policies/dropbox/freeze-destructive-ops) (dropbox, ingress): Freezes the irreversible and bulk-mutation Dropbox tools on the agent channel, regardless of path. At ingress it denies, by tool-name suffix:
- [Freeze Destructive Gmail Operations](https://www.intentbasedpolicy.com/policies/gmail/freeze-destructive-ops) (gmail, ingress): Denies the irreversible destruction surface that community Gmail MCP servers expose — permanent email deletion, label deletion, and filter deletion — for…
- [Freeze Destructive Google Drive Operations](https://www.intentbasedpolicy.com/policies/google-drive/freeze-destructive-ops) (google-drive, ingress): Blocks Google Drive delete operations issued by agents.
- [Freeze Destructive Linear Operations](https://www.intentbasedpolicy.com/policies/linear/freeze-destructive-ops) (linear, ingress): Denies destructive Linear tool calls — the delete , archive , and session-logout classes — unless the caller's IdP token carries the placeholder group…
- [Freeze Destructive Microsoft 365 Operations](https://www.intentbasedpolicy.com/policies/ms365/freeze-destructive-ops) (ms365, ingress): Denies every Microsoft 365 tool call whose verb segment is delete- or cancel- unless the caller's IdP token carries the placeholder group m365-admin.
- [Freeze Destructive monday Operations](https://www.intentbasedpolicy.com/policies/monday/freeze-destructive-ops) (monday, ingress): Splits monday's destructive tool surface into two tiers and treats each differently at ingress, before the call ever reaches the monday MCP server:
- [Freeze Destructive QuickBooks Operations](https://www.intentbasedpolicy.com/policies/quickbooks/freeze-destructive-ops) (quickbooks, ingress): Denies every destructive QuickBooks Online (QBO) tool call on the agent channel before it reaches the MCP server.
- [Freeze Destructive Tableau Content Ops](https://www.intentbasedpolicy.com/policies/tableau/freeze-destructive-content) (tableau, ingress): Denies the irreversible content-mutation tools on the official tableau/tableau-mcp web server unless the caller's IdP token carries the placeholder group…
- [Freeze M365 Identity Plane](https://www.intentbasedpolicy.com/policies/ms365/freeze-identity-plane) (ms365, ingress): Freezes directory and membership mutations on the Microsoft 365 MCP surface. The policy denies, by tool-name suffix:
- [Freeze Notion Full-Page Content Overwrites](https://www.intentbasedpolicy.com/policies/notion/freeze-content-overwrite) (notion, ingress): Denies notion-update-page calls whose command argument is replace content — the one edge on Notion's hosted MCP server that overwrites a page's entire body…
- [Freeze Payroll Writes in Gusto](https://www.intentbasedpolicy.com/policies/gusto/freeze-payroll-writes) (gusto, ingress): Freezes every write and delete operation on a Gusto pipeline.
- [Freeze Power BI RLS Role Edits](https://www.intentbasedpolicy.com/policies/power-bi/freeze-rls-role-edits) (power-bi, ingress): Freezes edits to row-level-security (RLS) roles on the Power BI MCP surface.
- [Freeze Salesforce Record Deletes](https://www.intentbasedpolicy.com/policies/salesforce/freeze-record-deletes) (salesforce, ingress): Denies all Salesforce record-deletion capability on the agent channel unless the caller's IdP groups claim contains the placeholder group sf-admins.
- [Freeze ServiceNow Identity Plane](https://www.intentbasedpolicy.com/policies/servicenow/freeze-identity-plane) (servicenow, ingress): Freezes the identity-and-access mutation surface of the ServiceNow MCP server. The policy denies, by tool-name suffix:
- [Freeze Standing Automation & AI Agents in monday](https://www.intentbasedpolicy.com/policies/monday/freeze-standing-automation) (monday, ingress): Denies the monday tools that install side effects which outlive the governed MCP session. Two classes of tool are blocked:
- [Freeze the Zapier Toolset (No Self-Expansion)](https://www.intentbasedpolicy.com/policies/zapier/freeze-toolset) (zapier, ingress): In its default agentic mode, Zapier MCP exposes meta-tools that let the agent widen its own blast radius mid-session : enable zapier action and auto…
- [Gate Google Drive Writes to an Authorized IdP Group](https://www.intentbasedpolicy.com/policies/google-drive/role-gate-writes) (google-drive, ingress): Baseline least-privilege policy for Google Drive MCP traffic.
- [Gate QuickBooks Money-Movement by Finance Group](https://www.intentbasedpolicy.com/policies/quickbooks/gate-money-movement) (quickbooks, ingress): Gates the QuickBooks Online money-movement creation tools — create payment, create bill payment, create refund receipt, create transfer, and create deposit —…
- [Gate Zoom Transcripts & Recordings by Group](https://www.intentbasedpolicy.com/policies/zoom/guard-transcripts-by-group) (zoom, ingress): Gates retrieval of Zoom meeting transcripts, AI Companion summaries, and next-steps on the connector's core egress tools, enforcing minimum-necessary access:
- [GitHub: Redact Secrets from Read Responses](https://www.intentbasedpolicy.com/policies/github/redact-secrets-egress) (github, egress): Scans the responses of GitHub's crown-jewel read tools and masks known credential shapes with a fixed [REDACTED-SECRET] marker before the text enters agent…
- [Glean Default-Deny Unknown Tools](https://www.intentbasedpolicy.com/policies/glean/default-deny-unknown-tools) (glean, ingress): Pins a per-tenant allowlist of the verified built-in read tools on the Glean managed remote MCP server and denies every other tool suffix on the Glean server…
- [Glean: Gate Memory Writes (Read-Only Default)](https://www.intentbasedpolicy.com/policies/glean/gate-memory-writes) (glean, ingress): Gates mutating calls to Glean's long-term memory surface — the built-in tool exposed as memory (and as read memory in Glean's own client guide).
- [Glean: Redact PII from Read-Tool Responses](https://www.intentbasedpolicy.com/policies/glean/redact-pii-egress) (glean, egress): Scans the responses of Glean's content-returning read tools and rewrites high-confidence PII to fixed redaction tokens before the response reaches the…
- [Gmail Cap Bulk Export](https://www.intentbasedpolicy.com/policies/gmail/cap-bulk-export) (gmail, ingress): Throttles mass-harvesting of a mailbox by capping the per-call blast radius of the two Gmail MCP surfaces that return many full email bodies at once:
- [Gmail: Role-Gated Writes (Read-Only Default)](https://www.intentbasedpolicy.com/policies/gmail/role-gate-writes) (gmail, ingress): Makes Gmail read-only by default on the MCP path. Verified read tools pass for everyone.
- [Google Drive: Redact PII from File Content](https://www.intentbasedpolicy.com/policies/google-drive/redact-pii-egress) (google-drive, egress): Scans the responses of the content-returning Google Drive tools — file reads, downloads, and Docs/Sheets/Slides content fetches — and rewrites personally…
- [Guard Box Share Links and External Collaborations](https://www.intentbasedpolicy.com/policies/box/guard-share-links-external) (box, ingress): Blocks the externally-visible Box sharing surface — the riskiest Box surface an agent can touch — before the call ever reaches Box:
- [Guard Calculation Expressions in Tableau VDS Queries](https://www.intentbasedpolicy.com/policies/tableau/guard-query-calculation) (tableau, ingress): Inspects the structured VizQL Data Service (VDS) query carried by Tableau's query-datasource tool and denies the call for callers outside the data-analysts…
- [Guard Databricks SQL Against Writes and DDL](https://www.intentbasedpolicy.com/policies/databricks/guard-warehouse-sql) (databricks, ingress): Inspects the SQL statement string that Databricks SQL-executing tools carry in their argument and denies any statement that performs a write, schema change,…
- [Guard DAX Whole-Table Dumps in Power BI](https://www.intentbasedpolicy.com/policies/power-bi/guard-warehouse-sql-dax) (power-bi, ingress): Power BI semantic models front the warehouse: a model imports or DirectQueries lakehouse/warehouse tables — finance, HR, customer PII.
- [Guard Docusign External Recipients](https://www.intentbasedpolicy.com/policies/docusign/guard-external-recipients) (docusign, ingress): Blocks Docusign envelope-creation and recipient-update tool calls when any recipient email address has a domain outside the configured counterparty allowlist.
- [Guard Drive ACL Reconnaissance](https://www.intentbasedpolicy.com/policies/google-drive/guard-acl-recon) (google-drive, ingress): Denies Google Drive get file permissions tool calls unless the caller's IdP groups claim contains infosec. All other tool calls pass through unchanged.
- [Guard OneDrive/SharePoint Share Links](https://www.intentbasedpolicy.com/policies/ms365/guard-share-links) (ms365, ingress): Stops agents from opening OneDrive/SharePoint files to the whole internet. It guards the two Microsoft 365 sharing tools:
- [Guard Vendor Banking and Tax-ID Changes](https://www.intentbasedpolicy.com/policies/quickbooks/guard-vendor-banking) (quickbooks, ingress): Blocks create vendor and update vendor calls whose arguments carry a vendor's payment coordinates — bank account number, routing / ACH branch details — or…
- [Gusto Cap Roster Export](https://www.intentbasedpolicy.com/policies/gusto/cap-roster-export) (gusto, ingress): Throttles full-roster exfiltration on Gusto's two broad outbound list tools — list company employees and list company contractors — by rewriting their…
- [Gusto: Redact Financial IDs in Responses](https://www.intentbasedpolicy.com/policies/gusto/redact-financial-ids-egress) (gusto, egress): Instantiates PF-02 (redact-pii-egress) on the Gusto read path.
- [HubSpot Block Deal Closure](https://www.intentbasedpolicy.com/policies/hubspot/block-deal-closure) (hubspot, ingress): Blocks HubSpot CRM-object calls that move a deal into a closed stage (closedwon or closedlost). Both create and update requests are inspected.
- [HubSpot Cap Bulk Export](https://www.intentbasedpolicy.com/policies/hubspot/cap-bulk-export) (hubspot, ingress): Clamps the page size of HubSpot bulk-read tool calls before they reach the HubSpot MCP server, so a single agent request to a covered bulk-read tool can…
- [HubSpot Freeze Destructive Ops](https://www.intentbasedpolicy.com/policies/hubspot/freeze-destructive-ops) (hubspot, ingress): Blocks every archive/deletion-class HubSpot tool call, plus the consent-destroying contact unsubscribe, before it reaches the MCP server.
- [HubSpot Protect Associations](https://www.intentbasedpolicy.com/policies/hubspot/protect-associations) (hubspot, ingress): Blocks HubSpot CRM-object calls that create or change associations between objects (deal↔company, contact↔company, etc.).
- [HubSpot Protect Deal Owner](https://www.intentbasedpolicy.com/policies/hubspot/protect-deal-owner) (hubspot, ingress): Blocks HubSpot CRM-object update calls that set or change a deal's owner.
- [HubSpot Protect Lifecycle Stage](https://www.intentbasedpolicy.com/policies/hubspot/protect-lifecycle-stage) (hubspot, ingress): Blocks HubSpot CRM-object calls that set or change a contact's lifecycle stage.
- [HubSpot Read-Only](https://www.intentbasedpolicy.com/policies/hubspot/read-only) (hubspot, ingress): Makes the HubSpot connection read-only by blocking the write tool.
- [HubSpot Redact PII](https://www.intentbasedpolicy.com/policies/hubspot/redact-pii) (hubspot, egress): Redacts sensitive contact information from HubSpot tool responses before they reach the caller.
- [HubSpot Role-Gate Schema and Consent](https://www.intentbasedpolicy.com/policies/hubspot/role-gate-schema-consent) (hubspot, ingress): Sits one privilege tier above hubspot/role-gate-writes: ordinary crm-writers can create and edit CRM records, but two higher-blast-radius write classes are…
- [HubSpot Role-Gate Writes](https://www.intentbasedpolicy.com/policies/hubspot/role-gate-writes) (hubspot, ingress): Gates every HubSpot write tool behind an IdP group: callers whose JWT groups claim contains crm-writers may create and update CRM records; everyone else gets…
- [Human-Only ServiceNow Change Approval](https://www.intentbasedpolicy.com/policies/servicenow/require-human-approval-changes) (servicenow, ingress): Unconditionally denies the ServiceNow change-management control-gate tools — the ones whose names end in approve change, reject change, or submit change for…
- [Human-Only Stripe Dispute Submission](https://www.intentbasedpolicy.com/policies/stripe/require-human-approval-dispute-submit) (stripe, ingress): Strips the irreversible submit flag from Stripe update dispute tool calls.
- [Intercom: Keep Agent Help Center Articles in Draft](https://www.intentbasedpolicy.com/policies/intercom/deny-article-publish) (intercom, ingress): Keeps agent-authored Intercom Help Center articles in draft so a human reviews them before they go live on the public Help Center.
- [Intercom: Mask Card Numbers in Conversation Responses](https://www.intentbasedpolicy.com/policies/intercom/mask-pan-egress) (intercom, egress): Masks payment-card numbers (PANs) in Intercom conversation content returned to agents by the conversation- and free-text-returning read tools.
- [Intercom: Redact PII from Conversation & Contact Reads](https://www.intentbasedpolicy.com/policies/intercom/redact-conversation-pii) (intercom, egress): Scans the free-text returned by Intercom's conversation- and contact-read MCP tools and rewrites high-confidence personal identifiers and credential shapes…
- [JIRA: Block Change-History Actor Spoofing](https://www.intentbasedpolicy.com/policies/jira/deny-history-actor-spoofing) (jira, ingress): Blocks any official Jira write call — transitionJiraIssue, editJiraIssue, or createJiraIssue — that carries a historyMetadata block, before it reaches the…
- [JIRA: Cap Field and Result Exposure on Reads](https://www.intentbasedpolicy.com/policies/jira/cap-read-field-exposure) (jira, ingress): Narrows the breadth of JIRA read requests before they run, on the two read surfaces that can pull large amounts of issue data into model context:
- [JIRA: Deny Sensitive Project Search and View](https://www.intentbasedpolicy.com/policies/jira/deny-view-search-sensitive-projects) (jira, ingress): Keeps issues that belong to a configurable set of "sensitive" JIRA projects out of read access through the JIRA MCP server.
- [JIRA: Freeze Destructive Issue Operations](https://www.intentbasedpolicy.com/policies/jira/freeze-destructive-ops) (jira, ingress): Freezes the three irreversible Jira operations on the agent channel: jira delete issue, jira remove issue link, and jira remove watcher.
- [JIRA: Protect Sensitive Projects from Writes](https://www.intentbasedpolicy.com/policies/jira/deny-write-sensitive-projects) (jira, ingress): Blocks write operations against issues that belong to a configurable set of "sensitive" JIRA projects.
- [JIRA: Redact Sensitive Information from Issue Views](https://www.intentbasedpolicy.com/policies/jira/redact-sensitive-info) (jira, egress): Redacts sensitive content from the responses of JIRA issue-view tools before they reach the caller.
- [JIRA: Role-Gated Writes (Read-Only Default)](https://www.intentbasedpolicy.com/policies/jira/role-gate-writes) (jira, ingress): Makes Jira read-only by default on the MCP path.
- [Linear: Redact Customer Revenue and Contacts](https://www.intentbasedpolicy.com/policies/linear/redact-customer-pii-egress) (linear, egress): Masks commercial and contact identifiers in the responses of Linear's Customers read tools before they reach the agent.
- [Lock Direct Journal-Entry Ledger Writes](https://www.intentbasedpolicy.com/policies/quickbooks/protect-closed-periods-journal-entries) (quickbooks, ingress): Denies the QuickBooks Online tools create journal entry and update journal entry at ingress for every caller except those whose IdP claims include the…
- [Mask Card Numbers in Email Content Read by Agents](https://www.intentbasedpolicy.com/policies/gmail/mask-pan-egress) (gmail, egress): Masks payment-card-number (PAN) shapes in email content returned to agents by Gmail mailbox-read tools.
- [Microsoft 365: Redact PII from Mail, Files & Transcripts](https://www.intentbasedpolicy.com/policies/ms365/redact-pii-egress) (ms365, egress): Scans the responses of the highest-density PII read surfaces in Microsoft 365 — mail bodies, Excel ranges, SharePoint list items, meeting transcripts, and…
- [monday: Redact PII in Board & Doc Reads](https://www.intentbasedpolicy.com/policies/monday/redact-board-pii-egress) (monday, egress): Two egress controls in one policy, both scoped to the monday MCP read path:
- [NetSuite Cap SuiteQL Bulk Export](https://www.intentbasedpolicy.com/policies/netsuite/cap-bulk-export) (netsuite, ingress): Instantiates the PF-08 cap-bulk-export family as a transform-only ingress policy on ns runCustomSuiteQL — the NetSuite MCP tool that runs arbitrary read-only…
- [NetSuite Default-Deny Unknown MCP Tools](https://www.intentbasedpolicy.com/policies/netsuite/default-deny-unknown-tools) (netsuite, ingress): Pins an allowlist of the audited NetSuite MCP Standard Tools and denies every other tool call before it reaches the NetSuite AI Connector.
- [NetSuite Guard Vendor Banking Edits (Anti-BEC)](https://www.intentbasedpolicy.com/policies/netsuite/guard-vendor-banking) (netsuite, ingress): Instantiates policy family PF-10 (guard-vendor-banking) — the anti-BEC / payment-fraud control — for the Oracle NetSuite MCP Standard Tools SuiteApp.
- [NetSuite: Redact Financial PII in Responses](https://www.intentbasedpolicy.com/policies/netsuite/redact-financial-pii) (netsuite, egress): Instantiates PF-02 (redact-pii-egress) on the NetSuite read path.
- [Notion: Redact PII from Read Responses](https://www.intentbasedpolicy.com/policies/notion/redact-pii-egress) (notion, egress): Scans the responses of the Notion hosted MCP server's content-returning read tools and rewrites personally identifiable information to fixed redaction tokens…
- [Power BI: Redact PII in Query Results](https://www.intentbasedpolicy.com/policies/power-bi/redact-pii-dax-results) (power-bi, egress): Scans the content returned by Power BI's result-returning tools and rewrites high-confidence PII shapes to fixed, non-recoverable redaction tokens before the…
- [Prevent Public Exposure of GitHub Repos, Gists & Forks](https://www.intentbasedpolicy.com/policies/github/deny-public-exposure-repos) (github, ingress): Stops the agent from exposing private code to the public across three GitHub write tools, at ingress — before the call reaches the GitHub MCP server, so a…
- [Protect Financial Postings by Role](https://www.intentbasedpolicy.com/policies/netsuite/protect-closed-periods) (netsuite, ingress): Denies the NetSuite record-write tools ns createRecord and ns updateRecord when they target a financial-transaction record type — journalentry (including the…
- [QuickBooks: Redact Employee & Vendor PII on Read](https://www.intentbasedpolicy.com/policies/quickbooks/redact-pii-egress-employee) (quickbooks, egress): On the read path, this policy masks sensitive identifiers in the responses of four QuickBooks Online (QBO) name-entity read tools — get employee, search…
- [Read-Only Baseline: Group-Gated Microsoft 365 Writes](https://www.intentbasedpolicy.com/policies/ms365/role-gate-writes) (ms365, ingress): The least-privilege baseline for Microsoft 365 through the gateway: every tool call is allowed only if it is a read , or the caller's IdP token carries the…
- [Read-Only GitHub for Non-Engineers](https://www.intentbasedpolicy.com/policies/github/role-gate-writes-engineering) (github, ingress): Establishes the least-privilege baseline for the GitHub MCP connector on the agent channel.
- [Read-Only Stripe by Default (Role-Gate Billing Writes)](https://www.intentbasedpolicy.com/policies/stripe/role-gate-writes-billing) (stripe, ingress): Establishes a read-only-by-default Stripe posture over the MCP path. The named write and destructive billing tools —
- [Redact Attendee PII and Meeting Links in Calendar Reads](https://www.intentbasedpolicy.com/policies/google-calendar/redact-attendee-pii) (google-calendar, egress): Scrubs sensitive fields from the responses of Google Calendar read tools before they reach the agent, for callers who lack the placeholder calendar-full-read…
- [Redact Email PII](https://www.intentbasedpolicy.com/policies/onboarding/redact-email) (onboarding, egress): This policy automatically masks email addresses in what a tool sends back, replacing each one with [REDACTED] before your agent ever sees it.
- [Require Human Approval: GitHub Merges & Approvals](https://www.intentbasedpolicy.com/policies/github/require-human-approval-merge) (github, ingress): Keeps a human in the loop on the two GitHub actions that consummate a code change: merging a pull request and approving one .
- [Role-Gate All Zapier Writes](https://www.intentbasedpolicy.com/policies/zapier/role-gate-writes) (zapier, ingress): Zapier MCP is an aggregator: one connector proxies actions across 9,000+ apps, and every create/update/delete/send funnels through a small, predictable…
- [Role-Gate Dropbox Writes to the Writers Group](https://www.intentbasedpolicy.com/policies/dropbox/role-gate-writes) (dropbox, ingress): Establishes the per-app least-privilege write floor for Dropbox.
- [Salesforce Cap Bulk Data Export](https://www.intentbasedpolicy.com/policies/salesforce/cap-bulk-export) (salesforce, ingress): Blocks bulk PII extraction through Salesforce query tools by inspecting the free-text query arguments that are the real policy surface for these servers.
- [Salesforce Deny API Escape Hatches](https://www.intentbasedpolicy.com/policies/salesforce/deny-escape-hatches) (salesforce, ingress): Unconditionally denies the raw-code and raw-API tools exposed by the community Salesforce MCP servers — tools that bypass every object- and argument-level…
- [Salesforce Guard Opportunity Pipeline Fields](https://www.intentbasedpolicy.com/policies/salesforce/guard-opportunity-pipeline) (salesforce, ingress): Keeps revenue-pipeline moves human-approved.
- [Salesforce Protect Contact Fields](https://www.intentbasedpolicy.com/policies/salesforce/protect-contact-fields) (salesforce, ingress): Blocks Salesforce Contact updates that modify protected fields — ownership, account linkage, contact PII, name, and consent flags.
- [Salesforce Query Allowlist](https://www.intentbasedpolicy.com/policies/salesforce/query-allowlist) (salesforce, ingress): Restricts Salesforce SOQL queries so only Account, Contact, and Opportunity records can be retrieved.
- [Salesforce Read-Only Access](https://www.intentbasedpolicy.com/policies/salesforce/read-only) (salesforce, ingress): Restricts the Salesforce MCP server to read-only access.
- [Salesforce Redact PII](https://www.intentbasedpolicy.com/policies/salesforce/redact-pii) (salesforce, egress): Redacts personal contact information from Salesforce tool responses before they reach the caller.
- [Salesforce Role-Gated Writes](https://www.intentbasedpolicy.com/policies/salesforce/role-gate-writes) (salesforce, ingress): The PF-12 least-privilege baseline for Salesforce.
- [Scrub Unapproved Stripe Payment-Link Redirects](https://www.intentbasedpolicy.com/policies/stripe/guard-share-links-payment-redirect) (stripe, ingress): Scrubs the post-payment redirect from Stripe payment-link creation calls.
- [ServiceNow: Role-Gated Writes (Read-Only Default)](https://www.intentbasedpolicy.com/policies/servicenow/role-gate-writes) (servicenow, ingress): else fails closed
- [Slack Role-Gate Writes](https://www.intentbasedpolicy.com/policies/slack/role-gate-writes) (slack, ingress): Gates every Slack write-class tool behind an IdP group: callers whose JWT groups claim contains slack-writers may send and schedule messages, add or remove…
- [Slack: Block Agent Posts to External Channels](https://www.intentbasedpolicy.com/policies/slack/guard-external-send) (slack, ingress): Denies Slack message-write calls whose destination is an externally shared Slack Connect channel.
- [Slack: Deny Channel Creation](https://www.intentbasedpolicy.com/policies/slack/deny-channel-creation) (slack, ingress): Blocks Slack channel-creation tool calls at ingress. Every other Slack tool — and every non-Slack tool — passes through untouched.
- [Slack: Deny DM and Private-Conversation Reads and Search](https://www.intentbasedpolicy.com/policies/slack/guard-dm-privacy) (slack, ingress): Denies the agent read reach into Slack DMs and private conversations on the paths below — the workspace's highest concentration of PII/PHI (HR issues, health…
- [Slack: Deny Read/Search/Summarize of Sensitive Channels](https://www.intentbasedpolicy.com/policies/slack/deny-read-search-summarize-sensitive-channels) (slack, ingress): Blocks read, search, and summarize operations that target a configurable set of "sensitive" Slack channels.
- [Slack: Deny Sending Direct Messages](https://www.intentbasedpolicy.com/policies/slack/deny-direct-messages) (slack, ingress): Blocks Slack message-write calls whose destination resolves to a direct conversation — a 1:1 DM, a message posted to a user ID (which Slack auto-opens as a…
- [Slack: Mask Card Numbers in Message and Search Responses](https://www.intentbasedpolicy.com/policies/slack/mask-pan-egress) (slack, egress): Masks payment-card numbers (PANs) in Slack content returned to agents by message-read, thread-read, canvas-read, history, and search tools.
- [Slack: Redact Profile PII from User Lookups](https://www.intentbasedpolicy.com/policies/slack/redact-profile-pii) (slack, egress): Redacts personally identifiable information — email addresses, phone numbers, and Slack custom profile fields (which commonly carry phone, title, and…
- [Slack: Redact Sensitive Information from Messages](https://www.intentbasedpolicy.com/policies/slack/redact-sensitive-info) (slack, ingress): Redacts sensitive content from outgoing Slack message arguments before the call reaches Slack.
- [Snowflake Default-Deny Unknown Tools](https://www.intentbasedpolicy.com/policies/snowflake/default-deny-unknown-tools) (snowflake, ingress): Pins an allowlist of the exact Snowflake tool names your team audited and denies every other tool name on the Snowflake MCP server(s).
- [Snowflake Deny Composite & Generic Tools](https://www.intentbasedpolicy.com/policies/snowflake/deny-composite-cortex-tools) (snowflake, ingress): Denies the opaque composite and generic passthrough tools on the Snowflake-managed MCP server whose execution the gateway cannot inspect one SQL statement at…
- [Snowflake: Redact PII from Query Result Sets](https://www.intentbasedpolicy.com/policies/snowflake/redact-pii-egress) (snowflake, egress): Scans the row content returned by the result-returning Snowflake MCP tools and rewrites personally identifiable information to fixed redaction tokens before…
- [Stripe Refund Group Gate and Amount Cap](https://www.intentbasedpolicy.com/policies/stripe/gate-money-movement-refund-cap) (stripe, ingress): Denies Stripe refund tool calls — money out, irreversible — unless the caller's IdP groups include finance or billing-admin.
- [Stripe: Redact Customer PII from Bulk Reads](https://www.intentbasedpolicy.com/policies/stripe/redact-pii-egress-customer) (stripe, egress): Masks customer PII in the responses of Stripe's bulk PII egress channels before they reach the agent.
- [Tableau: Redact PII & Mask PANs in Query Results](https://www.intentbasedpolicy.com/policies/tableau/redact-pii-query-results) (tableau, egress): Tableau is a warehouse proxy: the data-returning tools stream raw row-level content out of whatever the published datasource connects to — PII, PHI, payroll,…
- [Zapier: Mask Card Numbers in Read Responses](https://www.intentbasedpolicy.com/policies/zapier/mask-pan-egress) (zapier, egress): Masks payment-card numbers (PANs) in Zapier MCP read responses before they reach the agent.
- [Zoom: Redact PII in Meeting Intelligence](https://www.intentbasedpolicy.com/policies/zoom/redact-pii-meeting-intelligence) (zoom, egress): Scans the responses of Zoom's meeting-intelligence read surfaces — AI summaries, verbatim transcripts, recording resources, and Zoom Docs content — and…