All policies
Every policy in the store — 190 of them, browsable by app, direction, and tag. Filter to the control you need, then open it for the Rego and the import path.
| Policy | App | Direction | Bundles | Purpose |
|---|---|---|---|---|
| Airtable: Redact PII in Record Reads | airtable | egress | soc2gdpr-ccpa | Scans the responses of the Airtable record-read tools — the calls that return row fields values — and rewrites high-confidence PII shapes to a fixed… |
| Asana: Redact PII in Task & Comment Reads | asana | egress | soc2gdpr-ccpa | On the Asana MCP read path, this transform scans the free-text business fields that ride back in task, comment/story, and status-update responses — notes,… |
| BigQuery: Redact PII in Query Results | bigquery | egress | soc2hipaagdpr-ccpa | Scans the content returned by BigQuery's result-returning tools and rewrites high-confidence PII shapes to fixed, non-recoverable redaction tokens before the… |
| Block Agent Email to External Recipients | ms365 | ingress | soc2hipaagdpr-ccpa | Blocks agent-initiated Microsoft 365 email sends when any recipient address falls outside a corporate-domain allowlist. |
| Block BigQuery Exfiltration and Cross-Project Writes | bigquery | ingress | soc2pci-dssgdpr-ccpa | Inspects the raw GoogleSQL string carried by BigQuery SQL tools and denies any statement that moves data out of the tenant's own project — even when the call… |
| Block Bulk Export & External Staging (Snowflake) | snowflake | ingress | soc2pci-dssgdpr-ccpa | Blocks Snowflake SQL-execution tool calls whose query text moves whole tables off the Snowflake perimeter — bulk export to cloud storage or a stage, and… |
| Block Calendar Invites to External Attendees | google-calendar | ingress | soc2hipaagdpr-ccpa | Denies Google Calendar event-write tool calls — create event / create-event, update event / update-event, and the consolidated manage event — whenever any… |
| Block Destructive and Export SQL on Notion Data Sources | notion | ingress | soc2 | Inspects Notion data-source query tool calls (notion-query-data-sources on the hosted server, query-data-source on the official local server) and denies any… |
| Block Destructive and Mutating Snowflake SQL | snowflake | ingress | soc2pci-dsssox | Inspects the SQL text that Snowflake MCP tools carry in their query argument and denies any statement in a mutating or destructive class — DROP, TRUNCATE,… |
| Block Destructive SQL in BigQuery Queries | bigquery | ingress | soc2pci-dsssox | Inspects the raw GoogleSQL string carried by BigQuery write-capable query tools and denies any statement in a state-changing class — DML… |
| Block External Sends Hidden in Zapier Instructions | zapier | ingress | soc2gdpr-ccpa | Every Zapier MCP tool — in both the agentic and classic modes — accepts a free-text instructions string that Zapier's server-side AI uses to fill any… |
| Block External Team Chat Invites & Members | zoom | ingress | soc2gdpr-ccpahipaa | Stops a Zoom Team Chat agent from pulling external parties into the organization's chat surface. |
| Block Gmail Filter Creation (Auto-Forward Persistence) | gmail | ingress | soc2 | Blocks the classic BEC/exfiltration persistence primitive: Gmail filters that can auto-forward or auto-delete mail and outlive the agent session. |
| Block Irreversible Docusign Void and Workflow Kills | docusign | ingress | soc2 | Denies the irreversible destructive operations on the Docusign agent path: |
| Block Linear Webhook Creation | linear | ingress | soc2 | Unconditionally denies any Linear tool that creates, updates, or deletes a webhook — linear createWebhook, linear deleteWebhook, and update variants. |
| Block Mail-Rule and Webhook Persistence | ms365 | ingress | soc2 | Unconditionally denies the classic business-email-compromise (BEC) persistence surface in Microsoft 365: creating or updating Outlook mail rules, changing… |
| Block Power BI RLS-Bypass Service-Principal Queries | power-bi | ingress | soc2 | On Microsoft's remote Power BI MCP server (https://api.fabric.microsoft. |
| Block Public Dropbox Share, Download, and File-Request Links | dropbox | ingress | soc2hipaagdpr-ccpa | Denies, by default, the Dropbox tools that turn an internal file into an internet-visible resource in a single call — before the request ever reaches Dropbox: |
| Block Public Visibility & Guest Delegation | google-calendar | ingress | soc2gdpr-ccpa | Blocks Google Calendar create and update event calls that would expose the event to the world or hand control of it to guests. |
| Block Secrets in Confluence Pages and Comments | confluence | ingress | atlassiansoc2 | Blocks Confluence write calls whose body looks like it contains a live credential — an API key, password, token, or PEM-formatted private key — before the… |
| Block Secrets in GitHub Commits & PRs | github | ingress | soc2 | Blocks GitHub write tool calls whose payload looks like it carries a live credential into a repository, gist, pull request, or comment. |
| Block Secrets in Slack Messages | slack | ingress | im-messagingsoc2 | Blocks Slack send-message tool calls whose message body looks like it contains a secret — API keys, passwords, tokens, or PEM-formatted private keys. |
| Block Secrets in Zoom Team Chat | zoom | ingress | soc2 | Blocks Zoom Team Chat send/update tool calls whose message content looks like it contains a live secret — API keys, passwords, bearer tokens, or… |
| Box: Redact PII from File Content on Egress | box | egress | soc2hipaagdpr-ccpa | Scans the responses of Box content-returning tools and rewrites personally identifiable information to fixed redaction tokens before the response reaches the… |
| Box: Role-Gated Writes (Read-Only Default) | box | ingress | soc2gdpr-ccpa | Makes Box read-only by default on the MCP path. |
| Cap Asana Batch Task Mutations | asana | ingress | soc2 | Caps the blast radius of Asana's official V2 batch write tools. At ingress it: |
| Cap Docusign Directory and Document Egress | docusign | egress | soc2gdpr-ccpa | Bounds the two largest data-out channels in the Docusign MCP landscape: |
| Cap Glean Bulk Search Export | glean | ingress | soc2hipaagdpr-ccpa | Clamps the bulk-export parameters on Glean search calls before they reach the Glean MCP server, so a single agent request cannot pull an entire indexed… |
| Cap Google Drive Search & Listing Page Sizes | google-drive | ingress | soc2hipaagdpr-ccpa | Clamps the page size of Google Drive search and listing calls to a documented cap (25 results per call). |
| Cap Intercom Contact Enumeration | intercom | ingress | soc2hipaapci-dssgdpr-ccpa | caller is a CRM admin); clamp page size on everything else; allow the rest |
| Cap QuickBooks Bulk Search Exports | quickbooks | ingress | gdpr-ccpapci-dsssoc2 | Clamps the bulk-read levers on every QuickBooks Online search tool so an agent cannot pull the entire general ledger — or a full customer, vendor, or… |
| Clamp Bulk Airtable Record Reads | airtable | ingress | soc2gdpr-ccpa | Airtable bases routinely hold CRM contacts, applicant-tracking pipelines, customer/financial trackers, and — on HIPAA-eligible Enterprise plans — health-ops… |
| Confine Airtable Agent to Allowlisted Bases | airtable | ingress | soc2gdpr-ccpa | An Airtable OAuth grant (or Personal Access Token) with the workspacesAndBases:read scope spans the entire workspace — every base the connected identity can… |
| Confluence: Deny Org-Wide & Public Publication | confluence | ingress | atlassiansoc2gdpr-ccpa | Stops a prompt-injected or erring agent from broadcasting Confluence content org-wide or to anonymous external readers. |
| Confluence: Freeze Page & Attachment Deletion | confluence | ingress | atlassiansoc2 | Freezes the two irreversible Confluence deletion tools on the agent channel: confluence delete page and confluence delete attachment. |
| Confluence: Redact PII from Page & Comment Responses | confluence | egress | soc2hipaagdpr-ccpaatlassian | Scans the responses of Confluence page, comment, and search read tools and rewrites personally identifiable information to fixed redaction tokens before the… |
| Constrain Notion Connected-Tool Search | notion | ingress | soc2 | Notion's hosted MCP server (notion-search) does not just search Notion pages — through Notion AI connectors it also searches connected Slack, Google Drive,… |
| Databricks Default-Deny Unknown Tools | databricks | ingress | soc2 | Pins an allowlist of the exact Databricks tool names your team audited and denies every other tool name on the Databricks MCP server(s). |
| Databricks: Mask Cardholder PANs in Responses | databricks | egress | soc2pci-dssgdpr-ccpa | Masks payment-card numbers (PANs) in Databricks tool responses before the agent receives them. |
| Databricks: Redact PII in Tool Responses | databricks | egress | soc2hipaagdpr-ccpa | Scans the response payloads of the Databricks MCP tools that carry lakehouse data back to the agent and rewrites personally identifiable information to fixed… |
| Databricks: Role-Gate Compute & Job Control | databricks | ingress | soc2 | The community JustTryAI/databricks-mcp-server exposes cluster and job control — create cluster, start cluster, terminate cluster, run job, and export… |
| Default-Deny Unaudited Airtable Tools | airtable | ingress | soc2 | Maintains a per-tenant allowlist of audited Airtable tool-name suffixes and denies any call whose tool name does not end with an allowlisted entry. |
| Default-Deny Unaudited BigQuery Tools | bigquery | ingress | soc2 | Maintains a per-tenant allowlist of audited BigQuery tool-name suffixes and denies any call whose tool name does not end with an allowlisted entry. |
| Default-Deny Unknown Gusto Tools | gusto | ingress | soc2 | Pins an allowlist of the 36 official Gusto MCP tool names and allows a call only when lower(input.resource.name) is an exact member of that list. |
| Default-Deny Unknown Linear Tools | linear | ingress | soc2 | Pins an audited allowlist of the verified official Linear MCP tool names and allows a call only when the incoming tool name matches an allowlisted name on… |
| Default-Deny Unknown monday Tools | monday | ingress | soc2 | Maintains a per-tenant allowlist of audited monday tool-name suffixes and denies any call whose tool name does not end with an allowlisted entry. |
| Default-Deny Unknown Power BI Modeling Tools | power-bi | ingress | soc2 | Pins a per-tenant allowlist of audited Power BI tool-name suffixes and denies any call whose tool name does not end with an allowlisted entry. |
| Default-Deny Unknown ServiceNow Tools | servicenow | ingress | soc2 | Maintains an allowlist of audited ServiceNow tool-name suffixes and denies any tool call whose name does not match an allowlisted entry. |
| Default-Deny Unknown Tableau Tools | tableau | ingress | soc2 | Fails closed on tool drift. The policy carries a pinned allowlist of the 39 tools in the verified official Tableau web toolset (tableau/tableau-mcp v2.24. |
| Default-Deny Unknown Zapier Tools | zapier | ingress | soc2 | Maintains an allowlist of audited Zapier tool-name suffixes and denies any tool call whose name does not match an allowlisted entry, with an alert-worthy… |
| Deny Agent Email Sends to External Recipients | gmail | ingress | soc2hipaagdpr-ccpa | Denies Gmail send-class tool calls when any recipient in to, cc, or bcc falls outside a documented corporate-domain allowlist. |
| Deny Email PII | onboarding | ingress | This policy stops a request if it contains an email address. If there's no email address, the request goes through as normal. | |
| Deny Graph API Batch Escape Hatch | ms365 | ingress | soc2 | Blocks the Microsoft 365 MCP server's raw-Graph passthrough tool (graph-batch, observed live as ms365-graph-batch). |
| Deny Stripe API-Write Escape Hatch | stripe | ingress | soxsoc2 | Denies the stripe api write meta-tool — the single raw passthrough on the official Stripe MCP server that can execute any Stripe POST, PATCH, PUT, or DELETE… |
| Detect Email PII (Allow with Reason) | onboarding | ingress | A watch-only starter policy. | |
| Docusign: Redact SSN, Bank & Card Values on Egress | docusign | egress | soc2gdpr-ccpa | Scans the responses of Docusign envelope- and agreement-reading tools and rewrites high-confidence regulated identifiers before the response reaches the… |
| Dropbox: Redact PII, PANs, and Secrets in File Content | dropbox | egress | soc2hipaagdpr-ccpa | Scans the responses of the Dropbox file-content read tools and sanitises the returned text before it reaches the agent. |
| Fence Confluence Reads & Search to Non-Restricted Spaces | confluence | ingress | atlassiansoc2hipaagdpr-ccpa | Fences a configurable set of restricted Confluence spaces (placeholder keys: HR, LEGAL, SEC) out of the agent's read and search paths unless the caller's IdP… |
| Fence GitHub Access to the Company Org Allowlist | github | ingress | soc2 | Denies any GitHub tool call whose arguments.owner (read from input.payload.args. |
| Fence Glean Search by Datasource | glean | ingress | soc2hipaagdpr-ccpa | Glean's search tool fans out across every system the tenant has indexed (Drive, Confluence, Slack, Jira, Gmail/Outlook, GitHub, Salesforce, Gong, HR… |
| Fence Gusto Compensation & Payroll Reads | gusto | ingress | soc2gdpr-ccpa | Denies the highest-sensitivity Gusto read tools unless the caller's IdP-asserted groups include the placeholder group hr-payroll-admins. |
| Fence Intercom Contact & Company PII Reads | intercom | ingress | soc2hipaapci-dssgdpr-ccpa | Gates Intercom's structured-PII read surface — customer contact and company profiles — by IdP group. |
| Fence NetSuite HR & Payroll SuiteQL Queries | netsuite | ingress | gdpr-ccpasoc2 | Fences the single biggest exfiltration surface on the NetSuite MCP server — ns runCustomSuiteQL, which runs arbitrary read-only SuiteQL across the entire ERP. |
| Fence Notion Member Directory to Admin & IT | notion | ingress | soc2gdpr-ccpa | Denies calls to the Notion member-directory tool (notion-get-users, matched by the -get-users suffix) unless the caller's IdP groups include an admin or IT… |
| Fence Regulated BigQuery Datasets by Group | bigquery | ingress | soc2hipaapci-dssgdpr-ccpa | Fences customer-designated regulated BigQuery data domains by data-domain IdP group, at ingress, before any statement or metadata lookup reaches BigQuery. |
| Fence Restricted Google Drive Files and Folders | google-drive | ingress | soc2hipaagdpr-ccpa | Fences an admin-maintained denylist of restricted Google Drive file and folder IDs — HR records, M&A deal rooms, board packs, payroll — off the agent channel: |
| Fence Roadmap and Initiative Reads (Egress) | linear | egress | soc2 | Fences the responses of Linear's roadmap, initiative, and strategy read tools. |
| Fence Sensitive Box Folders by IdP Group | box | ingress | soc2hipaagdpr-ccpa | Fences pinned sensitive Box subtrees (HR, Finance, Legal, …) by ID. |
| Fence Sensitive Databricks Schemas | databricks | ingress | soc2hipaapci-dssgdpr-ccpa | Fences off the most sensitive lakehouse namespaces from agents on the read side of Databricks. |
| Fence Sensitive Dropbox Paths by Team | dropbox | ingress | soc2hipaagdpr-ccpa | Fences protected Dropbox subtrees by path prefix . Dropbox addresses files and folders by a root-relative path (/Finance/2026/payroll. |
| Fence Sensitive monday Boards by IdP Group | monday | ingress | soc2gdpr-ccpa | monday boards are schemaless business databases: HR/recruiting boards (candidate PII), CRM/deal boards (financial), and IT/security trackers routinely live… |
| Fence Sensitive ServiceNow Tables | servicenow | ingress | soc2hipaapci-dssgdpr-ccpa | Fences off the most sensitive ServiceNow tables from two routes that reach them: |
| Fence Snowflake Sensitive Schemas by Data Domain | snowflake | ingress | soc2hipaapci-dssgdpr-ccpa | Fences customer-designated sensitive data domains inside a Snowflake warehouse by inspecting the SQL text the agent is about to run — not by tool name, which… |
| Fence Tableau Datasource Scope | tableau | ingress | soc2gdpr-ccpa | Tableau's MCP server is a warehouse proxy: query-datasource runs a VizQL Data Service (VDS) query and returns raw row-level data — PII, PHI, payroll,… |
| Fence Writes to Sensitive Asana Projects | asana | ingress | soc2gdpr-ccpa | Asana is routinely used for HR (hiring, performance, offboarding), legal, M&A, and incident work; those project bodies, comments, custom fields, and status… |
| Fence Zoom Agentic Search to Native Corpora | zoom | ingress | soc2gdpr-ccpa | Constrains Zoom's agentic-search tool ( search zoom) so it can only reach Zoom-native content. |
| Force Docusign Envelopes to Draft | docusign | ingress | Rewrites Docusign envelope-creation calls so the envelope is staged as a (status: "sent"). | |
| Force Internal Visibility on JSM Comments | jira | ingress | soc2atlassian | Keeps agent-drafted Jira Service Management (JSM) comments off the customer-facing portal by rewriting addCommentToJiraIssue calls to carry a restrictive… |
| Force ServiceNow Comments to Internal Work Notes | servicenow | ingress | soc2 | Keeps agent-drafted ServiceNow comments off the customer/employee-visible journal by rewriting add comment calls to internal work notes. |
| Freeze Destructive Airtable Deletes | airtable | ingress | soc2 | Denies every destructive Airtable tool call unless the caller's IdP token carries the placeholder group airtable-admins. |
| Freeze Destructive and Series-Wide Calendar Changes | google-calendar | ingress | soc2 | Denies irreversible Google Calendar mutations on the agent channel: |
| Freeze Destructive Asana Operations | asana | ingress | soc2 | Denies every destructive Asana tool call unless the caller's IdP token carries the placeholder group asana-admins. |
| Freeze Destructive Box Operations | box | ingress | soc2 | Freezes deletes and retention tampering on the community self-hosted Box MCP server (box-community/mcp-server-box). |
| Freeze Destructive Dropbox Operations | dropbox | ingress | soc2 | Freezes the irreversible and bulk-mutation Dropbox tools on the agent channel, regardless of path. At ingress it denies, by tool-name suffix: |
| Freeze Destructive Gmail Operations | gmail | ingress | soc2 | Denies the irreversible destruction surface that community Gmail MCP servers expose — permanent email deletion, label deletion, and filter deletion — for… |
| Freeze Destructive Google Drive Operations | google-drive | ingress | soc2 | Blocks Google Drive delete operations issued by agents. |
| Freeze Destructive Linear Operations | linear | ingress | soc2 | Denies destructive Linear tool calls — the delete , archive , and session-logout classes — unless the caller's IdP token carries the placeholder group… |
| Freeze Destructive Microsoft 365 Operations | ms365 | ingress | soxsoc2 | Denies every Microsoft 365 tool call whose verb segment is delete- or cancel- unless the caller's IdP token carries the placeholder group m365-admin. |
| Freeze Destructive monday Operations | monday | ingress | soc2 | Splits monday's destructive tool surface into two tiers and treats each differently at ingress, before the call ever reaches the monday MCP server: |
| Freeze Destructive QuickBooks Operations | quickbooks | ingress | soxsoc2 | Denies every destructive QuickBooks Online (QBO) tool call on the agent channel before it reaches the MCP server. |
| Freeze Destructive Tableau Content Ops | tableau | ingress | soc2 | Denies the irreversible content-mutation tools on the official tableau/tableau-mcp web server unless the caller's IdP token carries the placeholder group… |
| Freeze M365 Identity Plane | ms365 | ingress | soc2 | Freezes directory and membership mutations on the Microsoft 365 MCP surface. The policy denies, by tool-name suffix: |
| Freeze Notion Full-Page Content Overwrites | notion | ingress | soc2 | Denies notion-update-page calls whose command argument is replace content — the one edge on Notion's hosted MCP server that overwrites a page's entire body… |
| Freeze Payroll Writes in Gusto | gusto | ingress | Freezes every write and delete operation on a Gusto pipeline. | |
| Freeze Power BI RLS Role Edits | power-bi | ingress | soc2 | Freezes edits to row-level-security (RLS) roles on the Power BI MCP surface. |
| Freeze Salesforce Record Deletes | salesforce | ingress | soc2crm | Denies all Salesforce record-deletion capability on the agent channel unless the caller's IdP groups claim contains the placeholder group sf-admins. |
| Freeze ServiceNow Identity Plane | servicenow | ingress | soc2 | Freezes the identity-and-access mutation surface of the ServiceNow MCP server. The policy denies, by tool-name suffix: |
| Freeze Standing Automation & AI Agents in monday | monday | ingress | soc2 | Denies the monday tools that install side effects which outlive the governed MCP session. Two classes of tool are blocked: |
| Freeze the Zapier Toolset (No Self-Expansion) | zapier | ingress | soc2 | In its default agentic mode, Zapier MCP exposes meta-tools that let the agent widen its own blast radius mid-session : enable zapier action and auto… |
| Gate Google Drive Writes to an Authorized IdP Group | google-drive | ingress | soc2gdpr-ccpa | Baseline least-privilege policy for Google Drive MCP traffic. |
| Gate QuickBooks Money-Movement by Finance Group | quickbooks | ingress | soxpci-dss | Gates the QuickBooks Online money-movement creation tools — create payment, create bill payment, create refund receipt, create transfer, and create deposit —… |
| Gate Zoom Transcripts & Recordings by Group | zoom | ingress | hipaagdpr-ccpasoc2 | Gates retrieval of Zoom meeting transcripts, AI Companion summaries, and next-steps on the connector's core egress tools, enforcing minimum-necessary access: |
| GitHub: Redact Secrets from Read Responses | github | egress | soc2 | Scans the responses of GitHub's crown-jewel read tools and masks known credential shapes with a fixed [REDACTED-SECRET] marker before the text enters agent… |
| Glean Default-Deny Unknown Tools | glean | ingress | soc2 | Pins a per-tenant allowlist of the verified built-in read tools on the Glean managed remote MCP server and denies every other tool suffix on the Glean server… |
| Glean: Gate Memory Writes (Read-Only Default) | glean | ingress | soc2 | Gates mutating calls to Glean's long-term memory surface — the built-in tool exposed as memory (and as read memory in Glean's own client guide). |
| Glean: Redact PII from Read-Tool Responses | glean | egress | soc2hipaagdpr-ccpa | Scans the responses of Glean's content-returning read tools and rewrites high-confidence PII to fixed redaction tokens before the response reaches the… |
| Gmail Cap Bulk Export | gmail | ingress | soc2hipaagdpr-ccpa | Throttles mass-harvesting of a mailbox by capping the per-call blast radius of the two Gmail MCP surfaces that return many full email bodies at once: |
| Gmail: Role-Gated Writes (Read-Only Default) | gmail | ingress | soc2gdpr-ccpa | Makes Gmail read-only by default on the MCP path. Verified read tools pass for everyone. |
| Google Drive: Redact PII from File Content | google-drive | egress | soc2hipaagdpr-ccpa | Scans the responses of the content-returning Google Drive tools — file reads, downloads, and Docs/Sheets/Slides content fetches — and rewrites personally… |
| Guard Box Share Links and External Collaborations | box | ingress | soc2hipaagdpr-ccpa | Blocks the externally-visible Box sharing surface — the riskiest Box surface an agent can touch — before the call ever reaches Box: |
| Guard Calculation Expressions in Tableau VDS Queries | tableau | ingress | soc2 | Inspects the structured VizQL Data Service (VDS) query carried by Tableau's query-datasource tool and denies the call for callers outside the data-analysts… |
| Guard Databricks SQL Against Writes and DDL | databricks | ingress | soc2pci-dsssox | Inspects the SQL statement string that Databricks SQL-executing tools carry in their argument and denies any statement that performs a write, schema change,… |
| Guard DAX Whole-Table Dumps in Power BI | power-bi | ingress | soc2gdpr-ccpa | Power BI semantic models front the warehouse: a model imports or DirectQueries lakehouse/warehouse tables — finance, HR, customer PII. |
| Guard Docusign External Recipients | docusign | ingress | soc2gdpr-ccpa | Blocks Docusign envelope-creation and recipient-update tool calls when any recipient email address has a domain outside the configured counterparty allowlist. |
| Guard Drive ACL Reconnaissance | google-drive | ingress | soc2 | Denies Google Drive get file permissions tool calls unless the caller's IdP groups claim contains infosec. All other tool calls pass through unchanged. |
| Guard OneDrive/SharePoint Share Links | ms365 | ingress | soc2hipaagdpr-ccpa | Stops agents from opening OneDrive/SharePoint files to the whole internet. It guards the two Microsoft 365 sharing tools: |
| Guard Vendor Banking and Tax-ID Changes | quickbooks | ingress | sox | Blocks create vendor and update vendor calls whose arguments carry a vendor's payment coordinates — bank account number, routing / ACH branch details — or… |
| Gusto Cap Roster Export | gusto | ingress | gdpr-ccpasoc2 | Throttles full-roster exfiltration on Gusto's two broad outbound list tools — list company employees and list company contractors — by rewriting their… |
| Gusto: Redact Financial IDs in Responses | gusto | egress | soc2gdpr-ccpa | Instantiates PF-02 (redact-pii-egress) on the Gusto read path. |
| HubSpot Block Deal Closure | hubspot | ingress | crm | Blocks HubSpot CRM-object calls that move a deal into a closed stage (closedwon or closedlost). Both create and update requests are inspected. |
| HubSpot Cap Bulk Export | hubspot | ingress | crmsoc2hipaapci-dssgdpr-ccpa | Clamps the page size of HubSpot bulk-read tool calls before they reach the HubSpot MCP server, so a single agent request to a covered bulk-read tool can… |
| HubSpot Freeze Destructive Ops | hubspot | ingress | crmsoc2 | Blocks every archive/deletion-class HubSpot tool call, plus the consent-destroying contact unsubscribe, before it reaches the MCP server. |
| HubSpot Protect Associations | hubspot | ingress | crm | Blocks HubSpot CRM-object calls that create or change associations between objects (deal↔company, contact↔company, etc.). |
| HubSpot Protect Deal Owner | hubspot | ingress | crm | Blocks HubSpot CRM-object update calls that set or change a deal's owner. |
| HubSpot Protect Lifecycle Stage | hubspot | ingress | crm | Blocks HubSpot CRM-object calls that set or change a contact's lifecycle stage. |
| HubSpot Read-Only | hubspot | ingress | crmsoc2gdpr-ccpa | Makes the HubSpot connection read-only by blocking the write tool. |
| HubSpot Redact PII | hubspot | egress | crmsoc2hipaagdpr-ccpa | Redacts sensitive contact information from HubSpot tool responses before they reach the caller. |
| HubSpot Role-Gate Schema and Consent | hubspot | ingress | crmsoc2 | Sits one privilege tier above hubspot/role-gate-writes: ordinary crm-writers can create and edit CRM records, but two higher-blast-radius write classes are… |
| HubSpot Role-Gate Writes | hubspot | ingress | crmsoc2gdpr-ccpa | Gates every HubSpot write tool behind an IdP group: callers whose JWT groups claim contains crm-writers may create and update CRM records; everyone else gets… |
| Human-Only ServiceNow Change Approval | servicenow | ingress | soc2 | Unconditionally denies the ServiceNow change-management control-gate tools — the ones whose names end in approve change, reject change, or submit change for… |
| Human-Only Stripe Dispute Submission | stripe | ingress | sox | Strips the irreversible submit flag from Stripe update dispute tool calls. |
| Intercom: Keep Agent Help Center Articles in Draft | intercom | ingress | soc2 | Keeps agent-authored Intercom Help Center articles in draft so a human reviews them before they go live on the public Help Center. |
| Intercom: Mask Card Numbers in Conversation Responses | intercom | egress | soc2pci-dssgdpr-ccpa | Masks payment-card numbers (PANs) in Intercom conversation content returned to agents by the conversation- and free-text-returning read tools. |
| Intercom: Redact PII from Conversation & Contact Reads | intercom | egress | soc2hipaagdpr-ccpa | Scans the free-text returned by Intercom's conversation- and contact-read MCP tools and rewrites high-confidence personal identifiers and credential shapes… |
| JIRA: Block Change-History Actor Spoofing | jira | ingress | atlassiansoc2 | Blocks any official Jira write call — transitionJiraIssue, editJiraIssue, or createJiraIssue — that carries a historyMetadata block, before it reaches the… |
| JIRA: Cap Field and Result Exposure on Reads | jira | ingress | soc2gdpr-ccpaatlassian | Narrows the breadth of JIRA read requests before they run, on the two read surfaces that can pull large amounts of issue data into model context: |
| JIRA: Deny Sensitive Project Search and View | jira | ingress | atlassiansoc2gdpr-ccpa | Keeps issues that belong to a configurable set of "sensitive" JIRA projects out of read access through the JIRA MCP server. |
| JIRA: Freeze Destructive Issue Operations | jira | ingress | atlassiansoc2 | Freezes the three irreversible Jira operations on the agent channel: jira delete issue, jira remove issue link, and jira remove watcher. |
| JIRA: Protect Sensitive Projects from Writes | jira | ingress | atlassiansoc2gdpr-ccpa | Blocks write operations against issues that belong to a configurable set of "sensitive" JIRA projects. |
| JIRA: Redact Sensitive Information from Issue Views | jira | egress | atlassiansoc2gdpr-ccpa | Redacts sensitive content from the responses of JIRA issue-view tools before they reach the caller. |
| JIRA: Role-Gated Writes (Read-Only Default) | jira | ingress | atlassiansoc2gdpr-ccpa | Makes Jira read-only by default on the MCP path. |
| Linear: Redact Customer Revenue and Contacts | linear | egress | gdpr-ccpasoc2 | Masks commercial and contact identifiers in the responses of Linear's Customers read tools before they reach the agent. |
| Lock Direct Journal-Entry Ledger Writes | quickbooks | ingress | sox | Denies the QuickBooks Online tools create journal entry and update journal entry at ingress for every caller except those whose IdP claims include the… |
| Mask Card Numbers in Email Content Read by Agents | gmail | egress | soc2pci-dssgdpr-ccpa | Masks payment-card-number (PAN) shapes in email content returned to agents by Gmail mailbox-read tools. |
| Microsoft 365: Redact PII from Mail, Files & Transcripts | ms365 | egress | soc2hipaagdpr-ccpa | Scans the responses of the highest-density PII read surfaces in Microsoft 365 — mail bodies, Excel ranges, SharePoint list items, meeting transcripts, and… |
| monday: Redact PII in Board & Doc Reads | monday | egress | soc2gdpr-ccpa | Two egress controls in one policy, both scoped to the monday MCP read path: |
| NetSuite Cap SuiteQL Bulk Export | netsuite | ingress | soc2pci-dssgdpr-ccpa | Instantiates the PF-08 cap-bulk-export family as a transform-only ingress policy on ns runCustomSuiteQL — the NetSuite MCP tool that runs arbitrary read-only… |
| NetSuite Default-Deny Unknown MCP Tools | netsuite | ingress | soc2 | Pins an allowlist of the audited NetSuite MCP Standard Tools and denies every other tool call before it reaches the NetSuite AI Connector. |
| NetSuite Guard Vendor Banking Edits (Anti-BEC) | netsuite | ingress | sox | Instantiates policy family PF-10 (guard-vendor-banking) — the anti-BEC / payment-fraud control — for the Oracle NetSuite MCP Standard Tools SuiteApp. |
| NetSuite: Redact Financial PII in Responses | netsuite | egress | gdpr-ccpasoc2 | Instantiates PF-02 (redact-pii-egress) on the NetSuite read path. |
| Notion: Redact PII from Read Responses | notion | egress | soc2hipaagdpr-ccpa | Scans the responses of the Notion hosted MCP server's content-returning read tools and rewrites personally identifiable information to fixed redaction tokens… |
| Power BI: Redact PII in Query Results | power-bi | egress | soc2gdpr-ccpa | Scans the content returned by Power BI's result-returning tools and rewrites high-confidence PII shapes to fixed, non-recoverable redaction tokens before the… |
| Prevent Public Exposure of GitHub Repos, Gists & Forks | github | ingress | soc2 | Stops the agent from exposing private code to the public across three GitHub write tools, at ingress — before the call reaches the GitHub MCP server, so a… |
| Protect Financial Postings by Role | netsuite | ingress | sox | Denies the NetSuite record-write tools ns createRecord and ns updateRecord when they target a financial-transaction record type — journalentry (including the… |
| QuickBooks: Redact Employee & Vendor PII on Read | quickbooks | egress | gdpr-ccpasoc2 | On the read path, this policy masks sensitive identifiers in the responses of four QuickBooks Online (QBO) name-entity read tools — get employee, search… |
| Read-Only Baseline: Group-Gated Microsoft 365 Writes | ms365 | ingress | soc2gdpr-ccpasox | The least-privilege baseline for Microsoft 365 through the gateway: every tool call is allowed only if it is a read , or the caller's IdP token carries the… |
| Read-Only GitHub for Non-Engineers | github | ingress | soc2sox | Establishes the least-privilege baseline for the GitHub MCP connector on the agent channel. |
| Read-Only Stripe by Default (Role-Gate Billing Writes) | stripe | ingress | soc2pci-dsssoxgdpr-ccpa | Establishes a read-only-by-default Stripe posture over the MCP path. The named write and destructive billing tools — |
| Redact Attendee PII and Meeting Links in Calendar Reads | google-calendar | egress | soc2hipaagdpr-ccpa | Scrubs sensitive fields from the responses of Google Calendar read tools before they reach the agent, for callers who lack the placeholder calendar-full-read… |
| Redact Email PII | onboarding | egress | This policy automatically masks email addresses in what a tool sends back, replacing each one with [REDACTED] before your agent ever sees it. | |
| Require Human Approval: GitHub Merges & Approvals | github | ingress | soc2sox | Keeps a human in the loop on the two GitHub actions that consummate a code change: merging a pull request and approving one . |
| Role-Gate All Zapier Writes | zapier | ingress | soc2gdpr-ccpa | Zapier MCP is an aggregator: one connector proxies actions across 9,000+ apps, and every create/update/delete/send funnels through a small, predictable… |
| Role-Gate Dropbox Writes to the Writers Group | dropbox | ingress | soc2gdpr-ccpa | Establishes the per-app least-privilege write floor for Dropbox. |
| Salesforce Cap Bulk Data Export | salesforce | ingress | crmsoc2hipaapci-dssgdpr-ccpa | Blocks bulk PII extraction through Salesforce query tools by inspecting the free-text query arguments that are the real policy surface for these servers. |
| Salesforce Deny API Escape Hatches | salesforce | ingress | crmsoc2 | Unconditionally denies the raw-code and raw-API tools exposed by the community Salesforce MCP servers — tools that bypass every object- and argument-level… |
| Salesforce Guard Opportunity Pipeline Fields | salesforce | ingress | crm | Keeps revenue-pipeline moves human-approved. |
| Salesforce Protect Contact Fields | salesforce | ingress | crmsoc2gdpr-ccpa | Blocks Salesforce Contact updates that modify protected fields — ownership, account linkage, contact PII, name, and consent flags. |
| Salesforce Query Allowlist | salesforce | ingress | crmsoc2pci-dssgdpr-ccpa | Restricts Salesforce SOQL queries so only Account, Contact, and Opportunity records can be retrieved. |
| Salesforce Read-Only Access | salesforce | ingress | crmsoc2gdpr-ccpa | Restricts the Salesforce MCP server to read-only access. |
| Salesforce Redact PII | salesforce | egress | crmsoc2hipaagdpr-ccpa | Redacts personal contact information from Salesforce tool responses before they reach the caller. |
| Salesforce Role-Gated Writes | salesforce | ingress | crmsoc2gdpr-ccpa | The PF-12 least-privilege baseline for Salesforce. |
| Scrub Unapproved Stripe Payment-Link Redirects | stripe | ingress | soc2 | Scrubs the post-payment redirect from Stripe payment-link creation calls. |
| ServiceNow: Role-Gated Writes (Read-Only Default) | servicenow | ingress | soc2gdpr-ccpa | else fails closed |
| Slack Role-Gate Writes | slack | ingress | slackim-messagingsoc2gdpr-ccpa | Gates every Slack write-class tool behind an IdP group: callers whose JWT groups claim contains slack-writers may send and schedule messages, add or remove… |
| Slack: Block Agent Posts to External Channels | slack | ingress | slackim-messagingsoc2gdpr-ccpahipaa | Denies Slack message-write calls whose destination is an externally shared Slack Connect channel. |
| Slack: Deny Channel Creation | slack | ingress | slacksoc2 | Blocks Slack channel-creation tool calls at ingress. Every other Slack tool — and every non-Slack tool — passes through untouched. |
| Slack: Deny DM and Private-Conversation Reads and Search | slack | ingress | soc2gdpr-ccpa | Denies the agent read reach into Slack DMs and private conversations on the paths below — the workspace's highest concentration of PII/PHI (HR issues, health… |
| Slack: Deny Read/Search/Summarize of Sensitive Channels | slack | ingress | slacksoc2hipaagdpr-ccpa | Blocks read, search, and summarize operations that target a configurable set of "sensitive" Slack channels. |
| Slack: Deny Sending Direct Messages | slack | ingress | slacksoc2 | Blocks Slack message-write calls whose destination resolves to a direct conversation — a 1:1 DM, a message posted to a user ID (which Slack auto-opens as a… |
| Slack: Mask Card Numbers in Message and Search Responses | slack | egress | pci-dsssoc2gdpr-ccpa | Masks payment-card numbers (PANs) in Slack content returned to agents by message-read, thread-read, canvas-read, history, and search tools. |
| Slack: Redact Profile PII from User Lookups | slack | egress | slacksoc2gdpr-ccpa | Redacts personally identifiable information — email addresses, phone numbers, and Slack custom profile fields (which commonly carry phone, title, and… |
| Slack: Redact Sensitive Information from Messages | slack | ingress | slacksoc2hipaagdpr-ccpa | Redacts sensitive content from outgoing Slack message arguments before the call reaches Slack. |
| Snowflake Default-Deny Unknown Tools | snowflake | ingress | soc2 | Pins an allowlist of the exact Snowflake tool names your team audited and denies every other tool name on the Snowflake MCP server(s). |
| Snowflake Deny Composite & Generic Tools | snowflake | ingress | soc2 | Denies the opaque composite and generic passthrough tools on the Snowflake-managed MCP server whose execution the gateway cannot inspect one SQL statement at… |
| Snowflake: Redact PII from Query Result Sets | snowflake | egress | soc2hipaagdpr-ccpa | Scans the row content returned by the result-returning Snowflake MCP tools and rewrites personally identifiable information to fixed redaction tokens before… |
| Stripe Refund Group Gate and Amount Cap | stripe | ingress | pci-dsssox | Denies Stripe refund tool calls — money out, irreversible — unless the caller's IdP groups include finance or billing-admin. |
| Stripe: Redact Customer PII from Bulk Reads | stripe | egress | soc2gdpr-ccpa | Masks customer PII in the responses of Stripe's bulk PII egress channels before they reach the agent. |
| Tableau: Redact PII & Mask PANs in Query Results | tableau | egress | soc2gdpr-ccpa | Tableau is a warehouse proxy: the data-returning tools stream raw row-level content out of whatever the published datasource connects to — PII, PHI, payroll,… |
| Zapier: Mask Card Numbers in Read Responses | zapier | egress | soc2pci-dssgdpr-ccpa | Masks payment-card numbers (PANs) in Zapier MCP read responses before they reach the agent. |
| Zoom: Redact PII in Meeting Intelligence | zoom | egress | hipaagdpr-ccpasoc2 | Scans the responses of Zoom's meeting-intelligence read surfaces — AI summaries, verbatim transcripts, recording resources, and Zoom Docs content — and… |