Denies, by default, the Dropbox tools that turn an internal file into an internet-visible resource in a single call — before the request ever reaches Dropbox:
dropboxguard-share-linkssharingexternal-sharingingresssoc2hipaagdpr-ccpa
Scans the responses of the Dropbox file-content read tools and sanitises the returned text before it reaches the agent.
dropboxredact-contentredact-piimask-pansecretspiidlpegresssoc2hipaagdpr-ccpa
Fences protected Dropbox subtrees by path prefix . Dropbox addresses files and folders by a root-relative path (/Finance/2026/payroll.
Freezes the irreversible and bulk-mutation Dropbox tools on the agent channel, regardless of path. At ingress it denies, by tool-name suffix:
Establishes the per-app least-privilege write floor for Dropbox.
dropboxrole-gate-writesrbacleast-privilegeingresssoc2gdpr-ccpa