gusto
5 Dtwo policies tagged "gusto", including Default-Deny Unknown Gusto Tools, Fence Gusto Compensation & Payroll Reads. Browse by what the control does rather than which app it targets.
Default-Deny Unknown Gusto ToolsPins an allowlist of the 36 official Gusto MCP tool names and allows a call only when lower(input.resource.name) is an exact member of that list.Fence Gusto Compensation & Payroll ReadsDenies the highest-sensitivity Gusto read tools unless the caller's IdP-asserted groups include the placeholder group hr-payroll-admins.Freeze Payroll Writes in GustoFreezes every write and delete operation on a Gusto pipeline.Gusto Cap Roster ExportThrottles full-roster exfiltration on Gusto's two broad outbound list tools — list company employees and list company contractors — by rewriting their…Gusto: Redact Financial IDs in ResponsesInstantiates PF-02 (redact-pii-egress) on the Gusto read path.