slack · ingress
Block Secrets in Slack Messages
Blocks Slack send-message tool calls whose message body looks like it contains a secret — API keys, passwords, tokens, or PEM-formatted private keys.
Policies tagged "iso27001-nist"
ms365 · ingress
Deny Graph API Batch Escape Hatch
Blocks the Microsoft 365 MCP server's raw-Graph passthrough tool (graph-batch, observed live as ms365-graph-batch).
ms365 · ingress
Freeze M365 Identity Plane
Freezes directory and membership mutations on the Microsoft 365 MCP surface. The policy denies, by tool-name suffix:
ms365freeze-identity-planeingressidentityentragroupsiso27001-nistsoc2
power-bi · ingress
Freeze Power BI RLS Role Edits
Freezes edits to row-level-security (RLS) roles on the Power BI MCP surface.
power-bifreeze-identity-planeingressrlsidentitygroupssoc2iso27001-nist
servicenow · ingress
Freeze ServiceNow Identity Plane
Freezes the identity-and-access mutation surface of the ServiceNow MCP server. The policy denies, by tool-name suffix:
servicenowfreeze-identity-planeingressidentitygroupssoc2iso27001-nist
ms365 · ingress
Guard OneDrive/SharePoint Share Links
Stops agents from opening OneDrive/SharePoint files to the whole internet. It guards the two Microsoft 365 sharing tools:
ms365share-linkssharingingresssoc2iso27001-nisthipaagdpr-ccpa
jira · ingress
JIRA: Deny Sensitive Project Search and View
Keeps issues that belong to a configurable set of "sensitive" JIRA projects out of read access through the JIRA MCP server.
jiraatlassianaccess-controldata-protectioningresssoc2gdpr-ccpaiso27001-nistfinserv-comms
jira · ingress
JIRA: Protect Sensitive Projects from Writes
Blocks write operations against issues that belong to a configurable set of "sensitive" JIRA projects.
jiraatlassianaccess-controldata-protectioningresssoc2gdpr-ccpaiso27001-nistfinserv-comms
salesforce · ingress
Salesforce Deny API Escape Hatches
Unconditionally denies the raw-code and raw-API tools exposed by the community Salesforce MCP servers — tools that bypass every object- and argument-level…
salesforcedeny-escape-hatchesaccess-controlingresssoc2iso27001-nist
salesforce · ingress
Salesforce Protect Contact Fields
Blocks Salesforce Contact updates that modify protected fields — ownership, account linkage, contact PII, name, and consent flags.
salesforcecontactspiiaccess-controlgovernanceingresssoc2gdpr-ccpaiso27001-nist
salesforce · ingress
Salesforce Query Allowlist
Restricts Salesforce SOQL queries so only Account, Contact, and Opportunity records can be retrieved.
salesforceaccess-controldata-protectiongovernanceingresssoc2pci-dssgdpr-ccpaiso27001-nist
salesforce · ingress
Salesforce Read-Only Access
Restricts the Salesforce MCP server to read-only access.
salesforceaccess-controlgovernanceread-onlyingresssoc2gdpr-ccpaiso27001-nist
salesforce · egress
Salesforce Redact PII
Redacts personal contact information from Salesforce tool responses before they reach the caller.
salesforcepiidlpredactionegresssoc2hipaagdpr-ccpaiso27001-nist
slack · ingress
Slack: Deny Channel Creation
Blocks Slack channel-creation tool calls at ingress. Every other Slack tool — and every non-Slack tool — passes through untouched.
slack · ingress
Slack: Deny Read/Search/Summarize of Sensitive Channels
Blocks read, search, and summarize operations that target a configurable set of "sensitive" Slack channels.
slackaccess-controldata-protectioningresssoc2hipaagdpr-ccpaiso27001-nist
slack · ingress
Slack: Deny Sending Direct Messages
Blocks Slack message-write calls whose destination resolves to a direct conversation — a 1:1 DM, a message posted to a user ID (which Slack auto-opens as a…
slackaccess-controlgovernanceingresssoc2iso27001-nistfinserv-comms
snowflake · ingress
Snowflake Deny Composite & Generic Tools
Denies the opaque composite and generic passthrough tools on the Snowflake-managed MCP server whose execution the gateway cannot inspect one SQL statement at…
snowflakedeny-escape-hatchesaccess-controlcortexingresssoc2iso27001-nist