Policies tagged "least-privilege"

box · ingress

Box: Role-Gated Writes (Read-Only Default)

Makes Box read-only by default on the MCP path.

box role-gate-writes access-control least-privilege ingress soc2 gdpr-ccpa

databricks · ingress

Databricks: Role-Gate Compute & Job Control

The community JustTryAI/databricks-mcp-server exposes cluster and job control — create cluster, start cluster, terminate cluster, run job, and export…

databricks role-gate-writes access-control least-privilege ingress soc2

google-drive · ingress

Gate Google Drive Writes to an Authorized IdP Group

Baseline least-privilege policy for Google Drive MCP traffic.

google-drive role-gate-writes least-privilege ingress soc2 gdpr-ccpa

glean · ingress

Glean: Gate Memory Writes (Read-Only Default)

Gates mutating calls to Glean's long-term memory surface — the built-in tool exposed as memory (and as read memory in Glean's own client guide).

glean gate-memory-writes role-gate-writes memory access-control least-privilege ingress soc2

gmail · ingress

Gmail: Role-Gated Writes (Read-Only Default)

Makes Gmail read-only by default on the MCP path. Verified read tools pass for everyone.

gmail role-gate-writes access-control least-privilege ingress soc2 gdpr-ccpa

hubspot · ingress

HubSpot Role-Gate Schema and Consent

Sits one privilege tier above hubspot/role-gate-writes: ordinary crm-writers can create and edit CRM records, but two higher-blast-radius write classes are…

hubspot role-gate-schema-consent access-control least-privilege segregation-of-duties consent ingress soc2

hubspot · ingress

HubSpot Role-Gate Writes

Gates every HubSpot write tool behind an IdP group: callers whose JWT groups claim contains crm-writers may create and update CRM records; everyone else gets…

hubspot role-gate-writes access-control least-privilege ingress soc2 gdpr-ccpa

jira · ingress

JIRA: Role-Gated Writes (Read-Only Default)

Makes Jira read-only by default on the MCP path.

jira atlassian role-gate-writes access-control least-privilege ingress soc2 gdpr-ccpa

ms365 · ingress

Read-Only Baseline: Group-Gated Microsoft 365 Writes

The least-privilege baseline for Microsoft 365 through the gateway: every tool call is allowed only if it is a read , or the caller's IdP token carries the…

ms365 role-gate-writes ingress least-privilege soc2 gdpr-ccpa sox

stripe · ingress

Read-Only Stripe by Default (Role-Gate Billing Writes)

Establishes a read-only-by-default Stripe posture over the MCP path. The named write and destructive billing tools —

stripe role-gate-writes ingress least-privilege rbac soc2 pci-dss sox gdpr-ccpa

dropbox · ingress

Role-Gate Dropbox Writes to the Writers Group

Establishes the per-app least-privilege write floor for Dropbox.

dropbox role-gate-writes rbac least-privilege ingress soc2 gdpr-ccpa

salesforce · ingress

Salesforce Role-Gated Writes

The PF-12 least-privilege baseline for Salesforce.

salesforce role-gate-writes access-control least-privilege ingress soc2 gdpr-ccpa crm

servicenow · ingress

ServiceNow: Role-Gated Writes (Read-Only Default)

else fails closed

servicenow role-gate-writes access-control least-privilege ingress soc2 gdpr-ccpa

slack · ingress

Slack Role-Gate Writes

Gates every Slack write-class tool behind an IdP group: callers whose JWT groups claim contains slack-writers may send and schedule messages, add or remove…

slack role-gate-writes access-control least-privilege ingress soc2 gdpr-ccpa