Sign in

least-privilege

14 Dtwo policies tagged "least-privilege", including Box: Role-Gated Writes (Read-Only Default), Databricks: Role-Gate Compute & Job Control. Browse by what the control does rather than which app it targets.

On this page
  1. Box
  2. Databricks
  3. Dropbox
  4. Glean
  5. Gmail
  6. Google Drive
  7. HubSpot
  8. Jira
  9. Microsoft 365
  10. Salesforce
  11. ServiceNow
  12. Slack
  13. Stripe

Box

Box: Role-Gated Writes (Read-Only Default)ingress · BoxMakes Box read-only by default on the MCP path.

Databricks

Databricks: Role-Gate Compute & Job Controlingress · DatabricksThe community JustTryAI/databricks-mcp-server exposes cluster and job control — create cluster, start cluster, terminate cluster, run job, and export…

Dropbox

Role-Gate Dropbox Writes to the Writers Groupingress · DropboxEstablishes the per-app least-privilege write floor for Dropbox.

Glean

Glean: Gate Memory Writes (Read-Only Default)ingress · GleanGates mutating calls to Glean's long-term memory surface — the built-in tool exposed as memory (and as read memory in Glean's own client guide).

Gmail

Gmail: Role-Gated Writes (Read-Only Default)ingress · GmailMakes Gmail read-only by default on the MCP path. Verified read tools pass for everyone.

Google Drive

Gate Google Drive Writes to an Authorized IdP Groupingress · Google DriveBaseline least-privilege policy for Google Drive MCP traffic.

HubSpot

HubSpot Role-Gate Schema and Consentingress · HubSpotSits one privilege tier above hubspot/role-gate-writes: ordinary crm-writers can create and edit CRM records, but two higher-blast-radius write classes are…HubSpot Role-Gate Writesingress · HubSpotGates every HubSpot write tool behind an IdP group: callers whose JWT groups claim contains crm-writers may create and update CRM records; everyone else gets…

Jira

JIRA: Role-Gated Writes (Read-Only Default)ingress · JiraMakes Jira read-only by default on the MCP path.

Microsoft 365

Read-Only Baseline: Group-Gated Microsoft 365 Writesingress · Microsoft 365The least-privilege baseline for Microsoft 365 through the gateway: every tool call is allowed only if it is a read , or the caller's IdP token carries the…

Salesforce

Salesforce Role-Gated Writesingress · SalesforceThe PF-12 least-privilege baseline for Salesforce.

ServiceNow

ServiceNow: Role-Gated Writes (Read-Only Default)ingress · ServiceNowelse fails closed

Slack

Slack Role-Gate Writesingress · SlackGates every Slack write-class tool behind an IdP group: callers whose JWT groups claim contains slack-writers may send and schedule messages, add or remove…

Stripe

Read-Only Stripe by Default (Role-Gate Billing Writes)ingress · StripeEstablishes a read-only-by-default Stripe posture over the MCP path. The named write and destructive billing tools —

↑↓ to navigate ↵ to open