Sign in

CRM bundle

19 Dtwo policies across 2 apps that compose into a starting posture for CRM — attach the bundle to cover the surface, then tune.

On this page
  1. Included policies
  2. How bundle membership works
  3. What's intentionally not in the bundle
  4. Roadmap
  5. Included policies (19)
  6. HubSpot
  7. Salesforce

A curated bundle of policies for CRM MCP servers. The goal is a sensible default posture for any organization fronting a CRM through the DTwo gateway: keep high-impact CRM writes (like closing deals or reassigning records) under control and keep customer PII from leaking out, while leaving everyday CRM work unaffected. The bundle spans CRM apps — HubSpot and Salesforce today, with room for more under the same theme.

Included policies

Policy App Direction Purpose
block-deal-closure hubspot ingress Deny CRM-object calls that move a deal into a closed stage (closedwon / closedlost); all other deal changes and tools pass through.
protect-associations hubspot ingress Deny CRM-object calls that create or change object associations; all other calls pass through.
protect-deal-owner hubspot ingress Deny deal-update calls that set or change hubspot_owner_id; deal creates and other fields pass through.
protect-lifecycle-stage hubspot ingress Deny contact create/update calls that set or change lifecyclestage; all other calls pass through.
read-only hubspot ingress Block all HubSpot writes (the *-manage-crm-objects tool); read/search/list tools pass through.
redact-pii hubspot egress Redact contact PII (phone, email, fax, SSN) from HubSpot tool responses. Transform-only — never denies.
protect-contact-fields salesforce ingress Deny Salesforce Contact updates that modify protected fields (ownership, account linkage, PII, name, consent flags); other field updates and tools pass through.
query-allowlist salesforce ingress Restrict Salesforce SOQL queries to Account, Contact, and Opportunity objects; other tools pass through.
read-only salesforce ingress Allowlist Salesforce read tools and deny all writes (fail-closed); non-Salesforce tools pass through.
redact-pii salesforce egress Redact contact PII (email, phone, fax, mailing address, birthdate, SSN, card numbers) from Salesforce responses. Transform-only — never denies.

Policy bodies live under apps/. This page only links to them — see the top-level README for the rationale.

How bundle membership works

Bundle membership is declared in each policy's policy.md frontmatter (the policy lists bundles: ["crm"]). This page is a human-readable landing page; the generated manifest.json is the machine-readable source of truth. There is intentionally no separate bundle.json artifact — one source of metadata avoids drift.

The bundle's ingress policies are designed to compose cleanly on the same pipeline. block-deal-closure, protect-associations, protect-deal-owner, and protect-lifecycle-stage are each single-purpose deny policies (default allow := false, re-allowing everything except their own narrow concern — a deal-closing write, an association change, a deal-owner change, and a contact lifecycle-stage change respectively), so they never interfere with each other or with other CRM policies attached to the same direction.

read-only is the broad-strokes alternative: it blocks the entire *-manage-crm-objects write tool, which supersedes all four narrow deny policies above (they each gate a subset of the same tool). Pick read-only when you want a fully read-only connection, or the narrow policies when you want to allow most writes but block specific high-impact ones — combining both is redundant but harmless.

The two redact-pii policies (one for HubSpot, one for Salesforce) are the bundle's egress members — they attach to the egress (response) pipeline rather than ingress, are transform-only (default allow := true), and are orthogonal to the ingress write controls above, so they compose cleanly alongside any of them. Each is scoped to its own app, so they don't interfere with each other.

What's intentionally not in the bundle

  • Pipeline / stage allow-deny lists. Custom pipeline and stage internal names are tenant-specific (your dealstage values aren't ours) and belong in your private policy repo.
  • Identity-scoped gates. IdP claims (org_id, groups, etc.) vary by deployment. Add these as separate policies in your gateway.

Roadmap

  • Equivalents for other CRM MCP servers (e.g. Salesforce) under the same bundle.
  • Additional field-protection and read-only policies as they stabilize in the catalog.

Included policies (19)

HubSpot

HubSpot Block Deal Closureingress · HubSpotBlocks HubSpot CRM-object calls that move a deal into a closed stage (closedwon or closedlost). Both create and update requests are inspected.HubSpot Cap Bulk Exportingress · HubSpotClamps the page size of HubSpot bulk-read tool calls before they reach the HubSpot MCP server, so a single agent request to a covered bulk-read tool can…HubSpot Freeze Destructive Opsingress · HubSpotBlocks every archive/deletion-class HubSpot tool call, plus the consent-destroying contact unsubscribe, before it reaches the MCP server.HubSpot Protect Associationsingress · HubSpotBlocks HubSpot CRM-object calls that create or change associations between objects (deal↔company, contact↔company, etc.).HubSpot Protect Deal Owneringress · HubSpotBlocks HubSpot CRM-object update calls that set or change a deal's owner.HubSpot Protect Lifecycle Stageingress · HubSpotBlocks HubSpot CRM-object calls that set or change a contact's lifecycle stage.HubSpot Read-Onlyingress · HubSpotMakes the HubSpot connection read-only by blocking the write tool.HubSpot Redact PIIegress · HubSpotRedacts sensitive contact information from HubSpot tool responses before they reach the caller.HubSpot Role-Gate Schema and Consentingress · HubSpotSits one privilege tier above hubspot/role-gate-writes: ordinary crm-writers can create and edit CRM records, but two higher-blast-radius write classes are…HubSpot Role-Gate Writesingress · HubSpotGates every HubSpot write tool behind an IdP group: callers whose JWT groups claim contains crm-writers may create and update CRM records; everyone else gets…

Salesforce

Freeze Salesforce Record Deletesingress · SalesforceDenies all Salesforce record-deletion capability on the agent channel unless the caller's IdP groups claim contains the placeholder group sf-admins.Salesforce Cap Bulk Data Exportingress · SalesforceBlocks bulk PII extraction through Salesforce query tools by inspecting the free-text query arguments that are the real policy surface for these servers.Salesforce Deny API Escape Hatchesingress · SalesforceUnconditionally denies the raw-code and raw-API tools exposed by the community Salesforce MCP servers — tools that bypass every object- and argument-level…Salesforce Guard Opportunity Pipeline Fieldsingress · SalesforceKeeps revenue-pipeline moves human-approved.Salesforce Protect Contact Fieldsingress · SalesforceBlocks Salesforce Contact updates that modify protected fields — ownership, account linkage, contact PII, name, and consent flags.Salesforce Query Allowlistingress · SalesforceRestricts Salesforce SOQL queries so only Account, Contact, and Opportunity records can be retrieved.Salesforce Read-Only Accessingress · SalesforceRestricts the Salesforce MCP server to read-only access.Salesforce Redact PIIegress · SalesforceRedacts personal contact information from Salesforce tool responses before they reach the caller.Salesforce Role-Gated Writesingress · SalesforceThe PF-12 least-privilege baseline for Salesforce.
Updated

↑↓ to navigate ↵ to open