All policies

Every policy in the store — 195 of them — grouped by the app it protects. Open one for the Rego, the import path, and the bundles it belongs to.

Policies run on the Dtwo MCP Gateway on every tool call. Ingress policies inspect the request before it reaches the app and can deny it or rewrite it; egress policies inspect the response on the way back and can redact it. Each one is single-purpose and composes with the others on the same pipeline.

Salesforce

Freeze Salesforce Record Deletesingress · SalesforceDenies all Salesforce record-deletion capability on the agent channel unless the caller's IdP groups claim contains the placeholder group sf-admins.Salesforce Cap Bulk Data Exportingress · SalesforceBlocks bulk PII extraction through Salesforce query tools by inspecting the free-text query arguments that are the real policy surface for these servers.Salesforce Deny API Escape Hatchesingress · SalesforceUnconditionally denies the raw-code and raw-API tools exposed by the community Salesforce MCP servers — tools that bypass every object- and argument-level…Salesforce Guard Opportunity Pipeline Fieldsingress · SalesforceKeeps revenue-pipeline moves human-approved.Salesforce Protect Contact Fieldsingress · SalesforceBlocks Salesforce Contact updates that modify protected fields — ownership, account linkage, contact PII, name, and consent flags.Salesforce Query Allowlistingress · SalesforceRestricts Salesforce SOQL queries so only Account, Contact, and Opportunity records can be retrieved.Salesforce Read-Only Accessingress · SalesforceRestricts the Salesforce MCP server to read-only access.Salesforce Redact PIIegress · SalesforceRedacts personal contact information from Salesforce tool responses before they reach the caller.Salesforce Role-Gated Writesingress · SalesforceThe PF-12 least-privilege baseline for Salesforce.

HubSpot

HubSpot Block Deal Closureingress · HubSpotBlocks HubSpot CRM-object calls that move a deal into a closed stage (closedwon or closedlost). Both create and update requests are inspected.HubSpot Cap Bulk Exportingress · HubSpotClamps the page size of HubSpot bulk-read tool calls before they reach the HubSpot MCP server, so a single agent request to a covered bulk-read tool can…HubSpot Freeze Destructive Opsingress · HubSpotBlocks every archive/deletion-class HubSpot tool call, plus the consent-destroying contact unsubscribe, before it reaches the MCP server.HubSpot Protect Associationsingress · HubSpotBlocks HubSpot CRM-object calls that create or change associations between objects (deal↔company, contact↔company, etc.).HubSpot Protect Deal Owneringress · HubSpotBlocks HubSpot CRM-object update calls that set or change a deal's owner.HubSpot Protect Lifecycle Stageingress · HubSpotBlocks HubSpot CRM-object calls that set or change a contact's lifecycle stage.HubSpot Read-Onlyingress · HubSpotMakes the HubSpot connection read-only by blocking the write tool.HubSpot Redact PIIegress · HubSpotRedacts sensitive contact information from HubSpot tool responses before they reach the caller.HubSpot Role-Gate Schema and Consentingress · HubSpotSits one privilege tier above hubspot/role-gate-writes: ordinary crm-writers can create and edit CRM records, but two higher-blast-radius write classes are…HubSpot Role-Gate Writesingress · HubSpotGates every HubSpot write tool behind an IdP group: callers whose JWT groups claim contains crm-writers may create and update CRM records; everyone else gets…

Stripe

Deny Stripe API-Write Escape Hatchingress · StripeDenies the stripe api write meta-tool — the single raw passthrough on the official Stripe MCP server that can execute any Stripe POST, PATCH, PUT, or DELETE…Human-Only Stripe Dispute Submissioningress · StripeStrips the irreversible submit flag from Stripe update dispute tool calls.Read-Only Stripe by Default (Role-Gate Billing Writes)ingress · StripeEstablishes a read-only-by-default Stripe posture over the MCP path. The named write and destructive billing tools —Scrub Unapproved Stripe Payment-Link Redirectsingress · StripeScrubs the post-payment redirect from Stripe payment-link creation calls.Stripe Refund Group Gate and Amount Capingress · StripeDenies Stripe refund tool calls — money out, irreversible — unless the caller's IdP groups include finance or billing-admin.Stripe: Redact Customer PII from Bulk Readsegress · StripeMasks customer PII in the responses of Stripe's bulk PII egress channels before they reach the agent.

DocuSign

Block Irreversible Docusign Void and Workflow Killsingress · DocuSignDenies the irreversible destructive operations on the Docusign agent path:Cap Docusign Directory and Document Egressegress · DocuSignBounds the two largest data-out channels in the Docusign MCP landscape:Docusign: Redact SSN, Bank & Card Values on Egressegress · DocuSignScans the responses of Docusign envelope- and agreement-reading tools and rewrites high-confidence regulated identifiers before the response reaches the…Force Docusign Envelopes to Draftingress · DocuSignRewrites Docusign envelope-creation calls so the envelope is staged as a (status: "sent").Guard Docusign External Recipientsingress · DocuSignBlocks Docusign envelope-creation and recipient-update tool calls when any recipient email address has a domain outside the configured counterparty allowlist.

Gusto

Default-Deny Unknown Gusto Toolsingress · GustoPins an allowlist of the 36 official Gusto MCP tool names and allows a call only when lower(input.resource.name) is an exact member of that list.Fence Gusto Compensation & Payroll Readsingress · GustoDenies the highest-sensitivity Gusto read tools unless the caller's IdP-asserted groups include the placeholder group hr-payroll-admins.Freeze Payroll Writes in Gustoingress · GustoFreezes every write and delete operation on a Gusto pipeline.Gusto Cap Roster Exportingress · GustoThrottles full-roster exfiltration on Gusto's two broad outbound list tools — list company employees and list company contractors — by rewriting their…Gusto: Redact Financial IDs in Responsesegress · GustoInstantiates PF-02 (redact-pii-egress) on the Gusto read path.

QuickBooks

Cap QuickBooks Bulk Search Exportsingress · QuickBooksClamps the bulk-read levers on every QuickBooks Online search tool so an agent cannot pull the entire general ledger — or a full customer, vendor, or…Freeze Destructive QuickBooks Operationsingress · QuickBooksDenies every destructive QuickBooks Online (QBO) tool call on the agent channel before it reaches the MCP server.Gate QuickBooks Money-Movement by Finance Groupingress · QuickBooksGates the QuickBooks Online money-movement creation tools — create payment, create bill payment, create refund receipt, create transfer, and create deposit —…Guard Vendor Banking and Tax-ID Changesingress · QuickBooksBlocks create vendor and update vendor calls whose arguments carry a vendor's payment coordinates — bank account number, routing / ACH branch details — or…Lock Direct Journal-Entry Ledger Writesingress · QuickBooksDenies the QuickBooks Online tools create journal entry and update journal entry at ingress for every caller except those whose IdP claims include the…QuickBooks: Redact Employee & Vendor PII on Readegress · QuickBooksOn the read path, this policy masks sensitive identifiers in the responses of four QuickBooks Online (QBO) name-entity read tools — get employee, search…

NetSuite

Fence NetSuite HR & Payroll SuiteQL Queriesingress · NetSuiteFences the single biggest exfiltration surface on the NetSuite MCP server — ns runCustomSuiteQL, which runs arbitrary read-only SuiteQL across the entire ERP.NetSuite Cap SuiteQL Bulk Exportingress · NetSuiteInstantiates the PF-08 cap-bulk-export family as a transform-only ingress policy on ns runCustomSuiteQL — the NetSuite MCP tool that runs arbitrary read-only…NetSuite Default-Deny Unknown MCP Toolsingress · NetSuitePins an allowlist of the audited NetSuite MCP Standard Tools and denies every other tool call before it reaches the NetSuite AI Connector.NetSuite Guard Vendor Banking Edits (Anti-BEC)ingress · NetSuiteInstantiates policy family PF-10 (guard-vendor-banking) — the anti-BEC / payment-fraud control — for the Oracle NetSuite MCP Standard Tools SuiteApp.NetSuite: Redact Financial PII in Responsesegress · NetSuiteInstantiates PF-02 (redact-pii-egress) on the NetSuite read path.Protect Financial Postings by Roleingress · NetSuiteDenies the NetSuite record-write tools ns createRecord and ns updateRecord when they target a financial-transaction record type — journalentry (including the…

Jira

Force Internal Visibility on JSM Commentsingress · JiraKeeps agent-drafted Jira Service Management (JSM) comments off the customer-facing portal by rewriting addCommentToJiraIssue calls to carry a restrictive…JIRA: Block Change-History Actor Spoofingingress · JiraBlocks any official Jira write call — transitionJiraIssue, editJiraIssue, or createJiraIssue — that carries a historyMetadata block, before it reaches the…JIRA: Cap Field and Result Exposure on Readsingress · JiraNarrows the breadth of JIRA read requests before they run, on the two read surfaces that can pull large amounts of issue data into model context:JIRA: Deny Sensitive Project Search and Viewingress · JiraKeeps issues that belong to a configurable set of "sensitive" JIRA projects out of read access through the JIRA MCP server.JIRA: Freeze Destructive Issue Operationsingress · JiraFreezes the three irreversible Jira operations on the agent channel: jira delete issue, jira remove issue link, and jira remove watcher.JIRA: Protect Sensitive Projects from Writesingress · JiraBlocks write operations against issues that belong to a configurable set of "sensitive" JIRA projects.JIRA: Redact Sensitive Information from Issue Viewsegress · JiraRedacts sensitive content from the responses of JIRA issue-view tools before they reach the caller.JIRA: Role-Gated Writes (Read-Only Default)ingress · JiraMakes Jira read-only by default on the MCP path.

Confluence

Block Secrets in Confluence Pages and Commentsingress · ConfluenceBlocks Confluence write calls whose body looks like it contains a live credential — an API key, password, token, or PEM-formatted private key — before the…Confluence: Deny Org-Wide & Public Publicationingress · ConfluenceStops a prompt-injected or erring agent from broadcasting Confluence content org-wide or to anonymous external readers.Confluence: Freeze Page & Attachment Deletioningress · ConfluenceFreezes the two irreversible Confluence deletion tools on the agent channel: confluence delete page and confluence delete attachment.Confluence: Redact PII from Page & Comment Responsesegress · ConfluenceScans the responses of Confluence page, comment, and search read tools and rewrites personally identifiable information to fixed redaction tokens before the…Fence Confluence Reads & Search to Non-Restricted Spacesingress · ConfluenceFences a configurable set of restricted Confluence spaces (placeholder keys: HR, LEGAL, SEC) out of the agent's read and search paths unless the caller's IdP…

GitHub

Block Secrets in GitHub Commits & PRsingress · GitHubBlocks GitHub write tool calls whose payload looks like it carries a live credential into a repository, gist, pull request, or comment.Fence GitHub Access to the Company Org Allowlistingress · GitHubDenies any GitHub tool call whose arguments.owner (read from input.payload.args.GitHub: Redact Secrets from Read Responsesegress · GitHubScans the responses of GitHub's crown-jewel read tools and masks known credential shapes with a fixed [REDACTED-SECRET] marker before the text enters agent…Prevent Public Exposure of GitHub Repos, Gists & Forksingress · GitHubStops the agent from exposing private code to the public across three GitHub write tools, at ingress — before the call reaches the GitHub MCP server, so a…Read-Only GitHub for Non-Engineersingress · GitHubEstablishes the least-privilege baseline for the GitHub MCP connector on the agent channel.Require Human Approval: GitHub Merges & Approvalsingress · GitHubKeeps a human in the loop on the two GitHub actions that consummate a code change: merging a pull request and approving one .

Linear

Block Linear Webhook Creationingress · LinearUnconditionally denies any Linear tool that creates, updates, or deletes a webhook — linear createWebhook, linear deleteWebhook, and update variants.Default-Deny Unknown Linear Toolsingress · LinearPins an audited allowlist of the verified official Linear MCP tool names and allows a call only when the incoming tool name matches an allowlisted name on…Fence Roadmap and Initiative Reads (Egress)egress · LinearFences the responses of Linear's roadmap, initiative, and strategy read tools.Freeze Destructive Linear Operationsingress · LinearDenies destructive Linear tool calls — the delete , archive , and session-logout classes — unless the caller's IdP token carries the placeholder group…Linear: Redact Customer Revenue and Contactsegress · LinearMasks commercial and contact identifiers in the responses of Linear's Customers read tools before they reach the agent.

Monday.com

Default-Deny Unknown monday Toolsingress · Monday.comMaintains a per-tenant allowlist of audited monday tool-name suffixes and denies any call whose tool name does not end with an allowlisted entry.Fence Sensitive monday Boards by IdP Groupingress · Monday.commonday boards are schemaless business databases: HR/recruiting boards (candidate PII), CRM/deal boards (financial), and IT/security trackers routinely live…Freeze Destructive monday Operationsingress · Monday.comSplits monday's destructive tool surface into two tiers and treats each differently at ingress, before the call ever reaches the monday MCP server:Freeze Standing Automation & AI Agents in mondayingress · Monday.comDenies the monday tools that install side effects which outlive the governed MCP session. Two classes of tool are blocked:monday: Redact PII in Board & Doc Readsegress · Monday.comTwo egress controls in one policy, both scoped to the monday MCP read path:

Asana

Asana: Redact PII in Task & Comment Readsegress · AsanaOn the Asana MCP read path, this transform scans the free-text business fields that ride back in task, comment/story, and status-update responses — notes,…Cap Asana Batch Task Mutationsingress · AsanaCaps the blast radius of Asana's official V2 batch write tools. At ingress it:Fence Writes to Sensitive Asana Projectsingress · AsanaAsana is routinely used for HR (hiring, performance, offboarding), legal, M&A, and incident work; those project bodies, comments, custom fields, and status…Freeze Destructive Asana Operationsingress · AsanaDenies every destructive Asana tool call unless the caller's IdP token carries the placeholder group asana-admins.

Slack

Block Secrets in Slack Messagesingress · SlackBlocks Slack send-message tool calls whose message body looks like it contains a secret — API keys, passwords, tokens, or PEM-formatted private keys.Slack Role-Gate Writesingress · SlackGates every Slack write-class tool behind an IdP group: callers whose JWT groups claim contains slack-writers may send and schedule messages, add or remove…Slack: Block Agent Posts to External Channelsingress · SlackDenies Slack message-write calls whose destination is an externally shared Slack Connect channel.Slack: Deny Channel Creationingress · SlackBlocks Slack channel-creation tool calls at ingress. Every other Slack tool — and every non-Slack tool — passes through untouched.Slack: Deny DM and Private-Conversation Reads and Searchingress · SlackDenies the agent read reach into Slack DMs and private conversations on the paths below — the workspace's highest concentration of PII/PHI (HR issues, health…Slack: Deny Read/Search/Summarize of Sensitive Channelsingress · SlackBlocks read, search, and summarize operations that target a configurable set of "sensitive" Slack channels.Slack: Deny Sending Direct Messagesingress · SlackBlocks Slack message-write calls whose destination resolves to a direct conversation — a 1:1 DM, a message posted to a user ID (which Slack auto-opens as a…Slack: Mask Card Numbers in Message and Search Responsesegress · SlackMasks payment-card numbers (PANs) in Slack content returned to agents by message-read, thread-read, canvas-read, history, and search tools.Slack: Redact Profile PII from User Lookupsegress · SlackRedacts personally identifiable information — email addresses, phone numbers, and Slack custom profile fields (which commonly carry phone, title, and…Slack: Redact Sensitive Information from Messagesingress · SlackRedacts sensitive content from outgoing Slack message arguments before the call reaches Slack.

Gmail

Block Gmail Filter Creation (Auto-Forward Persistence)ingress · GmailBlocks the classic BEC/exfiltration persistence primitive: Gmail filters that can auto-forward or auto-delete mail and outlive the agent session.Deny Agent Email Sends to External Recipientsingress · GmailDenies Gmail send-class tool calls when any recipient in to, cc, or bcc falls outside a documented corporate-domain allowlist.Filter Dormant Conversations Out of Gmail Readsegress · Gmailgoverned responses)Freeze Destructive Gmail Operationsingress · GmailDenies the irreversible destruction surface that community Gmail MCP servers expose — permanent email deletion, label deletion, and filter deletion — for…Gmail Cap Bulk Exportingress · GmailThrottles mass-harvesting of a mailbox by capping the per-call blast radius of the two Gmail MCP surfaces that return many full email bodies at once:Gmail: Role-Gated Writes (Read-Only Default)ingress · GmailMakes Gmail read-only by default on the MCP path. Verified read tools pass for everyone.Hide Threads Carrying a Restricted Gmail Labelegress · Gmailgoverned responses)Mask Card Numbers in Email Content Read by Agentsegress · GmailMasks payment-card-number (PAN) shapes in email content returned to agents by Gmail mailbox-read tools.Restrict Gmail Thread Searches to Recent Mailingress · GmailRewrites every Gmail thread search on the way in to prepend a newer than: recency term, so Gmail itself returns only recent correspondence.Strip Blocked Senders from Gmail Readsegress · Gmailgoverned responses)

Google Calendar

Block Calendar Invites to External Attendeesingress · Google CalendarDenies Google Calendar event-write tool calls — create event / create-event, update event / update-event, and the consolidated manage event — whenever any…Block Public Visibility & Guest Delegationingress · Google CalendarBlocks Google Calendar create and update event calls that would expose the event to the world or hand control of it to guests.Freeze Destructive and Series-Wide Calendar Changesingress · Google CalendarDenies irreversible Google Calendar mutations on the agent channel:Redact Attendee PII and Meeting Links in Calendar Readsegress · Google CalendarScrubs sensitive fields from the responses of Google Calendar read tools before they reach the agent, for callers who lack the placeholder calendar-full-read…

Google Drive

Cap Google Drive Search & Listing Page Sizesingress · Google DriveClamps the page size of Google Drive search and listing calls to a documented cap (25 results per call).Exclude Personal Drives from Agent Readsegress · Google Drivemetadata lookups and unparseable governed responses)Fence Restricted Google Drive Files and Foldersingress · Google DriveFences an admin-maintained denylist of restricted Google Drive file and folder IDs — HR records, M&A deal rooms, board packs, payroll — off the agent channel:Freeze Destructive Google Drive Operationsingress · Google DriveBlocks Google Drive delete operations issued by agents.Gate Google Drive Writes to an Authorized IdP Groupingress · Google DriveBaseline least-privilege policy for Google Drive MCP traffic.Google Drive: Redact PII from File Contentegress · Google DriveScans the responses of the content-returning Google Drive tools — file reads, downloads, and Docs/Sheets/Slides content fetches — and rewrites personally…Guard Drive ACL Reconnaissanceingress · Google DriveDenies Google Drive get file permissions tool calls unless the caller's IdP groups claim contains infosec. All other tool calls pass through unchanged.

Microsoft 365

Block Agent Email to External Recipientsingress · Microsoft 365Blocks agent-initiated Microsoft 365 email sends when any recipient address falls outside a corporate-domain allowlist.Block Mail-Rule and Webhook Persistenceingress · Microsoft 365Unconditionally denies the classic business-email-compromise (BEC) persistence surface in Microsoft 365: creating or updating Outlook mail rules, changing…Deny Graph API Batch Escape Hatchingress · Microsoft 365Blocks the Microsoft 365 MCP server's raw-Graph passthrough tool (graph-batch, observed live as ms365-graph-batch).Freeze Destructive Microsoft 365 Operationsingress · Microsoft 365Denies every Microsoft 365 tool call whose verb segment is delete- or cancel- unless the caller's IdP token carries the placeholder group m365-admin.Freeze M365 Identity Planeingress · Microsoft 365Freezes directory and membership mutations on the Microsoft 365 MCP surface. The policy denies, by tool-name suffix:Guard OneDrive/SharePoint Share Linksingress · Microsoft 365Stops agents from opening OneDrive/SharePoint files to the whole internet. It guards the two Microsoft 365 sharing tools:Microsoft 365: Redact PII from Mail, Files & Transcriptsegress · Microsoft 365Scans the responses of the highest-density PII read surfaces in Microsoft 365 — mail bodies, Excel ranges, SharePoint list items, meeting transcripts, and…Read-Only Baseline: Group-Gated Microsoft 365 Writesingress · Microsoft 365The least-privilege baseline for Microsoft 365 through the gateway: every tool call is allowed only if it is a read , or the caller's IdP token carries the…

Zoom

Block External Team Chat Invites & Membersingress · ZoomStops a Zoom Team Chat agent from pulling external parties into the organization's chat surface.Block Secrets in Zoom Team Chatingress · ZoomBlocks Zoom Team Chat send/update tool calls whose message content looks like it contains a live secret — API keys, passwords, bearer tokens, or…Fence Zoom Agentic Search to Native Corporaingress · ZoomConstrains Zoom's agentic-search tool ( search zoom) so it can only reach Zoom-native content.Gate Zoom Transcripts & Recordings by Groupingress · ZoomGates retrieval of Zoom meeting transcripts, AI Companion summaries, and next-steps on the connector's core egress tools, enforcing minimum-necessary access:Zoom: Redact PII in Meeting Intelligenceegress · ZoomScans the responses of Zoom's meeting-intelligence read surfaces — AI summaries, verbatim transcripts, recording resources, and Zoom Docs content — and…

Airtable

Airtable: Redact PII in Record Readsegress · AirtableScans the responses of the Airtable record-read tools — the calls that return row fields values — and rewrites high-confidence PII shapes to a fixed…Clamp Bulk Airtable Record Readsingress · AirtableAirtable bases routinely hold CRM contacts, applicant-tracking pipelines, customer/financial trackers, and — on HIPAA-eligible Enterprise plans — health-ops…Confine Airtable Agent to Allowlisted Basesingress · AirtableAn Airtable OAuth grant (or Personal Access Token) with the workspacesAndBases:read scope spans the entire workspace — every base the connected identity can…Default-Deny Unaudited Airtable Toolsingress · AirtableMaintains a per-tenant allowlist of audited Airtable tool-name suffixes and denies any call whose tool name does not end with an allowlisted entry.Freeze Destructive Airtable Deletesingress · AirtableDenies every destructive Airtable tool call unless the caller's IdP token carries the placeholder group airtable-admins.

Box

Box: Redact PII from File Content on Egressegress · BoxScans the responses of Box content-returning tools and rewrites personally identifiable information to fixed redaction tokens before the response reaches the…Box: Role-Gated Writes (Read-Only Default)ingress · BoxMakes Box read-only by default on the MCP path.Fence Sensitive Box Folders by IdP Groupingress · BoxFences pinned sensitive Box subtrees (HR, Finance, Legal, …) by ID.Freeze Destructive Box Operationsingress · BoxFreezes deletes and retention tampering on the community self-hosted Box MCP server (box-community/mcp-server-box).Guard Box Share Links and External Collaborationsingress · BoxBlocks the externally-visible Box sharing surface — the riskiest Box surface an agent can touch — before the call ever reaches Box:

Dropbox

Block Public Dropbox Share, Download, and File-Request Linksingress · DropboxDenies, by default, the Dropbox tools that turn an internal file into an internet-visible resource in a single call — before the request ever reaches Dropbox:Dropbox: Redact PII, PANs, and Secrets in File Contentegress · DropboxScans the responses of the Dropbox file-content read tools and sanitises the returned text before it reaches the agent.Fence Sensitive Dropbox Paths by Teamingress · DropboxFences protected Dropbox subtrees by path prefix . Dropbox addresses files and folders by a root-relative path (/Finance/2026/payroll.Freeze Destructive Dropbox Operationsingress · DropboxFreezes the irreversible and bulk-mutation Dropbox tools on the agent channel, regardless of path. At ingress it denies, by tool-name suffix:Role-Gate Dropbox Writes to the Writers Groupingress · DropboxEstablishes the per-app least-privilege write floor for Dropbox.

Notion

Block Destructive and Export SQL on Notion Data Sourcesingress · NotionInspects Notion data-source query tool calls (notion-query-data-sources on the hosted server, query-data-source on the official local server) and denies any…Constrain Notion Connected-Tool Searchingress · NotionNotion's hosted MCP server (notion-search) does not just search Notion pages — through Notion AI connectors it also searches connected Slack, Google Drive,…Fence Notion Member Directory to Admin & ITingress · NotionDenies calls to the Notion member-directory tool (notion-get-users, matched by the -get-users suffix) unless the caller's IdP groups include an admin or IT…Freeze Notion Full-Page Content Overwritesingress · NotionDenies notion-update-page calls whose command argument is replace content — the one edge on Notion's hosted MCP server that overwrites a page's entire body…Notion: Redact PII from Read Responsesegress · NotionScans the responses of the Notion hosted MCP server's content-returning read tools and rewrites personally identifiable information to fixed redaction tokens…

Glean

Cap Glean Bulk Search Exportingress · GleanClamps the bulk-export parameters on Glean search calls before they reach the Glean MCP server, so a single agent request cannot pull an entire indexed…Fence Glean Search by Datasourceingress · GleanGlean's search tool fans out across every system the tenant has indexed (Drive, Confluence, Slack, Jira, Gmail/Outlook, GitHub, Salesforce, Gong, HR…Glean Default-Deny Unknown Toolsingress · GleanPins a per-tenant allowlist of the verified built-in read tools on the Glean managed remote MCP server and denies every other tool suffix on the Glean server…Glean: Gate Memory Writes (Read-Only Default)ingress · GleanGates mutating calls to Glean's long-term memory surface — the built-in tool exposed as memory (and as read memory in Glean's own client guide).Glean: Redact PII from Read-Tool Responsesegress · GleanScans the responses of Glean's content-returning read tools and rewrites high-confidence PII to fixed redaction tokens before the response reaches the…

Snowflake

Block Bulk Export & External Staging (Snowflake)ingress · SnowflakeBlocks Snowflake SQL-execution tool calls whose query text moves whole tables off the Snowflake perimeter — bulk export to cloud storage or a stage, and…Block Destructive and Mutating Snowflake SQLingress · SnowflakeInspects the SQL text that Snowflake MCP tools carry in their query argument and denies any statement in a mutating or destructive class — DROP, TRUNCATE,…Fence Snowflake Sensitive Schemas by Data Domainingress · SnowflakeFences customer-designated sensitive data domains inside a Snowflake warehouse by inspecting the SQL text the agent is about to run — not by tool name, which…Snowflake Default-Deny Unknown Toolsingress · SnowflakePins an allowlist of the exact Snowflake tool names your team audited and denies every other tool name on the Snowflake MCP server(s).Snowflake Deny Composite & Generic Toolsingress · SnowflakeDenies the opaque composite and generic passthrough tools on the Snowflake-managed MCP server whose execution the gateway cannot inspect one SQL statement at…Snowflake: Redact PII from Query Result Setsegress · SnowflakeScans the row content returned by the result-returning Snowflake MCP tools and rewrites personally identifiable information to fixed redaction tokens before…

BigQuery

BigQuery: Redact PII in Query Resultsegress · BigQueryScans the content returned by BigQuery's result-returning tools and rewrites high-confidence PII shapes to fixed, non-recoverable redaction tokens before the…Block BigQuery Exfiltration and Cross-Project Writesingress · BigQueryInspects the raw GoogleSQL string carried by BigQuery SQL tools and denies any statement that moves data out of the tenant's own project — even when the call…Block Destructive SQL in BigQuery Queriesingress · BigQueryInspects the raw GoogleSQL string carried by BigQuery write-capable query tools and denies any statement in a state-changing class — DML…Default-Deny Unaudited BigQuery Toolsingress · BigQueryMaintains a per-tenant allowlist of audited BigQuery tool-name suffixes and denies any call whose tool name does not end with an allowlisted entry.Fence Regulated BigQuery Datasets by Groupingress · BigQueryFences customer-designated regulated BigQuery data domains by data-domain IdP group, at ingress, before any statement or metadata lookup reaches BigQuery.

Databricks

Databricks Default-Deny Unknown Toolsingress · DatabricksPins an allowlist of the exact Databricks tool names your team audited and denies every other tool name on the Databricks MCP server(s).Databricks: Mask Cardholder PANs in Responsesegress · DatabricksMasks payment-card numbers (PANs) in Databricks tool responses before the agent receives them.Databricks: Redact PII in Tool Responsesegress · DatabricksScans the response payloads of the Databricks MCP tools that carry lakehouse data back to the agent and rewrites personally identifiable information to fixed…Databricks: Role-Gate Compute & Job Controlingress · DatabricksThe community JustTryAI/databricks-mcp-server exposes cluster and job control — create cluster, start cluster, terminate cluster, run job, and export…Fence Sensitive Databricks Schemasingress · DatabricksFences off the most sensitive lakehouse namespaces from agents on the read side of Databricks.Guard Databricks SQL Against Writes and DDLingress · DatabricksInspects the SQL statement string that Databricks SQL-executing tools carry in their argument and denies any statement that performs a write, schema change,…

Tableau

Default-Deny Unknown Tableau Toolsingress · TableauFails closed on tool drift. The policy carries a pinned allowlist of the 39 tools in the verified official Tableau web toolset (tableau/tableau-mcp v2.24.Fence Tableau Datasource Scopeingress · TableauTableau's MCP server is a warehouse proxy: query-datasource runs a VizQL Data Service (VDS) query and returns raw row-level data — PII, PHI, payroll,…Freeze Destructive Tableau Content Opsingress · TableauDenies the irreversible content-mutation tools on the official tableau/tableau-mcp web server unless the caller's IdP token carries the placeholder group…Guard Calculation Expressions in Tableau VDS Queriesingress · TableauInspects the structured VizQL Data Service (VDS) query carried by Tableau's query-datasource tool and denies the call for callers outside the data-analysts…Tableau: Redact PII & Mask PANs in Query Resultsegress · TableauTableau is a warehouse proxy: the data-returning tools stream raw row-level content out of whatever the published datasource connects to — PII, PHI, payroll,…

Power BI

Block Power BI RLS-Bypass Service-Principal Queriesingress · Power BIOn Microsoft's remote Power BI MCP server (https://api.fabric.microsoft.Default-Deny Unknown Power BI Modeling Toolsingress · Power BIPins a per-tenant allowlist of audited Power BI tool-name suffixes and denies any call whose tool name does not end with an allowlisted entry.Freeze Power BI RLS Role Editsingress · Power BIFreezes edits to row-level-security (RLS) roles on the Power BI MCP surface.Guard DAX Whole-Table Dumps in Power BIingress · Power BIPower BI semantic models front the warehouse: a model imports or DirectQueries lakehouse/warehouse tables — finance, HR, customer PII.Power BI: Redact PII in Query Resultsegress · Power BIScans the content returned by Power BI's result-returning tools and rewrites high-confidence PII shapes to fixed, non-recoverable redaction tokens before the…

Zapier

Block External Sends Hidden in Zapier Instructionsingress · ZapierEvery Zapier MCP tool — in both the agentic and classic modes — accepts a free-text instructions string that Zapier's server-side AI uses to fill any…Default-Deny Unknown Zapier Toolsingress · ZapierMaintains an allowlist of audited Zapier tool-name suffixes and denies any tool call whose name does not match an allowlisted entry, with an alert-worthy…Freeze the Zapier Toolset (No Self-Expansion)ingress · ZapierIn its default agentic mode, Zapier MCP exposes meta-tools that let the agent widen its own blast radius mid-session : enable zapier action and auto…Role-Gate All Zapier Writesingress · ZapierZapier MCP is an aggregator: one connector proxies actions across 9,000+ apps, and every create/update/delete/send funnels through a small, predictable…Zapier: Mask Card Numbers in Read Responsesegress · ZapierMasks payment-card numbers (PANs) in Zapier MCP read responses before they reach the agent.

ServiceNow

Default-Deny Unknown ServiceNow Toolsingress · ServiceNowMaintains an allowlist of audited ServiceNow tool-name suffixes and denies any tool call whose name does not match an allowlisted entry.Fence Sensitive ServiceNow Tablesingress · ServiceNowFences off the most sensitive ServiceNow tables from two routes that reach them:Force ServiceNow Comments to Internal Work Notesingress · ServiceNowKeeps agent-drafted ServiceNow comments off the customer/employee-visible journal by rewriting add comment calls to internal work notes.Freeze ServiceNow Identity Planeingress · ServiceNowFreezes the identity-and-access mutation surface of the ServiceNow MCP server. The policy denies, by tool-name suffix:Human-Only ServiceNow Change Approvalingress · ServiceNowUnconditionally denies the ServiceNow change-management control-gate tools — the ones whose names end in approve change, reject change, or submit change for…ServiceNow: Role-Gated Writes (Read-Only Default)ingress · ServiceNowelse fails closed

Intercom

Cap Intercom Contact Enumerationingress · Intercomcaller is a CRM admin); clamp page size on everything else; allow the rest Fence Intercom Contact & Company PII Readsingress · IntercomGates Intercom's structured-PII read surface — customer contact and company profiles — by IdP group.Intercom: Keep Agent Help Center Articles in Draftingress · IntercomKeeps agent-authored Intercom Help Center articles in draft so a human reviews them before they go live on the public Help Center.Intercom: Mask Card Numbers in Conversation Responsesegress · IntercomMasks payment-card numbers (PANs) in Intercom conversation content returned to agents by the conversation- and free-text-returning read tools.Intercom: Redact PII from Conversation & Contact Readsegress · IntercomScans the free-text returned by Intercom's conversation- and contact-read MCP tools and rewrites high-confidence personal identifiers and credential shapes…

Onboarding starters

Email Address Alertingress · Onboarding startersA watch-only starter policy.Email Address Blockingress · Onboarding startersThis policy stops a request if it contains an email address. If there's no email address, the request goes through as normal.Email Address Redactionegress · Onboarding startersThis policy automatically masks email addresses in what a tool sends back, replacing each one with [REDACTED] before your agent ever sees it.