Sign in

fence-sensitive-scopes

16 Dtwo policies tagged "fence-sensitive-scopes", including Confine Airtable Agent to Allowlisted Bases, Fence Confluence Reads & Search to Non-Restricted Spaces. Browse by what the control does rather than which app it targets.

On this page
  1. Airtable
  2. Asana
  3. BigQuery
  4. Box
  5. Confluence
  6. Databricks
  7. Dropbox
  8. GitHub
  9. Glean
  10. Intercom
  11. Linear
  12. Monday.com
  13. NetSuite
  14. Notion
  15. Snowflake
  16. Tableau

Airtable

Confine Airtable Agent to Allowlisted Basesingress · AirtableAn Airtable OAuth grant (or Personal Access Token) with the workspacesAndBases:read scope spans the entire workspace — every base the connected identity can…

Asana

Fence Writes to Sensitive Asana Projectsingress · AsanaAsana is routinely used for HR (hiring, performance, offboarding), legal, M&A, and incident work; those project bodies, comments, custom fields, and status…

BigQuery

Fence Regulated BigQuery Datasets by Groupingress · BigQueryFences customer-designated regulated BigQuery data domains by data-domain IdP group, at ingress, before any statement or metadata lookup reaches BigQuery.

Box

Fence Sensitive Box Folders by IdP Groupingress · BoxFences pinned sensitive Box subtrees (HR, Finance, Legal, …) by ID.

Confluence

Fence Confluence Reads & Search to Non-Restricted Spacesingress · ConfluenceFences a configurable set of restricted Confluence spaces (placeholder keys: HR, LEGAL, SEC) out of the agent's read and search paths unless the caller's IdP…

Databricks

Fence Sensitive Databricks Schemasingress · DatabricksFences off the most sensitive lakehouse namespaces from agents on the read side of Databricks.

Dropbox

Fence Sensitive Dropbox Paths by Teamingress · DropboxFences protected Dropbox subtrees by path prefix . Dropbox addresses files and folders by a root-relative path (/Finance/2026/payroll.

GitHub

Fence GitHub Access to the Company Org Allowlistingress · GitHubDenies any GitHub tool call whose arguments.owner (read from input.payload.args.

Glean

Fence Glean Search by Datasourceingress · GleanGlean's search tool fans out across every system the tenant has indexed (Drive, Confluence, Slack, Jira, Gmail/Outlook, GitHub, Salesforce, Gong, HR…

Intercom

Fence Intercom Contact & Company PII Readsingress · IntercomGates Intercom's structured-PII read surface — customer contact and company profiles — by IdP group.

Linear

Fence Roadmap and Initiative Reads (Egress)egress · LinearFences the responses of Linear's roadmap, initiative, and strategy read tools.

Monday.com

Fence Sensitive monday Boards by IdP Groupingress · Monday.commonday boards are schemaless business databases: HR/recruiting boards (candidate PII), CRM/deal boards (financial), and IT/security trackers routinely live…

NetSuite

Fence NetSuite HR & Payroll SuiteQL Queriesingress · NetSuiteFences the single biggest exfiltration surface on the NetSuite MCP server — ns runCustomSuiteQL, which runs arbitrary read-only SuiteQL across the entire ERP.

Notion

Fence Notion Member Directory to Admin & ITingress · NotionDenies calls to the Notion member-directory tool (notion-get-users, matched by the -get-users suffix) unless the caller's IdP groups include an admin or IT…

Snowflake

Fence Snowflake Sensitive Schemas by Data Domainingress · SnowflakeFences customer-designated sensitive data domains inside a Snowflake warehouse by inspecting the SQL text the agent is about to run — not by tool name, which…

Tableau

Fence Tableau Datasource Scopeingress · TableauTableau's MCP server is a warehouse proxy: query-datasource runs a VizQL Data Service (VDS) query and returns raw row-level data — PII, PHI, payroll,…

↑↓ to navigate ↵ to open