sox

17 Dtwo policies tagged "sox", including Block Destructive and Mutating Snowflake SQL, Block Destructive SQL in BigQuery Queries. Browse by what the control does rather than which app it targets.

On this page

BigQuery
Databricks
GitHub
Microsoft 365
NetSuite
QuickBooks
Snowflake
Stripe

BigQuery

Block Destructive SQL in BigQuery Queriesingress · BigQueryInspects the raw GoogleSQL string carried by BigQuery write-capable query tools and denies any statement in a state-changing class — DML…

Databricks

Guard Databricks SQL Against Writes and DDLingress · DatabricksInspects the SQL statement string that Databricks SQL-executing tools carry in their argument and denies any statement that performs a write, schema change,…

GitHub

Read-Only GitHub for Non-Engineersingress · GitHubEstablishes the least-privilege baseline for the GitHub MCP connector on the agent channel.Require Human Approval: GitHub Merges & Approvalsingress · GitHubKeeps a human in the loop on the two GitHub actions that consummate a code change: merging a pull request and approving one .

Microsoft 365

Freeze Destructive Microsoft 365 Operationsingress · Microsoft 365Denies every Microsoft 365 tool call whose verb segment is delete- or cancel- unless the caller's IdP token carries the placeholder group m365-admin.Read-Only Baseline: Group-Gated Microsoft 365 Writesingress · Microsoft 365The least-privilege baseline for Microsoft 365 through the gateway: every tool call is allowed only if it is a read , or the caller's IdP token carries the…

NetSuite

NetSuite Guard Vendor Banking Edits (Anti-BEC)ingress · NetSuiteInstantiates policy family PF-10 (guard-vendor-banking) — the anti-BEC / payment-fraud control — for the Oracle NetSuite MCP Standard Tools SuiteApp.Protect Financial Postings by Roleingress · NetSuiteDenies the NetSuite record-write tools ns createRecord and ns updateRecord when they target a financial-transaction record type — journalentry (including the…

QuickBooks

Freeze Destructive QuickBooks Operationsingress · QuickBooksDenies every destructive QuickBooks Online (QBO) tool call on the agent channel before it reaches the MCP server.Gate QuickBooks Money-Movement by Finance Groupingress · QuickBooksGates the QuickBooks Online money-movement creation tools — create payment, create bill payment, create refund receipt, create transfer, and create deposit —…Guard Vendor Banking and Tax-ID Changesingress · QuickBooksBlocks create vendor and update vendor calls whose arguments carry a vendor's payment coordinates — bank account number, routing / ACH branch details — or…Lock Direct Journal-Entry Ledger Writesingress · QuickBooksDenies the QuickBooks Online tools create journal entry and update journal entry at ingress for every caller except those whose IdP claims include the…

Snowflake

Block Destructive and Mutating Snowflake SQLingress · SnowflakeInspects the SQL text that Snowflake MCP tools carry in their query argument and denies any statement in a mutating or destructive class — DROP, TRUNCATE,…

Stripe

Deny Stripe API-Write Escape Hatchingress · StripeDenies the stripe api write meta-tool — the single raw passthrough on the official Stripe MCP server that can execute any Stripe POST, PATCH, PUT, or DELETE…Human-Only Stripe Dispute Submissioningress · StripeStrips the irreversible submit flag from Stripe update dispute tool calls.Read-Only Stripe by Default (Role-Gate Billing Writes)ingress · StripeEstablishes a read-only-by-default Stripe posture over the MCP path. The named write and destructive billing tools —Stripe Refund Group Gate and Amount Capingress · StripeDenies Stripe refund tool calls — money out, irreversible — unless the caller's IdP groups include finance or billing-admin.