Box policies

Policies (5)

box · egress

Box: Redact PII from File Content on Egress

Scans the responses of Box content-returning tools and rewrites personally identifiable information to fixed redaction tokens before the response reaches the…

box redact-pii pii phi dlp redaction egress soc2 hipaa gdpr-ccpa

box · ingress

Box: Role-Gated Writes (Read-Only Default)

Makes Box read-only by default on the MCP path.

box role-gate-writes access-control least-privilege ingress soc2 gdpr-ccpa

box · ingress

Fence Sensitive Box Folders by IdP Group

Fences pinned sensitive Box subtrees (HR, Finance, Legal, …) by ID.

box fence-sensitive-scopes ingress soc2 hipaa gdpr-ccpa

box · ingress

Freeze Destructive Box Operations

Freezes deletes and retention tampering on the community self-hosted Box MCP server (box-community/mcp-server-box).

box freeze-destructive-ops ingress soc2

box · ingress

Guard Box Share Links and External Collaborations

Blocks the externally-visible Box sharing surface — the riskiest Box surface an agent can touch — before the call ever reaches Box:

box guard-share-links sharing external-sharing ingress soc2 hipaa gdpr-ccpa

About these policies

Reusable DTwo policies for Box MCP servers — the official hosted Box MCP server at https://mcp.box.com (the implementation behind the Claude connector for Box), plus the widely installed community server box-community/mcp-server-box and the minimal legacy hmk/box-mcp-server. The MCP surface spans content-read tools (file content, download URLs, previews, AI Q&A and extraction, folder listings, keyword/metadata search), state-mutating writes (upload, copy, move, folder and metadata creation, hub and docgen writes), and an externally-visible sharing surface (collaboration grants and shared links). Its risk profile is dominated by exfiltration and irreversibility: Box is a system of record for regulated documents (PHI, financials, contracts), an open shared link mints an anonymous URL the moment it is created, an external collaboration grants persistent outside access, and the community server adds destructive delete/retention tools with no per-user permission checks when run as a service account.

Available policies

Policy	Direction	Purpose	Framework bundles
guard-share-links-external	ingress	Deny external collaboration grants (login domain outside the corporate allowlist) and public shared links (`access: open`); id/group/role-only grants and non-string `access` fail closed.	soc2
role-gate-writes	ingress	Make Box read-only by default — gate every mutating tool (and unknown write-verb tools) behind an IdP writers group; reads and search pass for everyone.	soc2, hipaa, pci-dss, gdpr-ccpa, sox
freeze-destructive-ops	ingress	Deny deletes, collaboration/shared-link removal, and retention-date clears on the community server; recursive folder delete is denied for everyone, non-recursive deletes are exempt only for an IdP admin group.	sox, soc2, hipaa, gdpr-ccpa
fence-sensitive-folders	ingress	Fence pinned sensitive folder/file IDs (HR, Finance, Legal) so reads, moves, copies, listings, and scoped search only reach callers in the mapped IdP group.	soc2, hipaa, pci-dss, gdpr-ccpa
redact-pii-egress	egress	Redact SSNs, Luhn-valid payment cards, paired bank routing/account numbers, and paired email/phone from Box content-tool responses (transform-only).	soc2, hipaa, gdpr-ccpa

Tool naming on the DTwo gateway

DTwo prefixes tool names with the MCP server name configured on the gateway, and Box has two naming dialects. The official remote server uses bare verb_noun snake_case (upload_file, create_collaboration, add_file_shared_link); the community server uses a box_<domain>_<action>_tool shape (box_file_delete_tool, box_folder_delete_tool, box_shared_link_file_create_or_update_tool). A server registered as box surfaces tools like box-upload_file or box-box_file_delete_tool. The policies in this directory match on the suffix across both dialects so they stay portable — but you should always confirm the exact tool name your gateway sends using the dump-input debug technique before deploying. Capability divergence matters: deletes, locks, and retention exist only on the community server, while hub/docgen and enhanced AI extraction exist only on the official one.

Identity claims

The identity-gated policies (role-gate-writes, freeze-destructive-ops, fence-sensitive-folders, and the exemption branch of guard-share-links-external) read input.subject.claims.groups with placeholder group names (e.g. box-writers, box-admins, infosec, finance). Replace these with your own IdP group names at import time. Missing or non-array claims fail closed for grants (no group → not exempt, non-array shape → not a member). redact-pii-egress is transform-only and requires no claims.

Contributing

To add a Box policy:

Create apps/box/<policy-slug>/ with policy.md and a tests.yaml test file.
Add a row to the table above.
Declare apps: ["box"] in the policy frontmatter, plus any industry / bundle slugs that apply.
If the policy fits a bundle, link to it from the matching landing page.
Run pnpm manifest from the repo root.

See CONTRIBUTING.md for the full process.