Block Irreversible Docusign Void and Workflow Kills
Denies the irreversible destructive operations on the Docusign agent path:
Denies the irreversible destructive operations on the Docusign agent path:
Bounds the two largest data-out channels in the Docusign MCP landscape:
docusigncap-bulk-exportpiidata-minimisationegresssoc2gdpr-ccpa
Scans the responses of Docusign envelope- and agreement-reading tools and rewrites high-confidence regulated identifiers before the response reaches the…
docusignredact-piitab-valuespiiphipandlpredactionegresssoc2gdpr-ccpa
Rewrites Docusign envelope-creation calls so the envelope is staged as a (status: "sent").
Blocks Docusign envelope-creation and recipient-update tool calls when any recipient email address has a domain outside the configured counterparty allowlist.
Reusable DTwo policies for Docusign MCP servers — the official remote Docusign MCP Server (https://mcp.docusign.com/mcp, the same server behind the Claude / Claude Cowork connector) plus the community luthersystems/mcp-server-docusign and CData read-only SQL implementations. The MCP surface spans directory and profile reads (getUsers, getUserInfo), envelope and agreement reads that carry filled tab values and AI-extracted contract terms (getEnvelope, listRecipients, getAllAgreements, getAgreementDetails), externally visible writes (createEnvelope with status: "sent", updateEnvelopeRecipients, sendReminder), workflow controls (triggerWorkflow, cancelWorkflowInstance, pauseNewWorkflowInstances), and — on community servers — whole-PDF export (download_envelope_document). Its risk profile is dominated by legally significant, irreversible action: a status: "sent" envelope emails a real signature request to counterparties under your company's brand, a void permanently invalidates an executed record, and envelopes are PII by construction and routinely carry financial terms, PHI, or SSN/bank tab values — making Docusign a standing SOX/HIPAA evidence surface.
| Policy | Direction | Purpose | Framework bundles |
|---|---|---|---|
| force-draft-envelopes | ingress | Rewrite envelope-creation calls to status: "created" (draft) instead of "sent" unless the caller is in the esign-senders group; agents stage, humans dispatch. |
soc2, sox |
| guard-external-recipients | ingress | Deny envelope-creation and recipient-update calls that route any recipient to a domain outside the counterparty allowlist, naming each offending address. | soc2, gdpr-ccpa, hipaa |
| freeze-destructive-ops | ingress | Deny irreversible operations — updateEnvelope voids, cancelWorkflowInstance, pauseNewWorkflowInstances — except for the contract-ops group. |
sox, soc2, hipaa, gdpr-ccpa |
| redact-tab-values-egress | egress | Redact SSN, US bank routing/account numbers, and Luhn-validated payment-card PANs in envelope- and agreement-read responses (transform-only). | soc2, hipaa, gdpr-ccpa, pci-dss |
| cap-directory-and-document-egress | egress | Truncate getUsers directory listings to 25 rows for non-admins and deny community download_envelope_document base64-PDF export unless the caller is in contracts-read. |
soc2, hipaa, gdpr-ccpa |
The official Docusign server sends camelCase, no-prefix tool names on the wire (createEnvelope, updateEnvelope, getUsers, getAllAgreements); a DTwo gateway prepends the configured server name (e.g. docusign-createEnvelope). The community luthersystems server uses snake_case with richer verbs (create_envelope_from_template, download_envelope_document), and CData uses a {servername}_run_query prefix pattern. The policies here match on the suffix (createenvelope, create_envelope, updateenvelope, getusers, download_envelope_document, etc.) and lower-case the tool name so they stay portable across both naming conventions — but confirm the exact tool name your gateway sends using the dump-input debug technique before deploying. Per-tool JSON schemas for the official server are not published on a static page; the argument-shape assumptions in each policy are drawn from the mapped REST bodies and should be verified against a live tools/list before relying on exact-match behavior.
The identity-gated policies read input.subject.claims.groups with placeholder group names: esign-senders (force-draft-envelopes), contract-ops (freeze-destructive-ops), and admin / contracts-read (cap-directory-and-document-egress). Replace these with your own IdP group names at import time. Missing or empty claims fail closed for grants — no group means not exempt (still forced to draft, still denied the void, still truncated, still denied the download). guard-external-recipients and redact-tab-values-egress require no claims.
To add a Docusign policy:
apps/docusign/<policy-slug>/ with policy.md and a tests.yaml test file.apps: ["docusign"] in the policy frontmatter, plus any industry / bundle slugs that apply.soc2, hipaa, pci-dss, gdpr-ccpa, sox) in the policy frontmatter bundles field; if a matching thematic bundle landing page exists under bundles/, link to it.pnpm manifest from the repo root.See CONTRIBUTING.md for the full process.