Denies Google Calendar event-write tool calls — create event / create-event, update event / update-event, and the consolidated manage event — whenever any…
google-calendarguard-external-sendingresscalendarsoc2hipaagdpr-ccpa
Blocks Google Calendar create and update event calls that would expose the event to the world or hand control of it to guests.
Denies irreversible Google Calendar mutations on the agent channel:
Scrubs sensitive fields from the responses of Google Calendar read tools before they reach the agent, for callers who lack the placeholder calendar-full-read…
google-calendarredact-piipiiphidlpredactionegresssoc2hipaagdpr-ccpa
Reusable DTwo policies for Google Calendar MCP servers — Google's official remote Calendar server (create_event/update_event/delete_event/respond_to_event plus the read tools), the community nspady/google-calendar-mcp (create-event, update-event, delete-event, search-events, get-freebusy, manage-accounts), and taylorwilsdon/google_workspace_mcp, whose consolidated manage_event tool spans create, update, and delete behind one name. The Anthropic Claude connector is read-only, so all write risk comes from the official Google server or the community servers wired in behind a gateway. Its risk profile is dominated by externally visible writes and read-side leakage, not just deletion: a create/update with an external attendee and sendUpdates: all emails the event body outside the org (an under-watched exfil channel), visibility: public / guestsCan* flags hand a private event to the world, recurring-series-wide edits and deletes silently move or wipe standing meetings with no MCP-level undo, and read responses expose attendee email lists, private event bodies, and live meeting-join links across every calendar the OAuth grant covers.
| Policy | Direction | Purpose | Framework bundles |
|---|---|---|---|
| guard-external-attendees | ingress | Deny event-write calls (create/update/manage_event) that invite any attendee whose domain is outside the corporate allowlist; closes the calendar-invite exfil channel. |
soc2, hipaa, gdpr-ccpa |
| guard-public-exposure | ingress | Deny create/update calls that set visibility: public or hand edit / invite / self-add control to guests. |
soc2 |
| freeze-destructive-events | ingress | Deny event deletes (including manage_event delete actions) for non-admins, and deny recurring-series-wide changes for everyone. |
soc2, hipaa, gdpr-ccpa, sox |
| redact-attendee-pii | egress | Redact attendee emails and names, meeting-join links, and PII/PHI in calendar read responses (transform-only); reads still return, scrubbed. | soc2, hipaa, gdpr-ccpa |
DTwo prefixes tool names with the MCP server name configured on the gateway, and the three Calendar implementations disagree on delimiters for the same operations — create_event (Google, snake), create-event (nspady, kebab), gcal_* (Claude connector), and manage_event (taylorwilsdon, consolidated). The policies here match on the suffix and normalize -/_ so they stay portable across naming conventions, and the destructive-ops policy inspects the action argument on manage_event because the tool name alone cannot tell a reschedule from a delete. Always confirm the exact tool name your gateway sends using the dump-input debug technique before deploying.
The identity-gated policies read input.subject.claims.groups with placeholder group names — replace them with your own IdP group names at import time: guard-external-attendees exempts calendar-external-schedulers, freeze-destructive-events exempts calendar-admins (deletes only — series-wide changes are denied even for admins), and redact-attendee-pii exempts calendar-full-read. Missing claims fail closed for grants (no group → not exempt).
To add a Google Calendar policy:
apps/google-calendar/<policy-slug>/ with policy.md and a tests.yaml test file.apps: ["google-calendar"] in the policy frontmatter, plus any industry / bundle slugs that apply.pnpm manifest from the repo root.See CONTRIBUTING.md for the full process.