Fence NetSuite HR & Payroll SuiteQL Queries
Fences the single biggest exfiltration surface on the NetSuite MCP server — ns runCustomSuiteQL, which runs arbitrary read-only SuiteQL across the entire ERP.
Fences the single biggest exfiltration surface on the NetSuite MCP server — ns runCustomSuiteQL, which runs arbitrary read-only SuiteQL across the entire ERP.
Instantiates the PF-08 cap-bulk-export family as a transform-only ingress policy on ns runCustomSuiteQL — the NetSuite MCP tool that runs arbitrary read-only…
netsuitecap-bulk-exportsuiteqldata-minimisationingresssoc2pci-dssgdpr-ccpa
Pins an allowlist of the audited NetSuite MCP Standard Tools and denies every other tool call before it reaches the NetSuite AI Connector.
netsuitedefault-deny-unknown-toolsallowlistaccess-controlingresssoc2
Instantiates policy family PF-10 (guard-vendor-banking) — the anti-BEC / payment-fraud control — for the Oracle NetSuite MCP Standard Tools SuiteApp.
Instantiates PF-02 (redact-pii-egress) on the NetSuite read path.
netsuiteredact-piipiifinancial-piidlpredactionegressgdpr-ccpasoc2
Denies the NetSuite record-write tools ns createRecord and ns updateRecord when they target a financial-transaction record type — journalentry (including the…
Reusable DTwo policies for Oracle NetSuite MCP servers — the official NetSuite AI Connector Service + MCP Standard Tools SuiteApp (the endpoint the Claude connector uses directly), the dsvantien/netsuite-mcp-server community proxy that surfaces the same ns_* tools, and adjacent community wrappers. The MCP surface is read tools (ns_getRecord, ns_runCustomSuiteQL arbitrary read-only SQL over the whole ERP, ns_runSavedSearch/ns_runReport, metadata helpers) and two write tools (ns_createRecord, ns_updateRecord) that create or overwrite any REST-exposed record type. Its risk profile is dominated by financial integrity and exfiltration, not deletion: there is no delete tool, but ns_runCustomSuiteQL is a one-query path to employee PII/HR data, full vendor/customer master data (including bank details), and pre-earnings GL results; ns_updateRecord on a vendor is the classic BEC payment-fraud vector; a posted journal in a closed period is a restatement risk; and the /v1/all endpoint can expose arbitrary account-specific SuiteScript tools whose side effects are unknowable in advance.
| Policy | Direction | Purpose | Framework bundles |
|---|---|---|---|
| default-deny-unknown-tools | ingress | Default-deny any NetSuite tool whose suffix is not in the audited standard ns_* allowlist, so custom SuiteScript tools on /v1/all must be explicitly allow-listed before agents can call them. |
soc2, gdpr-ccpa |
| guard-vendor-banking | ingress | Deny ns_createRecord/ns_updateRecord on vendor records that touch bank/payment fields (account, routing, sort code, IBAN, payment method) unless the caller is in an AP-manager group — anti-BEC. |
sox, soc2 |
| protect-closed-periods | ingress | Deny financial-transaction writes (journalentry, vendorbill, vendorpayment, and peers) unless the caller is in a finance group, protecting posted/closed-period books. | sox, soc2 |
| fence-hr-payroll-suiteql | ingress | Deny ns_runCustomSuiteQL over HR/payroll tables and ns_runSavedSearch identifiers naming payroll/HR unless the caller is in an HR group. |
gdpr-ccpa, soc2 |
| cap-bulk-export | ingress | Clamp the ns_runCustomSuiteQL pageSize argument down to a configurable ceiling (default 100), throttling one-shot mass export of ERP master data (transform-only). |
soc2, gdpr-ccpa |
| redact-financial-pii | egress | Redact SSN/TIN, bank-account, routing/ABA, and IBAN-shaped strings from NetSuite read responses before they reach the agent context (transform-only). | gdpr-ccpa, soc2 |
DTwo prefixes tool names with the MCP server name configured on the gateway. A NetSuite MCP server registered as netsuite will surface tools like netsuite-ns_createRecord, while one registered as ns will surface ns-ns_createRecord. The official server and the dsvantien proxy share the ns_ prefix with camelCase verbs (ns_runCustomSuiteQL), so the policies in this directory match on the suffix (ns_createrecord, ns_runcustomsuiteql, etc., case-insensitively) to stay portable across naming conventions. The independent community wrappers use incompatible conventions (get-* for ChatFin, netsuite_* for glints-dev) with different argument shapes and are not covered by these ns_*-keyed policies. Always confirm the exact tool name your gateway sends using the dump-input debug technique before deploying — and on /v1/all accounts, pin default-deny-unknown-tools to your audited full gateway tool names rather than relying on suffix matching alone (see that policy's Known limitations).
Several of these policies are single-purpose and require no IdP claims (default-deny-unknown-tools, cap-bulk-export, redact-financial-pii). The identity-gated ones read input.subject.claims.groups with placeholder group names: guard-vendor-banking exempts an AP-manager group, protect-closed-periods gates on a finance group, and fence-hr-payroll-suiteql exempts an hr group. Replace these with your own IdP group names at import time. Missing claims fail closed for grants (no group → not exempt).
To add a NetSuite policy:
apps/netsuite/<policy-slug>/ with policy.md and a tests.yaml test file.apps: ["netsuite"] in the policy frontmatter, plus any industry / bundle slugs that apply.soc2, sox, gdpr-ccpa, …), link to it from the matching landing page.pnpm manifest from the repo root.See CONTRIBUTING.md for the full process.