pci-dss
24 Dtwo policies tagged "pci-dss", including Block BigQuery Exfiltration and Cross-Project Writes, Block Bulk Export & External Staging (Snowflake). Browse by what the control does rather than which app it targets.
On this page
BigQuery
Block BigQuery Exfiltration and Cross-Project WritesInspects the raw GoogleSQL string carried by BigQuery SQL tools and denies any statement that moves data out of the tenant's own project — even when the call…Block Destructive SQL in BigQuery QueriesInspects the raw GoogleSQL string carried by BigQuery write-capable query tools and denies any statement in a state-changing class — DML…Fence Regulated BigQuery Datasets by GroupFences customer-designated regulated BigQuery data domains by data-domain IdP group, at ingress, before any statement or metadata lookup reaches BigQuery.
Databricks
Databricks: Mask Cardholder PANs in ResponsesMasks payment-card numbers (PANs) in Databricks tool responses before the agent receives them.Fence Sensitive Databricks SchemasFences off the most sensitive lakehouse namespaces from agents on the read side of Databricks.Guard Databricks SQL Against Writes and DDLInspects the SQL statement string that Databricks SQL-executing tools carry in their argument and denies any statement that performs a write, schema change,…
Gmail
HubSpot
Intercom
Cap Intercom Contact Enumerationcaller is a CRM admin); clamp page size on everything else; allow the restFence Intercom Contact & Company PII ReadsGates Intercom's structured-PII read surface — customer contact and company profiles — by IdP group.Intercom: Mask Card Numbers in Conversation ResponsesMasks payment-card numbers (PANs) in Intercom conversation content returned to agents by the conversation- and free-text-returning read tools.
NetSuite
QuickBooks
Cap QuickBooks Bulk Search ExportsClamps the bulk-read levers on every QuickBooks Online search tool so an agent cannot pull the entire general ledger — or a full customer, vendor, or…Gate QuickBooks Money-Movement by Finance GroupGates the QuickBooks Online money-movement creation tools — create payment, create bill payment, create refund receipt, create transfer, and create deposit —…
Salesforce
Salesforce Cap Bulk Data ExportCaps how many records a single agent call can pull out of Salesforce, so an agent (or a prompt injection steering one) can't bulk-export the CRM.Salesforce Query AllowlistRestricts Salesforce SOQL queries so only Account, Contact, and Opportunity records can be retrieved.
ServiceNow
Slack
Snowflake
Block Bulk Export & External Staging (Snowflake)Blocks Snowflake SQL-execution tool calls whose query text moves whole tables off the Snowflake perimeter — bulk export to cloud storage or a stage, and…Block Destructive and Mutating Snowflake SQLInspects the SQL text that Snowflake MCP tools carry in their query argument and denies any statement in a mutating or destructive class — DROP, TRUNCATE,…Fence Snowflake Sensitive Schemas by Data DomainFences customer-designated sensitive data domains inside a Snowflake warehouse by inspecting the SQL text the agent is about to run — not by tool name, which…
Stripe
Read-Only Stripe by Default (Role-Gate Billing Writes)Establishes a read-only-by-default Stripe posture over the MCP path. The named write and destructive billing tools —Stripe Refund Group Gate and Amount CapDenies Stripe refund tool calls — money out, irreversible — unless the caller's IdP groups include finance or billing-admin.