Sign in

role-gate-writes

16 Dtwo policies tagged "role-gate-writes", including Block Power BI RLS-Bypass Service-Principal Queries, Box: Role-Gated Writes (Read-Only Default). Browse by what the control does rather than which app it targets.

On this page
  1. Box
  2. Databricks
  3. Dropbox
  4. GitHub
  5. Glean
  6. Gmail
  7. Google Drive
  8. HubSpot
  9. Jira
  10. Microsoft 365
  11. Power BI
  12. Salesforce
  13. ServiceNow
  14. Slack
  15. Stripe
  16. Zapier

Box

Box: Role-Gated Writes (Read-Only Default)ingress · BoxMakes Box read-only by default on the MCP path.

Databricks

Databricks: Role-Gate Compute & Job Controlingress · DatabricksThe community JustTryAI/databricks-mcp-server exposes cluster and job control — create cluster, start cluster, terminate cluster, run job, and export…

Dropbox

Role-Gate Dropbox Writes to the Writers Groupingress · DropboxEstablishes the per-app least-privilege write floor for Dropbox.

GitHub

Read-Only GitHub for Non-Engineersingress · GitHubEstablishes the least-privilege baseline for the GitHub MCP connector on the agent channel.

Glean

Glean: Gate Memory Writes (Read-Only Default)ingress · GleanGates mutating calls to Glean's long-term memory surface — the built-in tool exposed as memory (and as read memory in Glean's own client guide).

Gmail

Gmail: Role-Gated Writes (Read-Only Default)ingress · GmailMakes Gmail read-only by default on the MCP path. Verified read tools pass for everyone.

Google Drive

Gate Google Drive Writes to an Authorized IdP Groupingress · Google DriveBaseline least-privilege policy for Google Drive MCP traffic.

HubSpot

HubSpot Role-Gate Writesingress · HubSpotGates every HubSpot write tool behind an IdP group: callers whose JWT groups claim contains crm-writers may create and update CRM records; everyone else gets…

Jira

JIRA: Role-Gated Writes (Read-Only Default)ingress · JiraMakes Jira read-only by default on the MCP path.

Microsoft 365

Read-Only Baseline: Group-Gated Microsoft 365 Writesingress · Microsoft 365The least-privilege baseline for Microsoft 365 through the gateway: every tool call is allowed only if it is a read , or the caller's IdP token carries the…

Power BI

Block Power BI RLS-Bypass Service-Principal Queriesingress · Power BIOn Microsoft's remote Power BI MCP server (https://api.fabric.microsoft.

Salesforce

Salesforce Role-Gated Writesingress · SalesforceThe PF-12 least-privilege baseline for Salesforce.

ServiceNow

ServiceNow: Role-Gated Writes (Read-Only Default)ingress · ServiceNowelse fails closed

Slack

Slack Role-Gate Writesingress · SlackGates every Slack write-class tool behind an IdP group: callers whose JWT groups claim contains slack-writers may send and schedule messages, add or remove…

Stripe

Read-Only Stripe by Default (Role-Gate Billing Writes)ingress · StripeEstablishes a read-only-by-default Stripe posture over the MCP path. The named write and destructive billing tools —

Zapier

Role-Gate All Zapier Writesingress · ZapierZapier MCP is an aggregator: one connector proxies actions across 9,000+ apps, and every create/update/delete/send funnels through a small, predictable…

↑↓ to navigate ↵ to open