Access Policy

    An Access Policy decides whether a tool call is allowed to reach an MCP server. It applies to a chosen set of identities, evaluates the conditions you define, and then either allows or blocks the call.

    How it works

    Access Policy is one of the two control policy types in SecureAI. You select the identities the policy applies to, add the conditions that describe when it should act, and set the action to Allow or Block. The attributes available for conditions depend on SecureAI and on the identity sources configured in your organization. Each condition is numbered as you add it, and the criteria pattern controls how those numbers are combined. You can edit the pattern to group conditions with AND and OR, for example, (1 AND 2) OR 3, so the policy acts only on the combinations you intend. Values that a condition compares against are defined once as policy parameters and reused across policies. The policy takes effect when it is attached to an MCP gateway. From then on, the gateway evaluates it on every tool call and applies the action before the call reaches the MCP server.

    Prerequisites

    • Administrator access to SecureAI with permission to manage control policies.
    • An identity source configured in SecureAI, so identities are available to apply the policy to.

    Steps to create an Access Policy

    1. Go to Access Protection > Access Controls > Control Policy.
    2. Click Create Control Policy.
    3. Under General, enter the Policy Name. To add an optional description, click Description and enter it.
    4. Under Policy Type, select Access Policy.
    5. Under Apply to Identities, click the add icon and select the identities this policy applies to.
    6. Under Conditions, click Add condition, then set the attribute, operator, and value. Repeat for each condition you need.
    7. Conditions combine using AND and OR operators. To change how they combine, click the edit icon next to Criteria Pattern.
    8. Under Policy Action, select Allow or Block.
    9. Click Save.

    The policy will now appear in the Control Policy list. To put it into effect, attach it to an MCP gateway.