DLP Policy

    A DLP Policy inspects the content of tool calls for sensitive data. When it finds a match, it either redacts the matched content and lets the call through, or blocks the call.

    How it works

    DLP Policy is one of the two control policy types in SecureAI. You select the identities the policy applies to, choose the data patterns it should look for, and set the action to take on a match. Patterns come from policy parameters: SecureAI provides built-in patterns organized by country and compliance framework, and you can add your own as custom regex patterns. You can also select Enable Access Conditions, so that the policy applies only in the circumstances you define. If the action is Redact and Allow, the matched content is replaced with your redact text in the tool input, the tool output, or both, and the call continues. If the action is Block, the call is stopped. The policy takes effect when it is attached to an MCP gateway. From then on, the gateway evaluates it on every tool call before the call reaches the MCP server.

    Prerequisites

    • Administrator access to SecureAI with permission to manage control policies.
    • An identity source configured in SecureAI, so identities are available to apply the policy to.
    • The DLP patterns the policy will use, either the built-in patterns or a custom regex pattern created under Policy Parameters.

    Steps to create a DLP Policy

    1. Go to Access Protection > Access Controls > Control Policy.
    2. Click Create Control Policy.
    3. Under General, enter the Policy Name. To add an optional description, click Description and enter it.
    4. Under Policy Type, select DLP Policy.
    5. Under Apply to Identities, click the add icon and select the identities this policy applies to.
    6. Under DLP Conditions, click Add condition and select the data patterns to detect.
    7. To apply the policy only in specific circumstances, select Enable Access Conditions, then click Add condition in Access Conditions and define them.
    8. Under Policy Action, select Redact and Allow or Block.
    9. If you selected Redact and Allow, enter the Redact Text that replaces the matched content, and beside Redact In, select Tool Input, Tool Output, or both.
    10. Click Save.

    The policy will now appear in the Control Policy list. To put it into effect, attach it to an MCP gateway.