Policy schema reference

Section 6 · From docs/MCP_PRIVACY.md on GitHub

6.1 PolicyConfig (top level)

A policy has every field of AccessRules (6.2) plus:

Key	Type	Default	Meaning
name	str	"custom"	Shown in reports, annotations and error data.
description	str	""	Free text, shown by privacy_status.
extends	str or null	null	Profile name or file to inherit from (section 5.2).
hide_denied	bool	true	Denied primitives disappear from list results and calls answer "Unknown tool". With false they stay listed and calls fail with an access-denied error.
honor_hints	bool	true	Whether tools may relax transforms through transform_hints (section 10.4).
audit	bool	false	Record allowed calls too, and log them on cloudg.mcp.audit. Denials and rate limits are recorded either way.
audit_size	int >= 0	1000	Ring buffer size. 0 keeps no entries (the logger still gets them).
transforms	list	[]	Output pipeline: transform names or {type, id, options} objects (section 10).
input_transforms	list	[]	Argument pipeline, before the automatic depseudonymiser.
transform_options	map	{}	Option overrides keyed by transform type or id, deep-merged into matching transforms.
detectors	list of maps	[]	Custom content detectors (section 12.5).
disabled_detectors	list of str	[]	Detector names to switch off.
roles	map of role name to RuleConfig	{}	Shorthand for a rule whose match.roles contains the role.
rules	list of RuleConfig	[]	Conditional refinements, evaluated after roles.
rate_limits	list of RateLimitConfig	[]	Token buckets for every caller.
vault	VaultConfig	defaults	Pseudonym vault settings (section 13).

6.2 AccessRules (shared by policies and rules)

Key	Type	Default	At policy level	In a rule or role
allow_tools	list of globs or null	null	Allowlist of tool names; null means all. An empty list allows none.	Grant: matching tools skip the policy's allow and deny lists.
deny_tools	list of globs	[]	Default denial.	Explicit deny, always wins.
allow_resources / deny_resources	same	null / []	As above, for resource URIs and URI templates.	As above.
allow_prompts / deny_prompts	same	null / []	As above, for prompt names.	As above.
allow_categories / deny_categories	same	null / []	As above, for the primitive's category.	As above; a category grant also bypasses the name lists.
allow_capabilities	list of capability	[]	Removes capabilities from the inherited deny set.	Grants the capability despite the policy's deny set.
deny_capabilities	list of capability	[]	Capabilities nobody may use unless a rule grants them.	Explicit deny, wins over any grant.
max_sensitivity	sensitivity or null	null	Ceiling for every caller.	Ceiling for matching callers; replaces the policy ceiling and may raise it.

Capabilities: read_state, write_state, read_fs, write_fs, cloud_access, exec, reveal. Sensitivities, in order: public, internal, confidential (the default for a primitive), restricted.

The allow and deny lists are per family. Tools use the tool lists, prompts the prompt lists, and both static resources and resource templates the resource lists.

6.3 RuleConfig

A rule has every AccessRules field, plus:

Key	Type	Default	Meaning
name	str	""	Shown in denial reasons. Defaults to role:<role> for roles and rule[<index>] for rules.
description	str	""	Free text.
match	RuleMatch	match everything	Which calls the rule applies to.
transforms	list	[]	Extra output transforms for matching calls.
transforms_mode	append, prepend, replace	append	How transforms combine with the pipeline built so far.
transform_options	map	{}	Option overrides, deep-merged after the policy's own.
input_transforms	list	[]	Extra input transforms, appended.
rate_limits	list	[]	Extra rate limits for matching calls.
honor_hints	bool or null	null	Overrides the policy's honor_hints for matching calls.

6.4 RuleMatch

Every condition must hold; an empty list means "any".

Key	Matches when
roles	The principal has at least one of these roles. "*" matches every principal.
principals	The principal id matches one of these globs.
names	The tool or prompt name, or the resource URI or URI template, matches one of these globs.
categories	The primitive's category matches one of these globs.
tags	The primitive has at least one of these tags (exact strings).
kinds	The primitive is one of tool, resource, resource_template, prompt. resource also matches templates.
sensitivity	The primitive's sensitivity is one of these.
capabilities	The primitive declares at least one of these capabilities.

A rule with only roles and principals conditions also applies when no primitive is involved, which is how preview_transform without a tool and privacy_status pick up role options.

6.5 RateLimitConfig

Key	Type	Default	Meaning
rate	float > 0	required	Calls per period.
per	second, minute, hour, day	minute	The period.
burst	int >= 1 or null	null	Bucket capacity; defaults to ceil(rate) (at least 1).
scope	principal, tool, principal_tool, global	principal_tool	Which calls share a bucket (section 9).
tools	list of globs	["*"]	Names or URIs the limit covers.
kinds	list of str	[] (all)	tool, resource, resource_template, prompt, completion. Matched exactly, except that resource also covers resource_template.

6.6 VaultConfig

Key	Type	Default	Meaning
key	secret str or null	null	HMAC key for pseudonyms. Prefer the environment. Never shown by describe().
key_env	str	CLOUDG_MCP_VAULT_KEY	Environment variable read when key is not set.
scope	global, principal	global	One namespace, or one per principal id.
ttl_seconds	float > 0 or null	null	Forget a mapping unused for this long.
path	str or null	null	Vault file, loaded at start if it exists and saved at server shutdown and interpreter exit when it changed.
autosave	bool	false	Also rewrite the file whenever a transform issued new pseudonyms.
encrypt	bool	true	Encrypt and authenticate the file.

6.7 Globs

Name, URI, category and principal patterns are fnmatch globs, compiled into one regular expression per list:

• * matches any run of characters, including / and :; ? matches one character; [abc] and [!abc] match a set.
• Matching is case-sensitive and anchored to the whole string.
• A pattern starting with ! is a negation. A list matches when at least one positive pattern matches and no negation does. A list with only negations matches nothing, so allow_tools: ["!get_secret*"] allows no tools at all; write ["*", "!get_secret*"].
• Resource patterns match the static URI or the URI template text (cloudg://assets/{+ref}), never the concrete URI a client reads. You cannot deny cloudg://assets/arn:aws:s3:::payroll alone; deny the template, or filter inside the tool.

Projection paths (section 11.7) use a different, dotted syntax.