Control Policies
Each policy's mode; open a row to change it.
| Policy | Mode | Description | Tracked frameworks |
|---|---|---|---|
| MCP servers & tools2 of 3 on · 1 enforcing | |||
 Unsanctioned MCP server in use | Enforce 3 exceptions | Detect use of an MCP server that is not sanctioned for the applicable user, team, device, or other governed scope. |  OWASP LLM |
| Tools must be on the allow list | Observe | Agents may only invoke tools on the approved list. | OWASP LLM |
| MCP servers and skills are pinned to reviewed versions | Off observe only | Servers and skills load only at the version that was reviewed. | OWASP LLM |
| Identity2 of 2 on | |||
| Personal account is in use | Observe observe only | Detect an AI provider account that is not organisation-backed. | Maps to 3, none tracked |
| Enterprise accounts required | Observe observe only | AI provider accounts must be organisation-managed. | Maps to 3, none tracked |
| Data handling5 of 5 on · 1 enforcing | |||
| Sensitive information detected before transmission to an LLM | Observe observe only | Detect regulated personal or financial data in prompts and tool payloads bound for a model. | OWASP LLM |
| Sensitive information sanitized before transmission | Enforce | Sensitive values must be redacted before they reach a model. | OWASP LLM |
| Prohibited data classes must not leave an approved boundary | Off enforce for Finance | Block prohibited data classes from transmission to unapproved destinations. | OWASP LLM |
| Prompts are inspected for injection and leakage | Observe observe only | Inbound prompts and retrieved content are inspected for injection patterns and system-prompt leakage. | OWASP LLM |
| Credentials must not be sent to a model | Observe | Keys, tokens and passwords are denied before transmission to any model. | OWASP LLM |
| Providers & models1 of 1 on | |||
| Approved model providers only | Observe 2 exceptions | Agent traffic may only reach providers on the approved list. | OWASP LLM |
| Files & directories1 of 1 on | |||
| Restricted file access | Off enforce for Finance | Agents must not read or write restricted paths. | OWASP LLM |
| Network0 of 1 on | |||
| Agent traffic must use approved encrypted transport | Off | Detect agent traffic over transports that are not on the approved encrypted list. | Maps to 3, none tracked |
| Agents & harnesses4 of 4 on | |||
| Consequential tool calls require approval | Observe | A human approves consequential tool calls before an agent proceeds. | OWASP LLM |
| Model output is validated before tool execution | Observe observe only | Output that becomes a tool call or code is validated first. | OWASP LLM |
| Agents run in a sandbox | Observe | Agent processes run inside the approved sandbox. | OWASP LLM |
| Agents may not run as root | Observe · until Nov 15 then Enforce | Agents may not execute with root or admin privileges. | OWASP LLM |
| Sessions & transcripts1 of 1 on | |||
| Agent sessions are recorded | Observe observe only | Every agent session reports telemetry and a transcript. | OWASP LLM |
| Spend0 of 1 on | |||
| Spend stays under the ceiling | Off observe only | Token spend per session, user and team stays under the configured ceiling. | OWASP LLM |
Custom controls
Need something narrower than the policies above? The flexible engine is still here — author any rule against the live signal vocabulary. Seeded controls now surface as policies.
control | category | severity | matches |
|---|---|---|---|