Onboarding Playbook

Documentation Index

Fetch the complete documentation index at: https://docs.getunbound.ai/llms.txt

Use this file to discover all available pages before exploring further.

Your AI coding tools — Claude Code, Cursor, Codex, Copilot, and more — now route through Unbound. We see every prompt, every terminal command, and every MCP tool call your agents make, and we enforce your policies inline, before anything runs. Nothing changes for your developers. Everything changes for your security team. This playbook walks you through what’s in the platform, what each part is for, and how to get value fast.

​

1. Getting started (5 minutes)

Once a tool is connected, its activity starts flowing into Unbound immediately.

​

2. The dashboard — your home base

Your landing page is an at-a-glance health view of your whole org: devices and tools connected, agentic activity (terminal commands and MCP calls), how many actions were blocked / warned / allowed, total spend, and recommendations. It’s built to be skimmed — start here each day, then click into whatever needs attention.

​

3. See what your AI tools are actually doing

Before you write a single policy, get visibility. Open AI Tools Discovery → Summary. This is your mission control: it inventories every AI tool detected across your org and flags risk. Three things to check on day one: The other sub-pages — Users, Tools, Tool Rules, Skills, Setup — let you drill into per-developer detail. You don’t need them on day one.

​

4. Tool Policies — guardrails on what AI can do

Tool Policies govern the actions AI agents take — the terminal commands they run and the MCP tools they call — and stop the dangerous ones before they execute. Find them under Policies → Tool Policies.

​

What each action does

​

Three ways to create a policy

1. Guided form (UI). Open Policies → Tool Policies and click Create Policy, then choose Terminal Commands or MCP Actions. Build the rule with dropdowns: When (command family) → If (field to match + pattern) → Then (action) → optionally scope to User Groups. A live preview shows the rule in plain English as you build it.
2. Describe it in plain English. The create dialog has a “Describe a policy or paste a command…” box. Type what you want — e.g. “Block any database command that drops or truncates” — and Unbound fills in the form.
3. Ask your AI agent (CLI). Any developer onboarded with the Unbound CLI can ask their agent (Claude Code, Cursor, Codex) to create the policy. The agent runs the unbound CLI for you. Requires the CLI installed and logged in with an Admin role.
   unbound policy tool create-mcp \
     --name "Block destructive GitHub actions" \
     --mcp-server github \
     --mcp-action-type destructive \
     --action BLOCK \
     --custom-message "Destructive GitHub actions are blocked — contact your admin."
   

​

Command families you can target (terminal commands)

Unbound classifies every command an agent runs into a family, grouped by area: Each family matches on specific fields — e.g. Database Admin matches on database, table, operation, environment; Delete File matches on path.

​

Worked example A — Stop AI from destroying production infrastructure

The real risk: AI coding agents increasingly run with cloud and database credentials. One misfired command — terraform destroy, kubectl delete namespace production, aws rds delete-db-instance, DROP DATABASE prod — can wipe an environment in seconds. Layer the four actions by severity:

• Block what is never legitimate — Command Family Database Admin, Match Against Operation, Pattern DROP* (add a rule for TRUNCATE*); and Command Family Cloud Destroy, Match Against Environment, Pattern *prod*.
• Require Slack Approval for destructive actions that are sometimes valid, so a human signs off in-channel first — Command Family Cloud Destroy, Match Against Environment, Pattern *staging*.
• Warn on risky-but-common actions so the developer gets a heads-up without being blocked — Command Family Git Action, Match Against Operation, Pattern push --force*.
• Audit first when you don’t yet know what’s normal — Command Family Cloud Destroy, Match Against Any — log everything, tighten later.

Test it: a terraform destroy against production is blocked; against staging it’s held for Slack approval; a routine terraform plan runs as usual.

​

Worked example B — Gate destructive MCP actions across your tools

The real risk: an AI agent wired to the GitHub, Linear, or Sentry MCP can delete a repository, wipe issues and comments, or remove a Sentry project — irreversibly, in a single tool call, with no terminal command to catch it. Control them by action type:

• Block the never-automate actions — MCP Server GitHub, action type destructive.
• Require Slack Approval for destructive actions you occasionally need — MCP Server Linear, action type destructive (covers delete_comment, delete_attachment, delete_status_update).
• Audit to learn which MCP tools your agents actually reach for before you enforce — any server, action type destructive.

You can also target a single tool by name (e.g. delete_comment) instead of a whole action type. Test it: deleting a GitHub repository is blocked; deleting a Linear comment is held for Slack approval.

​

Recommended starting policies

Start with these, watch your logs, then expand.

​

5. Guardrails — content inspection

Where Tool Policies govern what AI agents do, Guardrails (under Policies → Security Policies) inspect the content of requests and responses. They act inline — on a request before it reaches the model, and on a response before it reaches your developer:

• PII Detection — emails, phone numbers, and other personal data.
• Secrets Detection — API keys, passwords, tokens.
• Actions: Redact (mask the sensitive value before the model sees it), Block, or Audit.

​

6. Where to find things

​

7. Settings you should know (admins)

Under Settings:

• Integrations — connect Slack (required for the Require Slack Approval action).
• Policy Enforcement — choose what happens if Unbound is ever unreachable: Allow (operations run as usual — the default) or Block (operations are denied). Pick based on your risk tolerance.
• Users & User Groups — invite teammates, assign roles (Admin / Member), and create groups to scope policies to specific teams.

​

8. (Optional) LLM Gateway features

If your organization uses Unbound as its LLM gateway (routing model traffic through us), you’ll also see Models, Model Policies, Cost Policies, Cost Management, and Billing. These let you control which models are allowed, cap spend per user or team, and manage invoices. If you only use Unbound to govern AI coding tools, you can skip this section — these pages won’t appear in your nav.

​

9. Troubleshooting

• Policy not firing? Confirm it’s Active and scoped to the right user group (empty = everyone).
• MCP policy not matching? Check the exact MCP server name on the MCP Servers page.
• Command classified differently than you expected? Open the command in Analytics → Tool Use → Terminal Run — the family and risk score are shown on every entry.
• “Require Slack Approval” not prompting? Connect Slack under Settings → Integrations.