Where your policies are enforced
| Agent | Prompts | Terminal | Native tools | MCP | Data | ||||
|---|---|---|---|---|---|---|---|---|---|
| Read | Write | Edit | Delete | Search | |||||
| Claude Code | |||||||||
| Claude Cowork | |||||||||
| Cursor | — | — | |||||||
| Codex | — | — | — | — | |||||
| GitHub Copilot | — | — | |||||||
| Augment Code | — | — | |||||||
Prompts means the prompt is captured and shown in activity. Data means secrets and personal data — an API key, a credential, personal information. On the agents ticked for it, a prompt carrying one is refused before the turn starts. To control what an agent does, use a terminal, native-tool or MCP rule.
The shell is covered on every agent here. A delete rule stops Claude Code deleting through its own tool and through the shell; on Codex it catches the shell route alone, because Codex has no delete tool.
The action you choose changes the reach. On Block, Warn and Require Slack Approval, a file rule — read, write or delete — covers both the agent’s own tool and the shell. An Audit rule reaches the shell only, so pair it with a live rule on the same family when you need both.
Tool Policies has the families, and when to reach for a Custom pattern instead.
How MCP rules identify a server
An MCP rule matches on the server being called, and most agents name it in the call. On GitHub Copilot and Augment Code, a rule matches a server present in that agent’s own configuration on the machine; a server missing from it is recorded rather than matched. On Claude Cowork, rules match the servers you add; Cowork’s own built-in tools are part of the app rather than servers you configure.Listing an agent’s MCP servers and matching an MCP call are separate things. Discovery reads an agent’s configuration to inventory its servers; the MCP column is about the moment a call is made.
What Warn looks like on each agent
A warning is always recorded, on every agent. What the developer sees depends on what the agent can show:
On a headless Claude Code run — in CI, or through the Agent SDK — there is nobody to prompt, so the action runs unless your organization sets headless warnings to block.
Use Block where an action must not happen, and Require Slack Approval where a person should decide. On Augment Code, use Block for both — it has no way to hold an action open while someone answers.
Agents pointed at Unbound as a provider
Roo Code, Cline, Kilo Code, Gemini CLI and any OpenAI-compatible client connect differently: you point them at Unbound with an API key instead of installing anything alongside them. Their traffic is recorded and their spend is metered. Tool policies do not apply to them — those need one of the agents in the table above.Discovered, not yet enforced
Unbound detects these agents. Tool policies do not apply to them yet.Enforcing on one of these today
Policies are not tied to a particular agent. A rule matches on what the call is, not on which agent made it — so an agent that reports its tool calls to Unbound gets real decisions back today through the hooks API. All three expose a way to hook in. What you take on:- You write and maintain the client, including the part that turns a refusal into that agent’s own way of stopping. We publish the contract, not an installer.
- Terminal and MCP rules work. File-tool rules do not — those reach an agent’s built-in tools only for the agents in the table above. Write against the shell.
- Warn needs a confirmation step of your own. Until you build one, use Block.
- Budgets and spend limits do not apply.
If a device cannot reach Unbound, work continues by default — a check that cannot run does not stop the developer. Your organization can require the opposite, so an unreachable check blocks instead. See Settings.