Tool Policies

​

What are Tool Policies?

Tool Policies allow you to monitor and control actions taken by AI coding tools in your organization. Create policies to track, warn on, or block terminal commands executed by AI agents or MCP tool calls made through integrated servers like GitHub, Linear, Sentry, and more. Gateway URL: https://gateway.getunbound.ai/policies/tool-policies

​

Policy Types

When you click Create Policy, you’ll be asked to choose what you want to monitor:

​

Terminal Commands

Monitor shell commands executed by AI coding tools like Claude Code, Cursor, Roo Code, and Cline.

• Select a Command Family (e.g., delete_file, git_action, remote_access)
• Set Match Against to the command field you want to inspect (e.g., path, branch, or Any)
• Define a Pattern to match specific paths, branches, or operations
• Supports exact match, glob patterns (/etc/*), and regex (.*\.env$)

Natural language rules: Instead of a command family and pattern, you can describe the policy in plain English — for example, “block any command that writes to the production database.” Unbound evaluates these via LLM, so policy authoring doesn’t require knowledge of specific command family names.

​

MCP Actions

Monitor tool calls made through MCP (Model Context Protocol) servers.

• Select an MCP Service — a canonical service such as GitHub, Linear, or Slack. This is the required first field (“Select a service…”). Picking a service applies the policy across every connected MCP server that maps to it, so you don’t name individual server instances.
• Select one or more MCP Tools to monitor (e.g., create_pull_request, create_issue). A service and at least one tool are both required.

Each MCP tool call also carries an action type — read, write, or destructive. Action type, and targeting one specific raw server instance instead of the canonical service, are available only through the policy API — the create-policy modal always targets a canonical MCP Service and its tools.

​

Unsanctioned MCP servers

The policies above target servers you know about. Developers also connect servers you don’t — that’s where a task quietly becomes an exfiltration path. Mark the servers you approve of as sanctioned, and Unbound governs everything else as a group. You choose how, org-wide: Start on Warn to see what your developers are actually reaching for without breaking their work, then move to Block once you’ve sanctioned the servers you’re happy with.

​

Actions

Each tool policy has an action that determines what happens when a match is found:

​

Applying to Users

By default, a tool policy with no user groups applies to everyone in your organization. To restrict a policy to specific teams, assign it to one or more user groups during creation or editing.

• No user groups selected — The policy applies organization-wide
• User groups selected — The policy applies only to members of those groups
• When a user group is modified, policy enforcement updates automatically for all affected users

​

Policy Coverage

The Policy Health view in the Tool Policies dashboard shows which command families and MCP tool categories have no active policies — coverage gaps where agent actions are completely unmonitored. Open the Policy Health tab, then switch between the Terminal and MCP sub-views to see coverage for each.

​

Risk-score policies

Every terminal command match carries a per-match risk score derived from its classification. A Risk Score policy applies its action whenever a command’s score meets or exceeds a configured risk_score_threshold, independent of any specific command family.

• risk_score_threshold is an integer from 1–10.
• A lower threshold fires the action on more command matches; a higher threshold reserves it for the highest-risk commands.

Risk Score policies are their own policy type — they don’t carry a command family or pattern — and are created through the policy API; risk_score_threshold is returned in the policy API response.

​

Policy Recommendations

The dashboard proactively surfaces policy suggestions based on observed agent activity. Each recommendation identifies either a complete gap (no policy covers this command or tool type at all) or a partial gap (a policy exists but doesn’t match all observed variants). Recommendations appear automatically as your agents run. You can create the suggested policy directly from the recommendation card, or dismiss it.

​

Quick Example

Let’s create a policy to audit when AI tools delete files in sensitive directories:

1. Go to Tool Policies and click Create Policy
2. Select Terminal Commands
3. Fill in the form:
   • Name: “Audit Sensitive File Deletions”
   • Command Family: delete_file
   • Match Against: path
   • Pattern: /etc/* or *.env
4. Set Action to Audit
5. Optionally select User Groups to limit the policy to specific teams
6. Click Preview Impact to see historical matches
7. Click Create Policy

​

Tool Policies vs Security Policies

Tool policies and security policies serve different purposes and are managed independently: