Step 2: Configure resource access

Step 2 changes according to the Resource Type selected in Step 1. Configure the actions that should be allowed, denied, or sent for approval, along with any additional controls available for that resource type.

MCP Policy

MCP Policies control agent access to tools exposed by MCP servers.
Configure MCP Access
  1. Select an MCP server from the available server list.
  2. Review the tools exposed by the selected server.
  3. Select the tools the policy should govern.
  4. Set each selected tool to Allow, Deny, or Require Approval.
  5. Repeat the configuration for additional MCP servers as required.
  6. If any tool requires approval, select the HITL App that should receive the approval request.
The configuration summary shows the number of servers configured, total tools, and the count of tools assigned to each policy decision. Bulk selection can be used when the same outcome should be applied to multiple tools.

File Policy

File Policies control agent access to files and can also apply additional data-protection checks.
Configure File Access
Configure file names under the three policy outcomes:
  • Allowed Files - files the agent is permitted to access.
  • Denied Files - files the agent is prevented from accessing.
  • Require Approval Files - files that require a human decision before access proceeds.
Threat Feed Validation

Checks files accessed by an agent for sensitive information, such as exposed secrets. If sensitive information is detected, the agent is blocked from accessing the file.

Data Classification

File Policies can also block access based on data classifications obtained from a configured Data Loss Prevention (DLP) integration. Enable Data classification to be blocked and select the classifications that should be prevented from agent access.

For example, if the connected DLP integration provides classifications such as Public, General, Personal, and Confidential, an administrator can select the classifications that should be blocked for the policy.

Package Policy

Package Policies control package installation by agents.

Configure Package Installation

Package rules can be added under Allowed Packages, Denied Packages, and Require Approval Packages. For each rule, configure the package name and, when required, a version condition.
Field Description
Package name The package to which the rule applies.
Version operator Choose ==, !=, >, >=, <, or <=.
Version Specify the version, or the version values supported by the configuration.
Threat Feed Validation

Checks packages that an agent attempts to install for known vulnerabilities using OSV. If a vulnerability is identified, the package installation is blocked.

Web Policy

Web Policies control agent access to web destinations.
Configure Web Access
  • Allowed URLs - web destinations the agent is permitted to access.
  • Denied URLs - web destinations the agent is prevented from accessing.
  • Require Approval URLs - web destinations that require human approval before access proceeds.
For each rule, specify the URL that the policy should evaluate.

Terminal Policy

Terminal policies controls terminal commands executed by agents using regular expression patterns for allowed, denied, and approval-required commands.
Fields Purpose
Allowed Commands Regular-expression patterns for commands the agent is permitted to execute.
Denied Commands Regular-expression patterns for commands that must be blocked.
Require Approval Commands Patterns that pause execution until a human approval decision is received.
HITL App Select the Human-in-the-Loop integration when Require Approval commands are configured.
Threat Feed Validation

Detects potentially destructive or risky terminal commands, such as rm -rf, process termination commands, or chmod 777. When detected, an event is generated in Event Logs with a risk level based on the type and severity of the command. Critical commands generate events with Critical severity.

Version Control System Policy

Version Control System Policies control how agents access Git repositories and branches. They are separate from Terminal Policies: Terminal controls command execution, while Version Control System policies govern repository and branch access.
Policy Mode Behavior
Allow all except blocked repositories Repositories are allowed unless a matching rule blocks access or requires approval.
Allow only approved repositories Repository access is denied unless it matches an approved rule; additional rules can block or require approval for specific access.

Configure Repository Access

Configure repository URLs and, when required, branch names. The available rule sections depend on the selected Policy Mode.
Allow all except blocked repositories
  • Denied Repositories - block Git operations for the configured repository and branches.
  • Require Approval Repositories - require a human decision before the matching Git operation proceeds.
Allow only approved repositories
  • Exclusively Allowed Repositories - define repositories that the agent may access.
  • Blocked Repositories - deny specific repository or branch access within the allowed scope.
  • Require Approval Repositories - require approval for selected repository or branch access.
When Require Approval rules are configured, select a HITL App.

AI Usage Policy

AI Usage Policies set usage limits for supported coding agents. Where available, they can enforce daily or monthly caps based on token consumption or cost.
AI Usage is platform-specific. In the current product guidance, this resource type is available for Claude Code. Configure the applicable usage cap and period. When the configured limit is exceeded, further usage is denied according to the policy.
Note: AI Usage policies do not use Human-in-the-Loop approval and do not use the standard enforcement schedule described for the other resource types.

Human Approval

Human Approval provides a controlled path for sensitive agent actions that should not be automatically allowed or denied. When a matching rule is configured as Require Approval, Agent Identity Security pauses the action and routes an approval request through the selected HITL App.
The action proceeds or remains blocked based on the approval decision. HITL App becomes relevant only when at least one Require Approval rule is configured.
Note: MCP, File, Package, Web, Terminal, and Version Control System policies when Require Approval is used. It does not apply to AI Usage policies.
What's next: With the resource access rules in place, proceed to Review and Create the Policy to verify the complete configuration before the policy goes live.