Home / Platform / Policy and governance
Platform · Governance
Nothing runs unless your policy says so.
Decide which teams and agents can use which tools, down to individual actions, and RimSift enforces it on every single call.
| Tool | Access | Rule |
|---|---|---|
crm.read_account | Allowed | All sales staff |
crm.export_contacts | Blocked | Not on the list |
email.send | Approval | External recipients |
files.delete | Blocked | Not on the list |
Illustrative interface
Default deny.
Tools not on the list are blocked. New tools need approval before anyone can use them, so access never grows quietly.
notion.search requested by EngineeringAwaiting approvalIllustrative interface
Tool sets for each team.
Engineering gets read access to code; finance doesn't see it at all. Agents only see the tools they're allowed to call, so they can't be tempted by the rest.
| Team | Tools visible to agents |
|---|---|
| Engineering | github, jira, docs |
| Sales | crm (read), email |
| Finance | erp, payments (approval) |
Illustrative interface
Limits on what a tool can do.
Restrict destinations, file paths and commands, not just tool names. Hold risky actions for a person to approve before they run.
Illustrative interface
What it protects against
Keep agents inside the lines you draw.
Maps to OWASP MCP Top 10: MCP02 privilege and scope creep, MCP05 command injection.
See every AI tool call your organisation makes.
A 30-minute demo with our engineers, on the AI tools you already use.