Create Allow and Deny rules on the MCP governance tab of an AI Agent asset page, to control which MCP tools the AI agent can use. A rule has an effect (Allow or Deny) and can match the metadata of a tool, for example its access type or surface. You can also apply a rule to one specific tool. An AI agent can have up to 500 rules.
To see the tools that the AI agent can call, go to Choose the tools an AI agent can use.
Prerequisites
- MCP governance is enabled.
- You have registered the MCP servers that the AI agent uses, and the AI agent can call tools of them.
- You have a resource role with the Asset > Update resource permission on the AI Agent asset. Without it, the Create rule button, the Enable and Disable buttons, and the edit and delete icons are hidden. No global permission is required.
Create a rule
- Open the AI Agent asset page, and click the MCP governance tab.
- Click Rules, and then click Create rule.
The Create rule dialog box opens. - Enter the required information.
Field Description Name The name of the rule. This field is required. The name must be unique for the AI agent, can have up to 100 characters, and can contain only letters, numbers, periods, underscores, and hyphens. Effect What the rule does when it matches a tool request:
- Allow (default): The request is allowed.
- Deny: The request is blocked. A Deny rule takes precedence over all other rules.
If no rule matches a tool, the request is blocked.
Metadata The conditions that a tool must meet for the rule to apply. Click Add metadata, and then enter a key and a value for each condition. You can use any key and value, up to 20 keys per rule, and each key once. Keys and values must match exactly, including uppercase and lowercase letters. For example, a rule that denies all tools that write data matches tools whose access type is write.
A rule applies to a tool only if the tool meets all of the conditions.
Tool Optionally, select a specific tool to apply the rule to. For example, to block a tool for this AI agent, create a Deny rule for that tool. A rule needs a tool, metadata, or both. Enable rule Switched on by default. Switch it off to create the rule without applying it yet. - Click Create.
The rule is added to the Rules table, which shows the rule name, effect, condition (the tool and the metadata as key and value pairs), and status.
Edit, enable, disable, or delete rules
In the Rules table on the MCP governance tab, do one of the following:
- To edit a rule, click
at the end of its row. - To delete a rule, click the trash icon at the end of its row, and then confirm the deletion.
- To enable or disable rules, select one or more rows, and then click Enable or Disable. A disabled rule isn't applied.
Rules must be compiled and published before the Agent Gateway uses them.