An MCP Policy decides which tools a member may use across your MCP Connections. Policies are attached to directory groups from your identity provider (SCIM), so adding someone to a group gives them its policies with no work in Oriant.
What a policy contains
- A risk level for every connection: Read only, Read and write, Everything, or Off.
- Levels per connection, which replace the base level on that connection.
- Tool exceptions: Allow or Block on one named tool. An exception beats the policy’s levels, Off included.
Risk levels use the labels the MCP server gives its own tools: Read, Write or Destructive. Oriant never labels a tool itself. A tool with no label is allowed only under Everything.
Presets
Oriant ships three presets: Read only, Read and write and Everything. Presets can’t be edited. Duplicate one to make your own policy.
How Oriant decides
Policies are kept in one order that you set. For each tool, the first applicable policy that says anything about it decides.
The Default policy sits at the bottom of the order. It applies to every member, including people in no directory group, and always has an answer.
No Role bypasses MCP Policies. Owners and Admins are governed like everyone else; their Permissions decide only who may edit policies.
What members see
Oriant hides tools a member may not use, so their AI client never lists them. A call to a blocked tool is refused, recorded with the policy that decided it, and never sent to the server.
Use View as to see exactly which tools one member gets on each connection. Last modified on November 9, 2026
