> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oriant.app/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Policies

> Decide which MCP tools each person may use, by directory group, risk level and named tool.

An **MCP Policy** decides which tools a member may use across your MCP Connections. Policies are attached to directory groups from your identity provider (SCIM), so adding someone to a group gives them its policies with no work in Oriant.

## What a policy contains

* **A risk level for every connection**: Read only, Read and write, Everything, or Off.
* **Levels per connection**, which replace the base level on that connection.
* **Tool exceptions**: Allow or Block on one named tool. An exception beats the policy's levels, Off included.

Risk levels use the labels the MCP server gives its own tools: Read, Write or Destructive. Oriant never labels a tool itself. A tool with no label is allowed only under Everything.

## Presets

Oriant ships three presets: **Read only**, **Read and write** and **Everything**. Presets can't be edited. Duplicate one to make your own policy.

## How Oriant decides

Policies are kept in one order that you set. For each tool, the first applicable policy that says anything about it decides.

The **Default policy** sits at the bottom of the order. It applies to every member, including people in no directory group, and always has an answer.

No Role bypasses MCP Policies. Owners and Admins are governed like everyone else; their Permissions decide only who may edit policies.

## What members see

Oriant hides tools a member may not use, so their AI client never lists them. A call to a blocked tool is refused, recorded with the policy that decided it, and never sent to the server.

Use **View as** to see exactly which tools one member gets on each connection.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.