Data Exposure Policy
The Policy tab adds a second layer of control on top of the
catalog: even when a tool’s SQL selects a column, policy can drop or
mask it from the result before Claude sees it. Policy is applied on the MCP execute path — the
same place the audit entry is written — and any dropped or masked columns are recorded in that
entry’s redacted_columns.
How it works
The tab shows your schema as a tree — schemas, tables, columns — with an Allow / Deny / Mask toggle on each node and a Default mode toggle at the top. Nodes without an explicit setting show what they inherit; a “Clear override” button resets any node back to inheriting.
- Allow — the column passes through untouched.
- Deny — the column is dropped from results.
- Mask (columns only) — the column stays but its values are transformed:
| Strategy | Example output |
|---|---|
| Redact | [REDACTED] |
| Hash | a1b2c3d4 |
| Email domain | ***@example.com |
| Last four | ******1234 |
| First char | J*** |
| Null | null |
The default policy is Allow — out of the box, nothing is restricted. Flipping Default mode to Deny inverts that: only columns you explicitly allow pass through.
An honest caveat about scope
On the MCP execute path, AccessVault currently identifies result columns by column name only — the executed query isn’t mapped back to specific schemas and tables. In practice:
- Column rules and the Default mode work on every MCP result: a rule on a column named
emailapplies to any result column namedemail, whichever table it came from. - Schema- and table-level settings do not currently take effect on the MCP path. They exist in the tree (and set expectations for future releases), but don’t rely on them to gate AI access per-table today. To restrict what the AI can reach per-table, control it where it’s structural: don’t enable catalog tools that touch those tables, and use a least-privilege database role.
The tab shows a warning to the same effect when Default mode is Deny: discovery is column-name only, and joined queries fall back to the default column behavior.
Recommendations
- Add Mask rules for the usual suspects by column name:
email,phone,ssn,card_number,password_hash— they’ll catch those columns in every tool’s results. - Prefer Deny for columns the AI never needs; masked values still leak shape (length, presence).
- Remember the layering: catalog controls which queries run, policy controls which columns come back, and the audit log records both.