Salesforce policies

Policies (4)

salesforce · ingress

Salesforce Protect Contact Fields

Blocks Salesforce Contact updates that modify protected fields — ownership, account linkage, contact PII, name, and consent flags.

salesforce.ingress.protect_contact_fields

salesforce contacts pii access-control governance ingress

salesforce · ingress

Salesforce Query Allowlist

Restricts Salesforce SOQL queries so only Account, Contact, and Opportunity records can be retrieved.

salesforce.ingress.query_allowlist

salesforce access-control data-protection governance ingress

salesforce · ingress

Salesforce Read-Only Access

Restricts the Salesforce MCP server to read-only access.

salesforce.ingress.readonly

salesforce access-control governance read-only ingress

salesforce · egress

Salesforce Redact PII

Redacts personal contact information from Salesforce tool responses before they reach the caller.

salesforce.egress.pii_redaction

salesforce pii dlp redaction egress

About these policies

Reusable DTwo policies for Salesforce MCP servers (the Salesforce-hosted MCP server and compatible implementations).

Available policies

Policy	Direction	Purpose
protect-contact-fields	ingress	Deny Contact updates that modify protected fields (ownership, account linkage, PII, name, consent flags); other field updates and tools pass through.
query-allowlist	ingress	Restrict SOQL queries to Account, Contact, and Opportunity objects; other Salesforce tools and non-Salesforce tools pass through.
read-only	ingress	Allowlist Salesforce read tools and deny all writes (fail-closed); non-Salesforce tools pass through.
redact-pii	egress	Redact contact PII (email, phone, fax, mailing address, birthdate, SSN, card numbers) from Salesforce responses. Transform-only — never denies.

Tool naming on the DTwo gateway

DTwo prefixes tool names with the MCP server name configured on the gateway. A Salesforce MCP server registered as salesforce surfaces tools like salesforce-updatesobjectrecord, while one registered under another name would surface <name>-updatesobjectrecord. The policies in this directory match on the suffix (e.g. -updatesobjectrecord) so they stay portable across naming conventions. Always confirm the exact tool name your gateway sends using the dump-input debug technique before deploying.

Identity claims

These policies do not require any specific IdP claims. If you want identity-based exemptions (e.g., a break-glass role that can edit protected fields), gate the relevant rule with object.get(input.subject.claims, "<claim>", "<default>").

Contributing

To add a Salesforce policy:

Create apps/salesforce/<policy-slug>/ with policy.md and a tests.yaml test file.
Add a row to the table above.
Declare apps: ["salesforce"] in the policy frontmatter, plus any industry / bundle slugs that apply.
If the policy fits an industry or bundle (e.g. bundles/crm), link to it from the matching landing page.
Run pnpm manifest from the repo root.

See CONTRIBUTING.md for the full process.