All policy settings at a glance

Everything on the Policy screen, with its default.
MCP
Setting
Default
Notes
MCP default action
Warn
Allow / Warn / Report / Block. Per-server rules override it
Require approval for new MCP servers
Off
Unreviewed servers get the pending action
Pending action
Warn
Applies only when approval is required
Local MCP decision cache
5 seconds
0–3600 seconds. 0 means ask every time
Risk
Setting
Default
AI risk classifier sensitivity
Medium
Secret scanning
Warn
Credentials in context
Report
Personal data (PII)
Report
Lethal-trifecta enforcement
Warn
Detected secrets are handled by their detector's action regardless of the sensitivity dial.
Data
Setting
Default
Notes
Prompt capture
Off
Redacted before storage; follows retention
Log retention
Set by support
Open a ticket to change it
Devices
Setting
Default
Notes
Idle timeout (hours)
Off
Blank disables
Max age (days)
Off
Blank disables
Ungoverned AI agents
Report it only
Report / Mark non-compliant / Block the device's access
Grace period (hours)
24
Blocking only. 0 blocks immediately
All of these take effect within about 30 seconds, like manual revocation. Blocking on an
ungoverned agent is the one setting here that can withdraw a developer's access without an
admin acting at the time — see Ungoverned-agent policy before changing it.
Per tool
Connection modes — subscription or managed API key, per tool. Cursor is locked to
managed.
Also on this screen
Per-server and per-tool MCP rules, real-time alert channels, the egress blocklist, and the
blocked-conversations list.