All policy settings at a glance

Everything on the Policy screen, with its default.

MCP

Setting	Default	Notes
MCP default action	ReportWarn	Allow / Warn / Report / Block. Per-server rules override it
Require approval for new MCP servers	Off	Unreviewed servers get the pending action
Pending action	—Warn	Applies only when approval is required
Local MCP decision cache	Minutes5 seconds	0–3600 seconds. 0 means ask every time

Risk

Setting	Default
AI risk classifier sensitivity	Medium
Secret scanning	Warn
Credentials in context	Report
Personal data (PII)	Report
Lethal-trifecta enforcement	Warn

Detected secrets are handled by their detector's action regardless of the sensitivity dial.

Data

Setting	Default	Notes
Prompt capture	Off	Redacted before storage; follows retention
Log retention	Set by support	Open a ticket to change it

Devices

Setting	Default	Notes
Idle timeout (hours)	Off	Blank disables
Max age (days)	Off	Blank disables

Ungoverned AI agents Report it only Report / Mark non-compliant / Block the device's access Grace period (hours) 24 Blocking only. 0 blocks immediately

BothAll of these take effect within about 30 seconds, like manual revocation. Blocking on an ungoverned agent is the one setting here that can withdraw a developer's access without an admin acting at the time — see Ungoverned-agent policy before changing it.

Per tool

Connection modes — subscription or managed API key, per tool. Cursor is locked to managed.

Also on this screen

Per-server and per-tool MCP rules, real-time alert channels, the egress blocklist, and the blocked-conversations list.