Policy is not doing what I expect

An MCP server is blocked that I allowed

Check the precedence. A per-tool rule beats a per-server rule. If you allowed the server but blocked one of its tools, that tool stays blocked.

Also: when a single request names several MCP servers, the most restrictive decision applies to the whole request. The Gateway cannot partially block one API call. One blocked server in the set blocks it all.

A server I never approved is working

Approval only applies if Require approval for new MCP servers is on. Without it, the tenant default applies — and if that is Allow, everything works.

Remember that "reviewed" means any explicit rule. There is no separate approve action.

Nothing is being blocked at all

Check the detector actions on Policy → Risk detectors. The defaults are mild by design: secrets warn, credentials and personal data report, lethal-trifecta warns. Report means recorded and not interrupted.

Filter Activity by Risk events to confirm the detectors are firing — if findings appear but nothing is blocked, the detectors are working and the actions are set to observe.

Too much is being blocked

Usually the classifier sensitivity is one step too high. Move High to Medium. The clearest cases are caught at every setting; High mostly adds the ambiguous ones.

Check Blocked conversations at the bottom of Policy — you can unblock individually.

A policy change has not taken effect on a developer's machine

Local MCP decisions are cached for as long as Policy → Local MCP decision cache allows. Set it to 0 while you are actively tuning, then put it back.