list_portal_users

What list_portal_users does on Businys

AI agents call list_portal_users to retrieve information from Businys without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_portal_users is rated Low

This tool performs a read-only operation—it queries and returns a list of portal users and their access timestamps. There are no side effects, no data modification, no execution of external operations, and no financial implications. The severity is low because listing user access data is a standard informational query with minimal blast radius even if misused by an AI agent.

From the tool's definition Tool name is 'list_portal_users' and description states it 'List clients who have been sent portal links, with their last access timestamp.' This is a query operation that retrieves and displays user access information without modifying, executing, or…

The rule that runs list_portal_users safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Businys, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_portal_users, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_portal_users": {}
  }
}

Questions about list_portal_users