cdp_create_selfservice_user

What cdp_create_selfservice_user does on CDP MCP Server

AI agents use cdp_create_selfservice_user to create or update resources in CDP MCP Server, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your CDP MCP Server environment.

Why cdp_create_selfservice_user is rated Medium

The tool creates new user accounts in the CDP system, which is a write operation that adds data to the system. While reversible (users can be deleted), it has high severity because creating unauthorized users could grant unintended access to the CDP platform, affecting administrative control and security posture. This is more severe than a typical data write due to the security implications of user account creation.

From the tool's definition Tool name contains 'create' and description states 'Create a new self-service user.' This creates a new user account, which is a reversible write operation that modifies system state by adding a new identity/principal.

The rule that runs cdp_create_selfservice_user safely

PolicyLayer is an MCP gateway: it sits between your AI agents and CDP MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For cdp_create_selfservice_user, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "cdp_create_selfservice_user": {
      "limits": [
        {
          "counter": "cdp_create_selfservice_user_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about cdp_create_selfservice_user