# gmail_users_settings_cse_identities_create

Create a client-side encryption identity

Agent View of the PolicyLayer registry record for `gmail_users_settings_cse_identities_create`. HTML page: https://policylayer.com/tools/google-workspace-gmail/gmail-users-settings-cse-identities-create

## Facts

- Tool: `gmail_users_settings_cse_identities_create`
- Server: Google Workspace Gmail (gws CLI) (`@gws mcp -s gmail`) — https://policylayer.com/tools/google-workspace-gmail.md
- Install: `npx -y @gws mcp -s gmail`
- Homepage: https://www.npmjs.com/package/@gws mcp -s gmail
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "gmail_users_settings_cse_identities_create",
    "arguments": {}
  }
}
```

## Why gmail_users_settings_cse_identities_create is rated Medium

This tool creates a new CSE (Client-Side Encryption) identity, which is a write operation that modifies Gmail's encryption settings by adding a new identity. While reversible (can be deleted), it affects security-sensitive configuration. Medium severity reflects that misuse could create unwanted encryption identities or expose key material, but the blast radius is limited to the user's own account settings.

From the tool's own definition: "Tool name contains 'create'; description states 'Create a client-side encryption identity', which is a reversible operation that generates a new CSE identity configuration without deleting or executing arbitrary code."

Risk signals: Creates encryption identities

## Use case

AI agents use gmail_users_settings_cse_identities_create to create or update resources in Google Workspace Gmail (gws CLI), usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Google Workspace Gmail (gws CLI) environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Google Workspace Gmail (gws CLI):

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "gmail_users_settings_cse_identities_create": {
      "limits": [
        {
          "counter": "gmail_users_settings_cse_identities_create_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Google Workspace Gmail (gws CLI) (78)

- `gmail_users_drafts_delete` — Destructive — https://policylayer.com/tools/google-workspace-gmail/gmail-users-drafts-delete.md
- `gmail_users_labels_delete` — Destructive — https://policylayer.com/tools/google-workspace-gmail/gmail-users-labels-delete.md
- `gmail_users_messages_batchDelete` — Destructive — https://policylayer.com/tools/google-workspace-gmail/gmail-users-messages-batchdelete.md
- `gmail_users_messages_delete` — Destructive — https://policylayer.com/tools/google-workspace-gmail/gmail-users-messages-delete.md
- `gmail_users_settings_cse_identities_delete` — Destructive — https://policylayer.com/tools/google-workspace-gmail/gmail-users-settings-cse-identities-delete.md
- `gmail_users_settings_cse_keypairs_obliterate` — Destructive — https://policylayer.com/tools/google-workspace-gmail/gmail-users-settings-cse-keypairs-obliterate.md
- `gmail_users_settings_delegates_delete` — Destructive — https://policylayer.com/tools/google-workspace-gmail/gmail-users-settings-delegates-delete.md
- `gmail_users_settings_filters_delete` — Destructive — https://policylayer.com/tools/google-workspace-gmail/gmail-users-settings-filters-delete.md
- `gmail_users_settings_forwardingAddresses_delete` — Destructive — https://policylayer.com/tools/google-workspace-gmail/gmail-users-settings-forwardingaddresses-delete.md
- `gmail_users_settings_sendAs_delete` — Destructive — https://policylayer.com/tools/google-workspace-gmail/gmail-users-settings-sendas-delete.md
- `gmail_users_settings_sendAs_smimeInfo_delete` — Destructive — https://policylayer.com/tools/google-workspace-gmail/gmail-users-settings-sendas-smimeinfo-delete.md
- `gmail_users_threads_delete` — Destructive — https://policylayer.com/tools/google-workspace-gmail/gmail-users-threads-delete.md
- `gmail_users_messages_send` — Execute — https://policylayer.com/tools/google-workspace-gmail/gmail-users-messages-send.md
- `gmail_users_drafts_get` — Read — https://policylayer.com/tools/google-workspace-gmail/gmail-users-drafts-get.md
- `gmail_users_drafts_list` — Read — https://policylayer.com/tools/google-workspace-gmail/gmail-users-drafts-list.md
- `gmail_users_getProfile` — Read — https://policylayer.com/tools/google-workspace-gmail/gmail-users-getprofile.md
- `gmail_users_history_list` — Read — https://policylayer.com/tools/google-workspace-gmail/gmail-users-history-list.md
- `gmail_users_labels_get` — Read — https://policylayer.com/tools/google-workspace-gmail/gmail-users-labels-get.md
- `gmail_users_labels_list` — Read — https://policylayer.com/tools/google-workspace-gmail/gmail-users-labels-list.md
- `gmail_users_messages_attachments_get` — Read — https://policylayer.com/tools/google-workspace-gmail/gmail-users-messages-attachments-get.md
- `gmail_users_messages_get` — Read — https://policylayer.com/tools/google-workspace-gmail/gmail-users-messages-get.md
- `gmail_users_messages_list` — Read — https://policylayer.com/tools/google-workspace-gmail/gmail-users-messages-list.md
- `gmail_users_settings_cse_identities_get` — Read — https://policylayer.com/tools/google-workspace-gmail/gmail-users-settings-cse-identities-get.md
- `gmail_users_settings_cse_identities_list` — Read — https://policylayer.com/tools/google-workspace-gmail/gmail-users-settings-cse-identities-list.md
- `gmail_users_settings_cse_keypairs_get` — Read — https://policylayer.com/tools/google-workspace-gmail/gmail-users-settings-cse-keypairs-get.md
- `gmail_users_settings_cse_keypairs_list` — Read — https://policylayer.com/tools/google-workspace-gmail/gmail-users-settings-cse-keypairs-list.md
- `gmail_users_settings_delegates_get` — Read — https://policylayer.com/tools/google-workspace-gmail/gmail-users-settings-delegates-get.md
- `gmail_users_settings_delegates_list` — Read — https://policylayer.com/tools/google-workspace-gmail/gmail-users-settings-delegates-list.md
- `gmail_users_settings_filters_get` — Read — https://policylayer.com/tools/google-workspace-gmail/gmail-users-settings-filters-get.md
- `gmail_users_settings_filters_list` — Read — https://policylayer.com/tools/google-workspace-gmail/gmail-users-settings-filters-list.md
- …and 48 more: https://policylayer.com/tools/google-workspace-gmail.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=google-workspace-gmail · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/google-workspace-gmail