gmail_users_settings_cse_keypairs_create

What gmail_users_settings_cse_keypairs_create does on Google Workspace Gmail (gws CLI)

AI agents use gmail_users_settings_cse_keypairs_create to create or update resources in Google Workspace Gmail (gws CLI), usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Google Workspace Gmail (gws CLI) environment.

Why gmail_users_settings_cse_keypairs_create is rated Medium

This tool creates and uploads cryptographic keypairs used for Client-Side Encryption in Gmail. While it is a write operation (creating new security material), the severity is high because misuse could result in creation of unauthorized encryption keys that could compromise email security or lock legitimate users out of accessing their encrypted messages.

From the tool's definition Tool name contains 'create' and description states 'Create and upload a CSE keypair'. CSE (Client-Side Encryption) keypairs are security credentials used to encrypt email data in Gmail.

Risk signalsCreates encryption keypairs

The rule that runs gmail_users_settings_cse_keypairs_create safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Google Workspace Gmail (gws CLI), and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For gmail_users_settings_cse_keypairs_create, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "gmail_users_settings_cse_keypairs_create": {
      "limits": [
        {
          "counter": "gmail_users_settings_cse_keypairs_create_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about gmail_users_settings_cse_keypairs_create