create_firewall_policy

What create_firewall_policy does on Fortimanager

AI agents use create_firewall_policy to create or update resources in Fortimanager, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Fortimanager environment.

Why create_firewall_policy is rated Medium

The tool creates firewall policies, which is a reversible write operation that changes security posture and network routing behavior. While not destructive (policies can be deleted/modified), and not immediately financial, misconfiguration could disrupt network traffic or expose systems. Severity is high due to potential for widespread network impact if an AI agent creates overly permissive or incorrect policies.

From the tool's definition Tool name 'create_firewall_policy' indicates creation of firewall policies. Related sibling tools include 'add_policies_to_block', 'add_device_to_group', 'add_interface_to_zone', and other network configuration operations, confirming this server manages…

The rule that runs create_firewall_policy safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Fortimanager, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For create_firewall_policy, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "create_firewall_policy": {
      "limits": [
        {
          "counter": "create_firewall_policy_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about create_firewall_policy