GetUserRoles

What GetUserRoles does on Veeam VBR v13 MCP Server

AI agents call GetUserRoles to retrieve information from Veeam VBR v13 MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why GetUserRoles is rated Low

This is a pure read operation that queries user or group role assignments. It retrieves information about permissions/roles already assigned but does not create, modify, delete, or execute any operations. The blast radius of misuse is low—an agent obtaining role information could inform reconnaissance but cannot directly change system state or cause destructive outcomes. It belongs in the Read category.

From the tool's definition Tool name 'GetUserRoles' and description 'Get roles assigned to a specific user or group' indicate a query operation that retrieves existing role assignment data without modification or side effects.

The rule that runs GetUserRoles safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Veeam VBR v13 MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For GetUserRoles, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "GetUserRoles": {}
  }
}

Questions about GetUserRoles