# snow_create_data_policy_rule Add a field rule to an existing Data Policy: mark the field as mandatory and/or read-only when the parent policy Agent View of the PolicyLayer registry record for `snow_create_data_policy_rule`. HTML page: https://policylayer.com/tools/serac/snow-create-data-policy-rule ## Facts - Tool: `snow_create_data_policy_rule` - Server: Serac (`serac-labs/serac`) — https://policylayer.com/tools/serac.md - Homepage: https://github.com/serac-labs/serac - Risk category: Write (Medium risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 0 - Recommended policy verdict: Rate-limited ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "snow_create_data_policy_rule", "arguments": {} } } ``` ## Why snow_create_data_policy_rule is rated Medium This tool creates or adds new field rules to existing ServiceNow Data Policies, which modifies system configuration. It is not immediately destructive (the rule can be removed), but carries high severity due to the blast radius: a misconfigured data policy rule could inadvertently restrict access, make critical fields read-only, or enforce mandatory constraints across the enterprise, affecting many users and… From the tool's own definition: "Tool name includes 'create' and description states 'Add a field rule to an existing Data Policy' — this creates or modifies a policy rule within ServiceNow. The action is reversible (rules can be removed/edited later), making it Write rather than Destructive." ## Use case AI agents use snow_create_data_policy_rule to create or update resources in Serac, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Serac environment. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Serac: ```json { "version": "1", "default": "deny", "tools": { "snow_create_data_policy_rule": { "limits": [ { "counter": "snow_create_data_policy_rule_rate", "window": "minute", "max": 30, "scope": "grant" } ] } } } ``` ## Other tools on Serac (431) - `snow_cleanup_test_artifacts` — Destructive — https://policylayer.com/tools/serac/snow-cleanup-test-artifacts.md - `snow_delete_attachment` — Destructive — https://policylayer.com/tools/serac/snow-delete-attachment.md - `snow_inbound_email_action` — Destructive — https://policylayer.com/tools/serac/snow-inbound-email-action.md - `snow_pa_indicator_manage` — Destructive — https://policylayer.com/tools/serac/snow-pa-indicator-manage.md - `snow_rollback_deployment` — Destructive — https://policylayer.com/tools/serac/snow-rollback-deployment.md - `snow_workflow_transition` — Destructive — https://policylayer.com/tools/serac/snow-workflow-transition.md - `enterprise_tool_execute` — Execute — https://policylayer.com/tools/serac/enterprise-tool-execute.md - `snow_auto_resolve_incident` — Execute — https://policylayer.com/tools/serac/snow-auto-resolve-incident.md - `snow_automate_threat_response` — Execute — https://policylayer.com/tools/serac/snow-automate-threat-response.md - `snow_batch_request` — Execute — https://policylayer.com/tools/serac/snow-batch-request.md - `snow_change_manage` — Execute — https://policylayer.com/tools/serac/snow-change-manage.md - `snow_cicd_deploy` — Execute — https://policylayer.com/tools/serac/snow-cicd-deploy.md - `snow_collect_metric` — Execute — https://policylayer.com/tools/serac/snow-collect-metric.md - `snow_confirm_script_execution` — Execute — https://policylayer.com/tools/serac/snow-confirm-script-execution.md - `snow_convert_es6_to_es5` — Execute — https://policylayer.com/tools/serac/snow-convert-es6-to-es5.md - `snow_convert_to_es5` — Execute — https://policylayer.com/tools/serac/snow-convert-to-es5.md - `snow_create_mobile_action` — Execute — https://policylayer.com/tools/serac/snow-create-mobile-action.md - `snow_create_vulnerability_scan` — Execute — https://policylayer.com/tools/serac/snow-create-vulnerability-scan.md - `snow_custom_api` — Execute — https://policylayer.com/tools/serac/snow-custom-api.md - `snow_elevate_role` — Execute — https://policylayer.com/tools/serac/snow-elevate-role.md - `snow_employee_offboarding` — Execute — https://policylayer.com/tools/serac/snow-employee-offboarding.md - `snow_employee_onboarding` — Execute — https://policylayer.com/tools/serac/snow-employee-onboarding.md - `snow_execute_atf_test` — Execute — https://policylayer.com/tools/serac/snow-execute-atf-test.md - `snow_execute_script` — Execute — https://policylayer.com/tools/serac/snow-execute-script.md - `snow_execute_security_playbook` — Execute — https://policylayer.com/tools/serac/snow-execute-security-playbook.md - `snow_execute_transform` — Execute — https://policylayer.com/tools/serac/snow-execute-transform.md - `snow_fluent_build` — Execute — https://policylayer.com/tools/serac/snow-fluent-build.md - `snow_fluent_install` — Execute — https://policylayer.com/tools/serac/snow-fluent-install.md - `snow_fluent_transform` — Execute — https://policylayer.com/tools/serac/snow-fluent-transform.md - `snow_github_deploy` — Execute — https://policylayer.com/tools/serac/snow-github-deploy.md - …and 401 more: https://policylayer.com/tools/serac.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=serac · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/serac