configure_privacy_retention · ComplyOS MCP: Risk & Policy

WHAT IT DOES

What configure_privacy_retention does on ComplyOS

AI agents use configure_privacy_retention to create or update resources in ComplyOS — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your ComplyOS environment.

WHY IT NEEDS A POLICY

Why configure_privacy_retention needs a policy

This tool modifies privacy retention settings, which are configurations that affect how long evidence and data are kept. While reversible (can be reconfigured), it impacts compliance posture and data lifecycle management across the tenant. Severity is high because misconfiguration could expose the organization to compliance violations, data breaches, or regulatory penalties.

From the tool's definition Tool name 'configure_privacy_retention' combined with description 'Configure tenant retention settings for privacy program evidence' indicates modification of data retention policies.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

configure_privacy_retention Rate-limited

configure_privacy_retention stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "configure_privacy_retention": {
      "limits": [
        {
          "counter": "configure_privacy_retention_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches ComplyOS, so you can run agents against it safely.

FAQ

Questions about configure_privacy_retention

What does the configure_privacy_retention tool do? +

Configure tenant retention settings for privacy program evidence. It is categorised as a Write tool in the ComplyOS MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on configure_privacy_retention? +

Register the ComplyOS MCP server in PolicyLayer and add a rule for configure_privacy_retention: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches ComplyOS. Nothing to install.

What risk level is configure_privacy_retention? +

configure_privacy_retention is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit configure_privacy_retention? +

Yes. Add a rate_limit block to the configure_privacy_retention rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block configure_privacy_retention completely? +

Set action: deny in the PolicyLayer policy for configure_privacy_retention. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides configure_privacy_retention? +

configure_privacy_retention is provided by the ComplyOS MCP server (simongonzalezdc/complyos). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.