user_set_password

What user_set_password does on Truenas

AI agents use user_set_password to create or update resources in Truenas, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Truenas environment.

Why user_set_password is rated Medium

This tool modifies user authentication credentials, which is a Write operation (reversible data modification). Severity is high because compromised password-setting capabilities could grant unauthorized access to TrueNAS accounts, though the operation itself is not destructive or financial. The confidence is high given the explicit nature of the tool name and description.

From the tool's definition Tool name 'user_set_password' and description 'Set or change a user' indicate modification of user account credentials. This is a write operation that creates or modifies data (password hashes/credentials) reversibly.

The rule that runs user_set_password safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Truenas, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For user_set_password, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "user_set_password": {
      "limits": [
        {
          "counter": "user_set_password_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about user_set_password