list_policy_exceptions

What list_policy_exceptions does on ServiceNow-MCP

AI agents call list_policy_exceptions to retrieve information from ServiceNow-MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_policy_exceptions is rated Low

This tool retrieves and filters existing policy exception records from ServiceNow's compliance module. It performs a read-only query operation with no side effects, no data modification, no code execution, and no destructive actions. The blast radius of misuse is minimal—an attacker could enumerate policy exceptions to understand compliance posture, but cannot modify or delete records through this tool alone.

From the tool's definition Tool is named 'list_policy_exceptions' and explicitly described as 'List' with ability to 'Filter by state'. The action is a query/retrieval operation with no modification or execution capabilities.

The rule that runs list_policy_exceptions safely

PolicyLayer is an MCP gateway: it sits between your AI agents and ServiceNow-MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_policy_exceptions, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_policy_exceptions": {}
  }
}

Questions about list_policy_exceptions