Rego Policy on Every Tool Call

# mcp-tool-policy.rego
package securix.mcp

default allow_tool_call = false
default allow_tool_response = false

# Allow Gmail reads for authenticated employees
allow_tool_call {
    input.tool == "gmail.list_messages"
    input.user.role in ["employee", "manager"]
}

# Block Gmail send for non-managers
deny_tool_call[msg] {
    input.tool == "gmail.send_message"
    input.user.role != "manager"
    msg := "Gmail send requires manager role"
}

# Block tool responses containing credit card patterns
allow_tool_response {
    not response_contains_pii
}
response_contains_pii {
    regex.match(
        `\b\d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4}\b`,
        input.response.content
    )
}

# Enforce GDrive read-only for non-admins
deny_tool_call[msg] {
    input.tool == "gdrive.files.update"
    input.user.role != "admin"
    msg := "GDrive write operations require admin role"
}