plugin
MASK Policy MCP
MASK Policy MCP is the agent-readable adapter for the canonical MASK service: apply, check, explain, resolve profiles, list visible rules, and search audit under RBAC control.
Who it is for
Enterprises, regulated teams, BYOC customers, and agent builders that need AI output to leave through tenant-scoped policy rails.
Problem it solves
It prevents proprietary terms, credentials, regulated claims, fabricated proof, and tenant secrets from leaking through inconsistent chat-specific guards.
Activation model
Inquiry-first install profile with RBAC Foundations, tenant policy packs, audit retention, and BYOC identity review.
Proof and source paths
- MASK enterprise spec exists
- RBAC Foundations sub-spec exists
- Canonical applyMask implementation exists
- CleverQ public route uses canonical MASK
Repo evidence
docs/MASK_POLICY_MCP_ENTERPRISE_SPEC_2026-05-12.mddocs/RBAC_FOUNDATIONS_SUBSPEC_2026-05-12.mdlib/mask/applyMask.ts
Capabilities
mask apply check
mcpApply or dry-run tenant-scoped MASK policy before AI output leaves a boundary.
mask audit policy admin
mcpSearch MASK audit and administer visible policy metadata under separation-of-duties controls.