MCP Attribute-Based Access Control Policy
Policy Name |
MCP Attribute-Based Access Control |
Summary |
Controls access to tools, resources, and prompts based on user information such as Tiers, IP, Headers, or Claims |
Category |
MCP |
First Flex Gateway version available |
v1.9.3 |
Returned Status Codes |
400 - Invalid token |
Summary
The MCP Attribute-Based Access Control policy controls access to server tools, resources, and prompts based on user information such as Tiers, IP, Headers, or Claims. Use the Cedar policy language to define access rules.
The MCP Attribute-Based Access Control policy requires that another authentication policy be applied before it. The authentication policy can be one of the following included policies or a custom policy:
For custom authentication policies, the custom policy must authenticate by using the Authentication injectable. To learn more, see pdk::policies-pdk-configure-features-authentication.adoc[].
Configuring Policy Parameters
Flex Gateway Local Mode
The MCP Attribute-Based Access Control policy is not supported in Local Mode.
Managed Flex Gateway and Flex Gateway Connected Mode
When you apply the policy to your API instance from the UI, the following parameters are displayed:
| Element | Description |
|---|---|
Rules |
Rules to control access to tools, resources, and prompts, written in the Cedar policy language. |
Cedar Expression |
Cedar expression defining the access rule. For example: |
Authentication Type |
Authentication type specified by the authentication policy, which must be applied before this policy. |