Data Access Management server

AI agents can use the Data Access Management server to create, review, and publish data access policies and other related content and tasks. Data access policies filter data, mask data, and control who can access data while following your organization's data protection rules.

The server allows for the complete management to create, modify and delete access control, data filter, and data de-identification policies in addition to creating, modifying, and deleting precedence tiers and data protections. The server also allows agents to submit data access assets for workflow approval and retrieve the necessary metadata context required for policy authoring. The MCP server automates the steps required to provide access and protect source systems such as Snowflake, Databricks, and Amazon Redshift.

Key capabilities

Use the MCP server to perform the following tasks:

•Create, update, and delete data access control policies that grant read, write, or delete access to tables and views in connected source systems.

•Create, update, and delete data filter policies that deny access to rows that match classification or business-term conditions.

•Create, update, and delete data protections that mask fields and cells.

•Create, update, and delete data de-identification policies to define which data protections to apply for a given use case.

•Publish draft policies and related assets through the approval workflow.

Prerequisites

Before you begin, verify that your organization has the following prerequisites:

•Licenses to access Data Governance and Catalog and Data Access Management.

•Users assigned to the Data Access Owner role or other custom role allowing access to Data Access Management to create data access assets.

•A valid authentication token generated by a user who has the appropriate role required to view and manage the data. The agent inherits permissions from this user.

•Scanned catalog sources to create data access policies.

•A running Secure Agent with an active connection to push data access policies to the source system.

Example prompts

Use the following sample prompts with the Data Access Management server:

•Create a data access control policy that gives the Finance user group read access to the Sales schema in Snowflake.

•Create a data filter policy that denies access to rows classified as SSN.

•List all published data de-identification policies.

•Create a data protection that tokenizes email addresses, then add it to a data de-identification policy in the highest precedence tier.

•List all data classifications that I can use in policy conditions.

•Show the draft version of the data filter policy with a given ID.

•Publish the draft data access control policy for approval using the publish_data_access_asset tool.

•List all precedence tiers with their ranks.

Available tools

The Data Access Management server provides the following tools:

create_business_term

Creates a business term (core.classType=BusinessTerm) used as glossary context in data access policy conditions.

Parameter: request body. JSON object. See the sample request schema.

create_data_access_control

Creates a data access control policy that grants read, write, or delete access to specific tables or views in the target source system through pushdown enforcement.

Parameter: request body. JSON object. See the sample request schema.

create_data_deidentification

Creates a data de-identification policy that applies data protections to fields or cells, ordered by an existing precedence tier.

Parameter: request body. JSON object. See the sample request schema.

create_data_filter

Creates a data filter policy that denies access to rows matching a rule condition, enforced in-place or through pushdown to the source system.

Parameter: request body. JSON object. See the sample request schema.

create_data_protection

Creates a data protection, a reusable set of data de-identification techniques such as tokenization, hashing, or redaction, applied to specific data types.

Parameter: request body. JSON object. See the sample request schema.

create_precedence_tier

Creates a precedence tier that ranks how data de-identification policies are evaluated, ordered from the lowest rank to the highest.

Parameter: request body. JSON object. See the sample request schema.

create_usage_type

Creates a usage type (usage context), such as 'Data-Access-Management' or 'Reporting and Analytics', referenced by policy conditions. Belongs to the Data Marketplace service, not the Data Access Management policy API.

Parameter: request body. JSON object. See the sample request schema.

delete_data_access_control

Deletes a data access control policy by its internal ID. Grant revocation on the source system after deletion is not documented. Verify on the source system that grants were revoked.

Parameter: id. Internal identifier of the data access control policy to delete. Required.

delete_data_deidentification

Deletes a data de-identification policy by its internal ID.

Parameter: id. Internal identifier of the data de-identification policy to delete. Required.

delete_data_filter

Deletes a data filter policy by its internal ID.

Parameter: id. Internal identifier of the data filter policy to delete. Required.

delete_data_protection

Deletes a data protection by its internal ID. Deletion of a referenced protection is not guarded against. Before you delete a data protection, check for references from data de-identification policies to prevent creating orphaned data protections.

Parameter: id. Internal identifier of the data protection to delete. Required.

delete_precedence_tier

Deletes a precedence tier by its internal ID. Deletion of a tier that is still referenced is not guarded against. To prevent creating orphaned policies, check for references from data de-identification policies before you delete a precedence tier.

Parameter: id. Internal identifier of the precedence tier to delete. Required.

get_data_access_control

Retrieves a single data access control policy by its internal ID.

Parameters:

- fetchDraft. If true, returns the unpublished draft copy of the policy instead of the published version.
- id. Internal identifier of the data access control policy to retrieve. Required.

get_data_deidentification

Retrieves a single data de-identification policy by its internal ID, including its precedence tier and per-field protections.

Parameters:

- fetchDraft. If true, returns the unpublished draft copy of the policy instead of the published version.
- id. Internal identifier of the data de-identification policy to retrieve. Required.

get_data_filter

Retrieves a single data filter policy by its internal ID.

Parameters:

- fetchDraft. If true, returns the unpublished draft copy of the policy instead of the published version.
- id. Internal identifier of the data filter policy to retrieve. Required.

get_data_protection

Retrieves a single data protection by its internal ID, including its configured data de-identification techniques.

Parameters:

- fetchDraft. If true, returns the unpublished draft copy of the data protection instead of the published version.
- id. Internal identifier of the data protection to retrieve. Required.

get_precedence_tier

Retrieves a single precedence tier by its internal ID, returning either the published or draft copy.

Parameters:

- fetchDraft. If true, returns the unpublished draft copy of the tier instead of the published version.
- id. Internal identifier of the precedence tier to retrieve. Required.

list_data_access_controls

Lists published data access control policies for lookups.

Parameters:

- limit. Maximum number of data access control policies to return. Default is 500.
- offset. Zero-based index of the first result to return. Default is 0.

list_data_classifications

Lists the data element classes such as SSN or email, in the catalog so you can use their IDs in data filter and data access control policy conditions. Only classifications already assigned to technical assets by a catalog scan can be referenced by policies. Pass a name or keyword in knowledgeQuery, or '*' to list all. Page with from and size.

Parameters:

- knowledgeQuery. Name or keyword to match against data classifications, for example 'SSN'. Use '*' to list every classification. Required.
- segments. Data 360 segments to include for each matched asset. Required.
- request body. JSON object. See the sample request schema.

list_data_deidentifications

Lists published data de-identification policies for lookups.

Parameters:

- limit. Maximum number of data de-identification policies to return. Default is 500.
- offset. Zero-based index of the first result to return. Default is 0.

list_data_filters

Lists published data filter policies for lookups.

Parameters:

- limit. Maximum number of data filter policies to return. Default is 500.
- offset. Zero-based index of the first result to return. Default is 0.

list_data_protections

Lists published data protections for lookups when building data de-identification policies.

Parameters:

- limit. Maximum number of data protections to return. Default is 500.
- offset. Zero-based index of the first result to return. Default is 0.

list_precedence_tiers

Lists published precedence tiers with their IDs, names, and ranks for lookups and reference maps.

Parameters:

- limit. Maximum number of precedence tiers to return. Default is 500.
- offset. Zero-based index of the first result to return. Default is 0.

list_usage_types

Lists usage types by ID and name, for resolving the usage types referenced in policy condition constants before building data filter policies or data de-identification policies.

Parameter: limit. Maximum number of usage types to return. Default is 500.

list_user_groups

Lists IDMC user groups so you can use a group ID in a data access control rule condition (context::principal.groups). Filter by group name or ID with q, and page with limit and skip. Specify a group that exists in the organization or the policy is rejected.

Parameters:

- limit. Optional maximum number of user groups to return in one response. Default is 100.
- q. Optional filter using double equals syntax to find a group by name or ID, for example 'userGroupName==Finance'.
- skip. Optional number of user group records to skip for paging, for example 0.

publish_data_access_asset

Submits a draft data access asset for workflow review and activation. Data access assets are precedence tiers, data protections, data filter policies, data de-identification policies, or data access control policies.

Parameter: request body. JSON object. See the sample request schema.

search_policy_reference_assets

Searches the catalog for business terms or data element classes to resolve a name to its internal ID for use in policy conditions and field locator queries. Scope the search with filterSpec (core.classType=BusinessTerm for terms, core.classType=core.DataElementClassification for classes). Data element classes must already be assigned to technical assets through catalog scans before policies can reference them.

Parameters:

- knowledgeQuery. Search term to match against catalog assets. Use '*' to match all assets within the filterSpec scope. Required.
- segments. Data 360 segments to include for each matched asset. Required.
- request body. JSON object. See the sample request schema.

update_data_access_control

Partially updates a data access control policy, for example its description. Editing a published policy creates an inactive draft until re-published with publish_data_access_asset.

Parameters:

- id. Internal identifier of the data access control policy to update. Required.
- request body. JSON object. See the sample request schema.

update_data_deidentification

Partially updates a data de-identification policy, for example its description or precedence tier. Editing a published policy creates an inactive draft until re-published with publish_data_access_asset.

Parameters:

- id. Internal identifier of the data de-identification policy to update. Required.
- request body. JSON object. See the sample request schema.

update_data_filter

Partially updates a data filter policy, for example its description or rules. Editing a published policy creates an inactive draft until re-published with publish_data_access_asset.

Parameters:

- id. Internal identifier of the data filter policy to update. Required.
- request body. JSON object. See the sample request schema.

update_data_protection

Replaces a data protection's full definition. This resource supports PUT only. Send the complete object, including any unchanged fields to prevent losing changes.

Parameters:

- id. Internal identifier of the data protection to update. Required.
- request body. JSON object. See the sample request schema.

update_precedence_tier

Partially updates a precedence tier, for example its description or rank. Editing a published tier creates an inactive draft until re-published with publish_data_access_asset.

Parameters:

- id. Internal identifier of the precedence tier to update. Required.
- request body. JSON object. See the sample request schema.

Sample request schemas

The following schemas show how you can define a request for each tool on the Data Access Management server. These sample schemas show required fields only. Replace placeholder values with real values. See each tool's description for optional parameters.

create_business_term

Request schema:

{
"core.classType": "<core.classType>",
"summary": {
"core.name": "<core.name>"
}
}

create_data_access_control

Request schema:

{
"name": "<name>"
}

create_data_deidentification

Request schema:

{
"name": "<name>",
"precedenceTier": "<precedenceTier>"
}

create_data_filter

Request schema:

{
"name": "<name>"
}

create_data_protection

Request schema:

{
"name": "<name>",
"dataProtectionTechniques": [
{
"dataProtectionTechniqueType": "CONSTANT_TEXT_VALUE_FUNCTION",
"appliesToDataType": "UNKNOWN"
}
]
}

create_precedence_tier

Request schema:

{
"name": "<name>",
"rank": 1
}

create_usage_type

Request schema:

{
"refId": "<refId>",
"name": "<name>"
}

delete_data_access_control

Request schema:

{
"id": "<id>"
}

delete_data_deidentification

Request schema:

{
"id": "<id>"
}

delete_data_filter

Request schema:

{
"id": "<id>"
}

delete_data_protection

Request schema:

{
"id": "<id>"
}

delete_precedence_tier

Request schema:

{
"id": "<id>"
}

get_data_access_control

Request schema:

{
"id": "<id>"
}

get_data_deidentification

Request schema:

{
"id": "<id>"
}

get_data_filter

Request schema:

{
"id": "<id>"
}

get_data_protection

Request schema:

{
"id": "<id>"
}

get_precedence_tier

Request schema:

{
"id": "<id>"
}

list_data_access_controls

Request schema:

{}

list_data_classifications

Request schema:

{
"knowledgeQuery": "<knowledgeQuery>",
"segments": "<segments>"
}

list_data_deidentifications

Request schema:

{}

list_data_filters

Request schema:

{}

list_data_protections

Request schema:

{}

list_precedence_tiers

Request schema:

{}

list_usage_types

Request schema:

{}

list_user_groups

Request schema:

{}

publish_data_access_asset

Request schema:

{
"id": "<id>",
"classType": "PRECEDENCE_TIER"
}

search_policy_reference_assets

Request schema:

{
"knowledgeQuery": "<knowledgeQuery>",
"segments": "<segments>"
}

update_data_access_control

Request schema:

{
"id": "<id>"
}

update_data_deidentification

Request schema:

{
"id": "<id>",
"precedenceTier": "<precedenceTier>"
}

update_data_filter

Request schema:

{
"id": "<id>"
}

update_data_protection

Request schema:

{
"id": "<id>",
"name": "<name>",
"dataProtectionTechniques": [
{
"dataProtectionTechniqueType": "CONSTANT_TEXT_VALUE_FUNCTION",
"appliesToDataType": "UNKNOWN"
}
]
}

update_precedence_tier

Request schema:

{
"id": "<id>"
}