---
schema_version: "1"
id: 762209d93861e1276d9a91da7084e9230db4ff39ef0de8a034c49d64ca5f4b8c
title: MCP Attribute-Based Access Control Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/latest/policies-included-mcp-attribute-access-control.md
canonical_url: https://docs.mulesoft.com/gateway/latest/policies-included-mcp-attribute-access-control
source_site: docs.mulesoft.com
content_type: documentation
content_hash: cc3fe82b77b8ef3dd550804c5e9ee5ee73c10343f8a3dc3b77a4a6854f3986b2
description: MuleSoft Documentation Site
release: "1.14"
latest: true
---
---
product: Omni Gateway
version: 1.14
is-latest-version: true
keywords: api gateway, flex gateway, gateway, policy
---

# MCP Attribute-Based Access Control Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>MCP Attribute-Based Access Control</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Controls access to tools, resources, and prompts based on user information such as Tiers, IP, Headers, or Claims</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>MCP</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.9.3</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/mcp-attribute-access-control-release-notes">MCP Attribute-Based Access Control</a></p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>400 - Invalid token</p></td></tr></tbody></table>

> [!NOTE] This policy supports Model Context Protocol (MCP) version 2025-06-18 and earlier. To learn
> more about MCP, see [MCP Specification](https://modelcontextprotocol.io/specification/2025-06-18).

## Summary

The MCP Attribute-Based Access Control policy controls access to server tools, resources, and
prompts based on user information such as Tiers, IP, Headers, or Claims. Use the
[Cedar policy language](https://docs.cedarpolicy.com/) to define access rules.

This policy requires that another authentication policy be applied before the MCP Attribute-Based
Access Control policy. For detailed guidance, see [Writing Cedar Rules](#writing-cedar-rules).

## Configuring Policy Parameters

### Omni Gateway Local Mode

The MCP Attribute-Based Access Control policy is not supported in Local Mode.

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col></colgroup><thead><tr><th>Element</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>Rules</p></div></div></td><td><div><div><p>Rules to control access to tools, resources, and prompts written in the <a href="https://docs.cedarpolicy.com/">Cedar policy language</a>.</p></div></div></td></tr><tr><td><div><div><p>Cedar Expression</p></div></div></td><td><div><div><p>Cedar expression defining the access rule. For example: <code>permit(principal,action == Action::"tools/call</code> or <code>resource == Tool::"calculator");</code>. To learn more about the Cedar bindings provided by the requests, see <a href="#writing-cedar-rules">Writing Cedar Rules</a>.</p></div></div></td></tr><tr><td><div><div><p>Authentication Type</p></div></div></td><td><div><div><p>Type of authentication used by the authentication policy applied before this policy.</p></div></div></td></tr></tbody></table>

## Writing Cedar Rules

You must apply either an included authentication policy or a custom authentication policy before the
MCP Attribute-Based Access Control policy.

### Included Authentication Policies

The authentication policy you apply affects the available Cedar `principal` bindings:

- Multiple policies can validate Client ID:

  - [Client ID Enforcement Policy](https://docs.mulesoft.com/gateway/latest/policies-included-client-id-enforcement)

  - [Rate Limiting: SLA-Based Policy](https://docs.mulesoft.com/gateway/latest/policies-included-rate-limiting-sla)

  - [OAuth 2.0 Token Introspection Policy](https://docs.mulesoft.com/gateway/latest/policies-included-oauth-token-introspection) (If Client
    ID enforcement is configured)

  - [OpenID Connect OAuth 2.0 Token Enforcement Policy](https://docs.mulesoft.com/gateway/latest/policies-included-openid-token-enforcement)
    (If Client ID enforcement is configured)

  - [JWT Validation Policy](https://docs.mulesoft.com/gateway/latest/policies-included-jwt-validation) (If Client ID enforcement is
    configured)

    Policies validating Client ID provide these Cedar bindings:

  - `principal.client_name`: Name of the contract’s client application

  - `principal.principal`: ID of the contract’s client application

  - `principal.properties.slaId`: SLA ID assigned to the contract

- [JWT Validation Policy](https://docs.mulesoft.com/gateway/latest/policies-included-jwt-validation):

  - `principal.properties.claims.<claimName>`: All claims provided by the JWT

- Multiple policies validate basic authentication credentials:

  - [Basic Authentication: Simple Policy](https://docs.mulesoft.com/gateway/latest/policies-included-basic-auth-simple)

  - [Basic Authentication: LDAP Policy](https://docs.mulesoft.com/gateway/latest/policies-included-basic-auth-ldap)

    Policies validating basic authentication credentials provide these Cedar bindings:

  - `principal.principal`: Username passed as basic auth user

### Custom Authentication Policies

For custom authentication policies, the custom policy must authenticate by using the
`Authentication` injectable. To configure the `Authentication` injectable, see
[Accessing Request Authentication Information](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-authentication).

For the Rust `AuthenticationData` structure:

```rust
pub struct AuthenticationData {
    pub principal: Option<String>,
    pub client_id: Option<String>,
    pub client_name: Option<String>,
    pub properties: Value,
}
```

The `AuthenticationData` parameters map to these Cedar bindings:

- `principal`: `principal.principal`

- `client_name`: `principal.client_name`

- `properties`: `principal.properties.*`

## See Also

- [Configuring MCP Access Control Policies](https://docs.mulesoft.com/gateway/latest/policies-mcp-access-control-together)

- [MCP Global Access](https://docs.mulesoft.com/gateway/latest/policies-included-mcp-global-access)

- [MCP Tool Mapping](https://docs.mulesoft.com/gateway/latest/policies-included-mcp-tool-mapping)