Denies, by default, the Dropbox tools that turn an internal file into an internet-visible resource in a single call — before the request ever reaches Dropbox:
dropboxguard-share-linkssharingexternal-sharingingresssoc2hipaagdpr-ccpa
Blocks the externally-visible Box sharing surface — the riskiest Box surface an agent can touch — before the call ever reaches Box:
boxguard-share-linkssharingexternal-sharingingresssoc2hipaagdpr-ccpa
Denies Google Drive get file permissions tool calls unless the caller's IdP groups claim contains infosec. All other tool calls pass through unchanged.
Stops agents from opening OneDrive/SharePoint files to the whole internet. It guards the two Microsoft 365 sharing tools:
ms365share-linkssharingingresssoc2iso27001-nisthipaagdpr-ccpa