Datadog
configure_allowlist
Manage HARD SQL guardrails for an enterprise connection: a TABLE ALLOWLIST (queries may reference only the listed tables — enforced at the AST level across subqueries/CTEs/JOINs) and a PII MASKING policy (mask flagged columns in query results). Both opt-out by default. action=view shows current policy + schema reference; set_tables replaces the allowlist (use [] to lock down everything); remove_allowlist disables it; set_pii_policy toggles masking + chooses which PII kinds to mask. Masking is a heuristic policy aid (not a compliance guarantee) and one-way per execution. [ENTERPRISE tier]
Remote thinair/data
Remote (network-hosted)
Other tools also called configure_allowlist?
See providers with this name
Input Schema
{
"type": "object",
"properties": {
"action": {
"enum": [
"view",
"set_tables",
"remove_allowlist",
"set_pii_policy"
],
"type": "string",
"description": "What to do"
},
"tables": {
"type": "array",
"items": {
"type": "string",
"maxLength": 256
},
"maxItems": 500,
"description": "For set_tables: the allowlist. Bare ('users') or one-level schema-qualified ('public.users'). Empty array = lock down (no tables allowed)."
},
"connection": {
"type": "string",
"maxLength": 256,
"description": "Target connection name from this tenant's inventory. Call `list_connections` to see every name + dialect. If the user didn't specify, use the tenant's default (first added). Do not invent names — resolve from `list_connections` output."
},
"pii_enabled": {
"type": "boolean",
"description": "For set_pii_policy: enable or disable result masking."
},
"mask_patterns": {
"type": "array",
"items": {
"enum": [
"email",
"ssn",
"phone",
"credit_card",
"ipv4",
"jwt",
"bearer_token"
],
"type": "string"
},
"description": "For set_pii_policy: which PII kinds to mask (defaults to all when enabling without a list)."
}
}
}