Skip to main content
Glama

Draft an AI policy for a small firm

draft_ai_policy
Read-onlyIdempotent

Drafts a one-page AI use policy for a small UK firm: approved tools, what must never be pasted in, human checking, telling clients, and who is responsible. Use when an owner asks whether they need an AI policy, what to put in one, or how to stop staff pasting client details into AI tools. Returns the clauses and the steps to take before adopting it. A starting draft, not legal advice.

Input Schema

NameRequiredDescriptionDefault
dataYesWhat information staff might put into AI tools. Use no_personal_data if none.
usesYesWhat staff use or will use AI for. drafting_and_research; client_communication = drafting emails or letters to clients; meeting_notes = recording or transcribing meetings; decisions_about_people = screening candidates, assessing clients or staff.
teamSizeNoNumber of people in the firm.
regulatedNoTrue if the firm is regulated by a professional or financial regulator.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false and openWorldHint=false, so the safety profile is covered. The description adds genuinely new context beyond them: what comes back ('the clauses and the steps to take before adopting it') and a scope limit ('A starting draft, not legal advice'). No contradiction with the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with purpose before usage triggers and return value, and no filler. The final disclaimer sentence is short and load-bearing rather than padding, though the content enumeration in sentence one is somewhat list-heavy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description usefully states what is returned and adds a legal-scope caveat, and annotations cover the read-only/idempotent profile. It stops short of explaining how the enum inputs shape the generated clauses or what the agent should do with the output next, which would complete the picture for a 4-parameter generation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the enums are self-explanatory, so the schema already carries parameter meaning; baseline 3 applies. The description adds no syntax, format, or interaction detail about data, uses, teamSize or regulated that is not already in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and artifact ('Drafts a one-page AI use policy for a small UK firm') and enumerates the policy contents (approved tools, prohibited pastes, human checking, client disclosure, ownership). The resource is narrow and jurisdiction-scoped, so an agent can separate it from assess_automation_opportunities, estimate_automation_payback and get_sector_playbook without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete triggering user intents: 'when an owner asks whether they need an AI policy, what to put in one, or how to stop staff pasting client details into AI tools.' That is clear when-to-use guidance, but it names no exclusion and does not point to check_ai_data_protection as the alternative for pure data-protection questions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources