create_chrome_dlp_rule
Creates a Chrome DLP rule to protect browser actions (uploads, downloads, printing) per organizational unit.
Instructions
Creates a new Chrome DLP rule for a specific Organizational Unit. Applies browser-level protection (uploads, downloads, printing). For safety reasons, this MCP tool is disabled from creating 'ACTIVE' rules with a 'BLOCK' action. You can create 'INACTIVE' 'BLOCK' rules and enable them later in the UI, or create 'ACTIVE' 'WARN' or 'AUDIT' rules.
To ensure technical accuracy and verify trigger compatibility, you should retrieve the full technical reference using 'get_document' for '11-dlp-rule-reference' before using this tool.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| state | No | Rule state (defaults to ACTIVE): - ACTIVE: The rule is currently enforced. - INACTIVE: The rule is saved but not currently enforced. | |
| action | Yes | Action to take when the rule is triggered. AUDIT mode is silent and logs events without notifying or blocking the user. | |
| triggers | Yes | List of Chrome triggers: - FILE_UPLOAD: Scanning files that are uploaded. - FILE_DOWNLOAD: Scanning files that are downloaded. - WEB_CONTENT_UPLOAD: Scanning text that is copy-pasted. - PRINT: Scanning pages that are printed. - URL_NAVIGATION: Scanning URLs when visited. | |
| condition | No | CEL condition string. To ensure technical accuracy and verify trigger compatibility, you should retrieve the full technical reference using 'get_document' for '11-dlp-rule-reference' before formulating a condition. | |
| orgUnitId | Yes | The target Organizational Unit ID | |
| customerId | No | The Chrome customer ID (e.g. C012345). | |
| dataMasking | No | Data masking configurations (supports custom regular expressions and data masking detectors). The 'dataMasking' parameter is only supported with the 'URL_NAVIGATION' trigger and 'WARN' or 'AUDIT' actions. Currently, only custom regular expressions and data masking detectors are supported for data masking (word lists and URL lists are not supported). | |
| description | No | Description of the rule. | |
| displayName | Yes | The display name of the rule. Will be automatically prefixed with '🤖 '. | |
| saveContent | No | Whether to save the content that triggered the rule. | |
| customMessage | No | Custom message to display to the user. The 'customMessage' parameter is supported with 'BLOCK' and 'WARN' actions, and must be 300 characters or less. Only <a> tags with href attributes are allowed. | |
| blockScreenshot | No | Whether to block screenshots when the rule is triggered. The 'blockScreenshot' parameter (which also restricts screen-sharing) is only supported with the 'URL_NAVIGATION' trigger and 'WARN' or 'AUDIT' actions. | |
| watermarkMessage | No | Watermark message to display when the rule is triggered. The 'watermarkMessage' parameter is only supported with the 'URL_NAVIGATION' trigger and 'WARN' or 'AUDIT' actions, and must be 60 characters or less. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| dlpRule | Yes |