Content Security
Content Security is an Access Policy: Access Policies define, enforce, and audit access between Client and Server Workloads by cryptographically verifying workload identity and contextual factors rather than relying on static secrets.Learn more component that inspects content and enforces the verdict an inspection service returns. Content Security inspects Model Context Protocol: A standard protocol for AI agent and server interactions that defines how AI assistants communicate with external tools and data sources.Learn more(opens in new tab) traffic that flows through the Aembit MCP Identity Gateway: A component that brokers MCP traffic between MCP clients and target MCP servers, validating authorization and presenting Aembit-managed credentials on each request.Learn more.
When a policy includes Content Security, Aembit sends eligible content to the configured inspection service and enforces the verdict it returns:
- Allow - The content passes inspection, and Aembit forwards it unchanged.
- Block - The content violates a policy, and Aembit blocks it.
- Transform - The inspection service returns modified content, such as content with sensitive data redacted, and Aembit forwards the transformed content in place of the original.
Content Security in an Access Policy
Section titled “Content Security in an Access Policy”Content Security is one of the components you can add to an Access Policy, alongside:
- Client Workload: Client Workloads represent software applications, scripts, or automated processes that initiate access requests to Server Workloads, operating autonomously without direct user interaction.Learn more
- Server Workload: Server Workloads represent target services, APIs, databases, or applications that receive and respond to access requests from Client Workloads.Learn more
- Trust Provider: Trust Providers validate Client Workload identities through workload attestation, verifying identity claims from the workload's runtime environment rather than relying on pre-shared secrets.Learn more
- Access Condition: Access Conditions add dynamic, context-aware constraints to authorization by evaluating circumstances like time, location, or security posture to determine whether to grant access.Learn more
- Credential Provider: Credential Providers obtain the specific access credentials—such as API keys, OAuth tokens, or temporary cloud credentials—that Client Workloads need to authenticate to Server Workloads.Learn more
In the Access Policy Builder, Content Security appears as an optional component positioned between Access Conditions and Credential Providers. A policy evaluates Content Security on each matching request, adding inspection to the request path without changing how the policy’s other components authorize access.
Available integrations
Section titled “Available integrations”- CrowdStrike AIDR - Inspect MCP content with CrowdStrike AI Detection and Response (AIDR).
You enter each integration’s connection details directly on the Content Security component.
Data shared for inspection
Section titled “Data shared for inspection”When a policy includes Content Security, Aembit sends the inspected content to the configured inspection service, along with request metadata that identifies the request. Review the inspection service’s data handling before you add Content Security to policies that carry sensitive content.