How can we secure Salesforce hosted MCP server that it has less record access provided to Claude users - based on record fields such as country or product line, similar to attribute based access control - than if they were logging into Salesforce from a browser?
We do not want to change the record sharing and access rules in Salesforce for logged in users but want to restrict it for Claude or other AI tool users.
What options would you recommend?
I had a look at DataGrout web site and the various solutions including MCP gateway. It looks interesting, who could be a contact from your company to talk about some of the challenges that we are facing with?
Like on example: it seems that we could build filters on, say, Opportunity records using a region formula field and compare it with our users' region and only send records to Claude where the region values are matching. (I am just giving a simplified example)
I.e. for a SOQL query in Query Records MCP tool like SELECT Name, Amount, Probability, CloseDate, Region FROM Opportunity , we could filter the records based on Region field.
However, when it comes to aggregates, it is not trivial.
E.g. for SOQL query in the same Query Records MCP tool like SELECT SUM(Amount) FROM Opportunity we do not get the Region field back in the aggregate result, so we cannot use that for filtering.
How can you reoslve this kind of challenges with DataGrout?
