Browse Workshops
Step 4

Apply Governance Policies

⏱ 5 min

Overview

You will apply two policies to the gateway instance:

  1. Outbound — Credential Injection OAuth2: the gateway authenticates with Salesforce on behalf of every agent — agents never handle Salesforce credentials
  2. Inbound — Basic Authentication: protects the gateway endpoint so only requests with valid credentials can reach it

Step 1 — Navigate to the legacy UI

Policy management for MCP Server instances is done in the legacy Anypoint Platform UI.

  1. In the lower-left corner, click Anypoint Platform to switch to the legacy UI
  2. Go to Agents & Tools → API Manager
  3. Under AI Management, click Agent and Tool Instances
  4. Find and click the Headless 360 MCP Server instance you created

Step 2 — Apply the Outbound Policy (Credential Injection — OAuth2)

  1. Click the Policies tab
  2. Click the Outbound policies sub-tab
  3. Click Add Outbound Policy
  4. In the Add Upstream URL field, enter: 
    https://api.salesforce.com/platform/mcp/v1/platform/sobject-all
  5. Click Next
  6. Select Credential Injection — OAuth2

  7. Fill in the following fields using values from the Credentials page:

    Field Value
    OAuth2 service name (provided by your workshop instructor)
    Credential location Send credentials in body
    Grant Type Client Credentials
    Client ID (provided by your workshop instructor)
    Client Secret (provided by your workshop instructor)
    Scope (leave blank)
  8. Click Apply

Step 3 — Apply the Inbound Policy (Basic Authentication)

  1. Click the Inbound policies sub-tab
  2. Click Add Inbound Policy
  3. Select Basic Authentication - Simple

  4. Fill in the following fields:

    Field Value
    Username mcp-user
    Password mcp-pass
  5. Click Apply

Step 4 — Verify both policies are active

The Policies tab should now show:

Policy Direction Status
Credential Injection — OAuth2 Outbound Active
Basic Authentication - Simple Inbound Active

Both policies propagate to the gateway within 30 seconds. No restart required.

What this achieves: Agents authenticate to the gateway with Basic Auth (inbound). The gateway then authenticates to Salesforce with OAuth2 Client Credentials (outbound). Two separate auth layers — neither the agent nor Salesforce ever sees the other’s credentials.

Continue to Test and Verify →