> For the complete documentation index, see [llms.txt](https://docs.flowcp.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flowcp.ai/security/default-deny-model.md).

# Default-deny model

FlowCP follows a default-deny principle: every tool is disabled when first created and must be explicitly enabled before AI clients can invoke it.

## Why default deny?

When FlowCP imports your Swagger/OpenAPI spec, it may find dozens or hundreds of endpoints. Automatically enabling all of them would expose every API operation to AI clients — including internal admin endpoints, destructive operations, or endpoints that are not intended for external access.

Default deny means:

* You review and consciously enable only the endpoints you want AI clients to use
* A newly imported endpoint can never be invoked until a human turns it on
* Adding a new endpoint to your API does not automatically expose it — it starts disabled and waits for review

## How it applies

| Event                                                    | Default state                                           |
| -------------------------------------------------------- | ------------------------------------------------------- |
| New import — endpoint discovered for the first time      | Disabled                                                |
| Re-import — existing endpoint already customized         | Unchanged (your settings are preserved)                 |
| Re-import — new endpoint found that did not exist before | Disabled                                                |
| `DELETE` endpoint                                        | Disabled, with **Require confirmation** defaulted to on |
| New [skill](/guides/offer-agent-skills.md) authored      | Disabled until you turn it on                           |

## Enabling tools

Enable a tool from the **Tools** tab by toggling the switch on its row. You can enable multiple tools at once using the toolbar's bulk controls.

## Workspace isolation

The default-deny model is enforced at the workspace level. A tool in workspace A can never be invoked by a request authenticated to workspace B. Every storage lookup in FlowCP is scoped to the requesting workspace — this is not just a UI concern but is enforced in every database query.

## Runtime enforcement

Even if a tool's database record is marked enabled, the runtime re-validates the state on every incoming request. If a tool is disabled between requests, the next call is rejected without making an upstream API call.