# FAQ ## How do I protect employee data from AI? > **Summary:** Barndoor sits between your people, agents, and the models and MCP servers they use, so AI requests are checked against access and data loss prevention policies, and the DLP policies you configure can act on sensitive data before it reaches a model or MCP server. Barndoor is an AI gateway. It sits between every model and MCP server your teams use, so every AI request is checked against access and data loss prevention policies, metered against token budgets, and auditable. What happens to sensitive data depends on the policies you set: they can block or rewrite it, or only alert. Three controls help protect employee data: - **Scoped access.** Barndoor connects to your identity provider (Okta, Azure AD, Google Workspace) and applies access policies at the group, team, role, and user level. You can set access down to the individual tool and action, so you decide which tools and actions each person can use through AI. - **Native DLP.** Sensitive identifiers such as Social Security numbers, emails, phone numbers, and dates of birth can be detected by Protection Profiles, and a policy can block, redact, mask, or tokenize them before they reach a model or MCP server. - **Field Controls.** When you know exactly which fields are sensitive, name the JSON field paths in a tool's output and Barndoor removes them, or allows only the fields you list, before an agent can read them. Barndoor keeps detailed audit logs of every AI action and the policy behind it, so you can trace what an agent accessed and which policy applied. You can also revoke AI access directly in Barndoor without changing your identity provider settings. --- **Sources:** - [Barndoor home page](https://barndoor.ai) - [Okta integration](https://barndoor.ai/integrations/okta) - [Data Control Center overview](https://docs.barndoor.ai/how-tos/data-control-center/overview)