Lists

Eleven lists can be managed here: Sanctioned Providers, Sanctioned Applications, Allowed Applications, Blocked Applications, Private Applications, Private Models, Public Models, Allowed MCP Servers, Allowed Tools, Blocked MCP Servers and Blocked Tools. Once defined, these Lists can be added to Policies as Destinations.

Blocked Applications are enforced by the Application Access Policy, which is pinned to the top of the Policies page.

Open Lists

In the console's left navigation, expand Policy and select Lists. The page opens on an overview table with one row per list, showing its item count, contents type, the policies that reference it and when it was last updated. Select a list by name to open it on its own page, and use Back to Lists to return to the table.

The provider, application and model lists open as a two-column picker. Private Applications and the MCP server and tool lists open as a table.

Sanctioned Providers

On the Lists overview table, select Sanctioned Providers.
The list opens as two columns, Available Providers and Selected Providers, each with its own search box. Providers in the Selected Providers column are approved for use.
Use the search boxes to find providers, then move them between the columns with the single or double arrows.
Click Save to keep your changes, or Cancel to discard them.

Sanctioned Applications

On the Lists overview table, select Sanctioned Applications.
View all Available and Selected (Approved) applications.
Use search bar or filters to find specific applications.
Use the center arrow to move Apps with their checkboxes checked from one list to the other, or the double arrows to move an entire list from one side to the other.

Allowed Applications

The Allowed Applications list opens as a two-column picker like the other application lists. It holds the applications that are explicitly permitted when the Application Access Policy is in allowlist mode.

Blocked Applications

On the Lists overview table, select Blocked Applications.
View all AI Applications explicitly blocked by your organization.
Block or unblock Applications by checking their checkbox and using the single arrow in the center to move Apps from one list to the other.

💡

Important: Any Application on the right-side list is blocked for everyone by the Application Access Policy, which is pinned to the top of the Policies page.

The Blocked Applications list as a two-column picker, with Available Applications on the left and Blocked Applications on the right.

💡

Note: If githubcopilot.com is added to the Selected Applications list as shown below, traffic from both Visual Studio and VS Code will be blocked by WitnessAI, since both applications use the same URL endpoint of GitHub Copilot.

WitnessAI Lists page showing the Blocked Applications tab. Available Applications panel on the left shows apps including github.com,

Private Applications

Review the detailed Private Applications documentation here.

On the Lists overview table, select Private Applications.
View all the in-house and Private AI Applications deployed in your enterprise.
Use the “Add Application” button to add a new Private App to your environment.

The Private Applications list, with the Add Application button and a table of registered applications.

Private Models

On the Lists overview table, select Private Models.
View all in-house and private AI models deployed in your enterprise.
Use the checkboxes and arrows to select and move Models from one List to the other.

Public Models

On the Lists overview table, select Public Models.
View available Public Models from the Catalog.
Manage models by selecting them and using the arrows to move them between Lists.

Allowed MCP Servers

This list holds the MCP servers explicitly allowed by the Agent Tool Use Policy. The list is a table with Server, Policy and Action columns, and Add Server adds a server to it.

WitnessAI Lists page showing the ‘Allow Servers’ dialog for adding new MCP servers. The dialog has a text area for ‘Discovered servers’ with two checkboxes showing suggested MCP server URLs, and an empty ‘Enter servers manually’ text area below. Cancel and Allow Server buttons are at the bottom.

Allowed Tools

This list holds the tools explicitly allowed by the Agent Tool Use Policy.

WitnessAI Lists page showing the ‘Allow Tools’ dialog for adding MCP tools. The dialog has a search field, a list of ‘Discovered tools’ with checkboxes showing tool names, and an ‘Enter tool names manually’ section for manual entry. The list shows tools like read_file and edit_file with checkboxes for selection.

Blocked MCP Servers

This list holds the MCP servers explicitly blocked by the Agent Tool Use Policy.

WitnessAI Lists page showing the ‘Block Servers’ dialog. The dialog says ‘Block tools to allow AI Athe server name allowed/blocked’. It shows a search field and ‘Discovered servers’ list with a URL for a GitHub Copilot endpoint, and an ‘Enter tool names manually’ text area below.

Blocked Tools

This list holds the tools explicitly blocked by the Agent Tool Use Policy.

WitnessAI Lists page showing the ‘Block Tools’ dialog for blocking MCP tools. The dialog displays a search field under ‘Discovered tools’, shows a ‘google’ entry selected with checkboxes for ‘Get Weather’ and ‘Get Location Info’ tools from Google, an ‘Enter tool manually’ option with a text area for entering tool names one per line, a ‘Server name (optional)’ field, and Cancel and Block Tools buttons.

Lists Overview Open Lists Sanctioned Providers Sanctioned Applications Allowed Applications Blocked Applications Private Applications Private Models Public Models Allowed MCP Servers Allowed Tools Blocked MCP Servers Blocked Tools