MCP Global Access Control Policy Blocks UI Elements Due to Missing 'ui://' Allowlist

The MCP Global Access Control policy  is applied to allowlist certain tools/list and tools/call in an MCP Instance under API Manager, however, this blocks the resources/read as seen in the error below.

{
	"jsonrpc": "2.0",
	"id": 7,
	"error": {
		"code": -32008,
		"message": "Unable to access",
		"data": "Access denied to: ui://business-groups/app.html"
	}
}

CAUSE

The MCP Global Access Control policy, by design, enforces Allow/Block rules on various resource types, including resources/read, prompts/get, tools/list, and tools/call. It also filters responses for resources/list and prompts/list. User interface (UI) elements are categorized as resources and are therefore subject to these access control rules. If your policy does not include an explicit Allow rule for ui:// patterns, these UI elements will be implicitly blocked, leading to errors or unexpected behavior in your application's user interface.