@highflame/policy 2.1.11 → 2.1.13

package/_schemas/guardrails/schema.cedarschema

@@ -16,12 +16,16 @@ namespace Guardrails {
     // Entity hierarchy enables Cedar's `in` operator for policy scoping:
     //   Account (org root)
     //     └── Project in [Account]
-    //           └── App in [Project]
-    //                 └── Session in [App]
+    //           ├── App in [Project]
+    //           │     └── Session in [App, Agent]
+    //           └── Agent in [Project]
+    //                 └── Session in [App, Agent]
     //
     // Policy scoping examples:
-    //   resource == Guardrails::App::"<uuid>"              → app-scoped
-    //   resource in Guardrails::Project::"<uuid>"          → project-wide
+    //   resource == Guardrails::App::"<uuid>"              → app-scoped (app only)
+    //   resource == Guardrails::Agent::"<agent_id>"        → agent-only (exact match)
+    //   resource in Guardrails::Agent::"<agent_id>"        → agent + its sessions
+    //   resource in Guardrails::Project::"<uuid>"          → project-wide (apps + agents)
     //   resource in Guardrails::Account::"<uuid>"          → org-wide
     // =========================================================================
 
@@ -34,14 +38,18 @@ namespace Guardrails {
     /// User represents a principal (human or service) making requests
     entity User;
 
-    /// Agent represents an AI agent (Claude, Cursor, Copilot, etc.) making requests
-    entity Agent;
+    /// Agent represents an AI agent (Claude, Cursor, Copilot, etc.) making requests.
+    /// Used as both principal (who is acting) and resource (policy scoping target).
+    /// Agent + sessions: resource in Guardrails::Agent::"<agent_id>" (hierarchy match)
+    /// Agent only:       resource == Guardrails::Agent::"<agent_id>" (exact match)
+    entity Agent in [Project];
 
     /// App represents a protected application (guardrails-enabled LLM app)
     entity App in [Project];
 
-    /// Session represents an agentic conversation session with state tracking
-    entity Session in [App];
+    /// Session represents an agentic conversation session with state tracking.
+    /// Sessions can belong to either an App or an Agent.
+    entity Session in [App, Agent];
 
     // =========================================================================
     // Actions
@@ -50,35 +58,35 @@ namespace Guardrails {
     /// Process user prompts and AI responses for security threats and content violations
     action "process_prompt" appliesTo {
         principal: [User, Agent],
-        resource: [App, Session],
+        resource: [App, Agent, Session],
         context: ProcessPromptContext
     };
 
     /// Execute tool calls (shell, file operations, MCP tools)
     action "call_tool" appliesTo {
         principal: [User, Agent],
-        resource: [Session],
+        resource: [Agent, Session],
         context: CallToolContext
     };
 
     /// Read file operations
     action "read_file" appliesTo {
         principal: [User, Agent],
-        resource: [Session],
+        resource: [Agent, Session],
         context: FileReadContext
     };
 
     /// Write file operations
     action "write_file" appliesTo {
         principal: [User, Agent],
-        resource: [Session],
+        resource: [Agent, Session],
         context: FileWriteContext
     };
 
     /// Connect to an MCP server
     action "connect_server" appliesTo {
         principal: [User, Agent],
-        resource: [Session],
+        resource: [Agent, Session],
         context: ConnectServerContext
     };
 

package/_schemas/sentry/schema.cedarschema

@@ -229,7 +229,7 @@ action receive_response appliesTo {
 // Threat focus: data leakage via cut/paste, injection payloads in pasted content
 action paste_content appliesTo {
   principal: [User],
-  resource: [ChatSession],
+  resource: [ChatSession, Document],
   context: {
     // --- Core Metadata ---
     content: String,                  // Pasted content

package/dist/guardrails-entities.gen.js

@@ -6,7 +6,7 @@
  */
 export const GUARDRAILS_ENTITIES = {
     principals: ['Agent', 'User'],
-    resources: ['App', 'Session'],
+    resources: ['Agent', 'App', 'Session'],
     actions: ['call_tool', 'connect_server', 'process_prompt', 'read_file', 'write_file'],
 };
 /**
@@ -15,23 +15,23 @@ export const GUARDRAILS_ENTITIES = {
  */
 export const GUARDRAILS_ACTION_ENTITIES = {
     'call_tool': {
-        principals: ['User', 'Agent'],
-        resources: ['Session'],
+        principals: ['Agent', 'User'],
+        resources: ['Agent', 'Session'],
     },
     'connect_server': {
-        principals: ['User', 'Agent'],
-        resources: ['Session'],
+        principals: ['Agent', 'User'],
+        resources: ['Agent', 'Session'],
     },
     'process_prompt': {
-        principals: ['User', 'Agent'],
-        resources: ['App', 'Session'],
+        principals: ['Agent', 'User'],
+        resources: ['Agent', 'App', 'Session'],
     },
     'read_file': {
-        principals: ['User', 'Agent'],
-        resources: ['Session'],
+        principals: ['Agent', 'User'],
+        resources: ['Agent', 'Session'],
     },
     'write_file': {
-        principals: ['User', 'Agent'],
-        resources: ['Session'],
+        principals: ['Agent', 'User'],
+        resources: ['Agent', 'Session'],
     },
 };

package/dist/overwatch-defaults.gen.js

@@ -1069,6 +1069,11 @@ export const OVERWATCH_DEFAULTS = [
         tags: ['baseline', 'permit-default', 'organization'],
         isActive: true,
     },
+];
+// =============================================================================
+// ALL TEMPLATES
+// =============================================================================
+export const OVERWATCH_TEMPLATES = [
     {
         id: 'secrets-default',
         name: 'Secrets Detection',
@@ -1077,7 +1082,6 @@ export const OVERWATCH_DEFAULTS = [
         cedarText: OVERWATCH_SECRETS_DEFAULT_CEDAR,
         severity: 'critical',
         tags: ['secrets', 'credentials', 'aws', 'github', 'ssh', 'pem', 'yara', 'baseline'],
-        isActive: true,
     },
     {
         id: 'semantic-default',
@@ -1087,7 +1091,6 @@ export const OVERWATCH_DEFAULTS = [
         cedarText: OVERWATCH_SEMANTIC_DEFAULT_CEDAR,
         severity: 'critical',
         tags: ['injection', 'jailbreak', 'content-safety', 'yara', 'ml', 'owasp-llm01', 'owasp-llm02', 'baseline'],
-        isActive: true,
     },
     {
         id: 'tools-default',
@@ -1097,13 +1100,7 @@ export const OVERWATCH_DEFAULTS = [
         cedarText: OVERWATCH_TOOLS_DEFAULT_CEDAR,
         severity: 'high',
         tags: ['tools', 'file-access', 'system-paths', 'severity', 'baseline'],
-        isActive: true,
     },
-];
-// =============================================================================
-// ALL TEMPLATES
-// =============================================================================
-export const OVERWATCH_TEMPLATES = [
     {
         id: 'pii-default',
         name: 'PII Detection',
@@ -1213,7 +1210,9 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "severity": "low",
       "tags": ["baseline", "permit-default", "organization"],
       "is_active": true
-    },
+    }
+  ],
+  "templates": [
     {
       "id": "secrets-default",
       "name": "Secrets Detection",
@@ -1221,8 +1220,7 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "secrets",
       "file": "defaults/secrets.cedar",
       "severity": "critical",
-      "tags": ["secrets", "credentials", "aws", "github", "ssh", "pem", "yara", "baseline"],
-      "is_active": true
+      "tags": ["secrets", "credentials", "aws", "github", "ssh", "pem", "yara", "baseline"]
     },
     {
       "id": "semantic-default",
@@ -1231,8 +1229,7 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "semantic",
       "file": "defaults/semantic.cedar",
       "severity": "critical",
-      "tags": ["injection", "jailbreak", "content-safety", "yara", "ml", "owasp-llm01", "owasp-llm02", "baseline"],
-      "is_active": true
+      "tags": ["injection", "jailbreak", "content-safety", "yara", "ml", "owasp-llm01", "owasp-llm02", "baseline"]
     },
     {
       "id": "tools-default",
@@ -1241,11 +1238,8 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "tools",
       "file": "defaults/tools.cedar",
       "severity": "high",
-      "tags": ["tools", "file-access", "system-paths", "severity", "baseline"],
-      "is_active": true
-    }
-  ],
-  "templates": [
+      "tags": ["tools", "file-access", "system-paths", "severity", "baseline"]
+    },
     {
       "id": "pii-default",
       "name": "PII Detection",

package/dist/overwatch-entities.gen.js

@@ -15,23 +15,23 @@ export const OVERWATCH_ENTITIES = {
  */
 export const OVERWATCH_ACTION_ENTITIES = {
     'call_tool': {
-        principals: ['User', 'Agent'],
-        resources: ['Tool', 'FilePath'],
+        principals: ['Agent', 'User'],
+        resources: ['FilePath', 'Tool'],
     },
     'connect_server': {
-        principals: ['User', 'Agent'],
+        principals: ['Agent', 'User'],
         resources: ['Server'],
     },
     'process_prompt': {
-        principals: ['User', 'Agent'],
+        principals: ['Agent', 'User'],
         resources: ['LlmPrompt'],
     },
     'read_file': {
-        principals: ['User', 'Agent'],
+        principals: ['Agent', 'User'],
         resources: ['FilePath'],
     },
     'write_file': {
-        principals: ['User', 'Agent'],
+        principals: ['Agent', 'User'],
         resources: ['FilePath'],
     },
 };

package/dist/sentry-entities.gen.js

@@ -16,7 +16,7 @@ export const SENTRY_ENTITIES = {
 export const SENTRY_ACTION_ENTITIES = {
     'paste_content': {
         principals: ['User'],
-        resources: ['ChatSession'],
+        resources: ['ChatSession', 'Document'],
     },
     'receive_response': {
         principals: ['User'],
@@ -28,6 +28,6 @@ export const SENTRY_ACTION_ENTITIES = {
     },
     'upload_file': {
         principals: ['User'],
-        resources: ['Document', 'ChatSession'],
+        resources: ['ChatSession', 'Document'],
     },
 };

package/dist/service-schemas.gen.d.ts

@@ -3,7 +3,7 @@
  *
  * Full Cedar schema for guardrails, embedded at codegen time.
  */
-export declare const GUARDRAILS_SCHEMA = "// =============================================================================\n// Guardrails Cedar Schema\n// =============================================================================\n// Defines entity types, actions, and context attributes for the highflame-shield\n// guardrails service. This schema enables type-safe policy authoring and\n// validation in both Studio UI and backend.\n//\n// Service: highflame-shield (guardrails)\n// Namespace: Guardrails\n// =============================================================================\n\nnamespace Guardrails {\n    // =========================================================================\n    // Entity Types \u2014 ReBAC Hierarchy\n    // =========================================================================\n    // Entity hierarchy enables Cedar's `in` operator for policy scoping:\n    //   Account (org root)\n    //     \u2514\u2500\u2500 Project in [Account]\n    //           \u2514\u2500\u2500 App in [Project]\n    //                 \u2514\u2500\u2500 Session in [App]\n    //\n    // Policy scoping examples:\n    //   resource == Guardrails::App::\"<uuid>\"              \u2192 app-scoped\n    //   resource in Guardrails::Project::\"<uuid>\"          \u2192 project-wide\n    //   resource in Guardrails::Account::\"<uuid>\"          \u2192 org-wide\n    // =========================================================================\n\n    /// Account represents an organization (top-level tenant)\n    entity Account;\n\n    /// Project represents a project within an account\n    entity Project in [Account];\n\n    /// User represents a principal (human or service) making requests\n    entity User;\n\n    /// Agent represents an AI agent (Claude, Cursor, Copilot, etc.) making requests\n    entity Agent;\n\n    /// App represents a protected application (guardrails-enabled LLM app)\n    entity App in [Project];\n\n    /// Session represents an agentic conversation session with state tracking\n    entity Session in [App];\n\n    // =========================================================================\n    // Actions\n    // =========================================================================\n\n    /// Process user prompts and AI responses for security threats and content violations\n    action \"process_prompt\" appliesTo {\n        principal: [User, Agent],\n        resource: [App, Session],\n        context: ProcessPromptContext\n    };\n\n    /// Execute tool calls (shell, file operations, MCP tools)\n    action \"call_tool\" appliesTo {\n        principal: [User, Agent],\n        resource: [Session],\n        context: CallToolContext\n    };\n\n    /// Read file operations\n    action \"read_file\" appliesTo {\n        principal: [User, Agent],\n        resource: [Session],\n        context: FileReadContext\n    };\n\n    /// Write file operations\n    action \"write_file\" appliesTo {\n        principal: [User, Agent],\n        resource: [Session],\n        context: FileWriteContext\n    };\n\n    /// Connect to an MCP server\n    action \"connect_server\" appliesTo {\n        principal: [User, Agent],\n        resource: [Session],\n        context: ConnectServerContext\n    };\n\n    // =========================================================================\n    // Context Types (Action-Specific)\n    // =========================================================================\n\n    /// Context for process_prompt action (user prompts & AI responses)\n    type ProcessPromptContext = {\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n        \"direction\": String,        // \"input\" | \"output\"\n        \"content_type\": String,     // \"prompt\" | \"response\" | \"tool_call\" | \"file\"\n        \"detector_count\": Long,\n\n        // Security - Injection & Jailbreak (optional)\n        \"injection_confidence\"?: Long,  // Combined injection confidence: MAX(pulse, deep_context)\n        \"jailbreak_confidence\"?: Long,  // Combined jailbreak confidence: MAX(pulse, deep_context)\n        \"injection_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"injection_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n        \"jailbreak_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"jailbreak_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n        \"injection_type\"?: String,       // \"prompt\" | \"sql\" | \"command\" | \"none\"\n\n        // Privacy - Secrets (optional)\n        \"contains_secrets\"?: Bool,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,    // [\"aws_access_key\", \"github_token\", ...]\n\n        // Privacy - PII (optional)\n        \"pii_detected\"?: Bool,\n        \"pii_count\"?: Long,\n        \"pii_types\"?: Set<String>,       // [\"email\", \"phone\", \"ssn\", \"credit_card\", ...]\n        \"pii_confidence\"?: Long,         // PII ML classifier confidence (0-100) \u2014 catches novel PII patterns that escape regex detection\n\n        // Threat Severity Aggregation (optional)\n        \"highest_severity\"?: String,     // Highest severity across all detectors: \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n\n        // Trust & Safety - Toxicity (optional)\n        \"violence_score\"?: Long,         // 0-100\n        \"hate_speech_score\"?: Long,      // 0-100\n        \"sexual_score\"?: Long,           // 0-100\n        \"weapons_score\"?: Long,          // 0-100\n        \"crime_score\"?: Long,            // 0-100\n        \"profanity_score\"?: Long,        // 0-100\n\n        // Semantic - Topic Classification (optional)\n        \"content_topics\"?: Set<String>,      // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n        \"topic_confidence\"?: Long,           // 0-100\n\n        // Security - Invisible Character Detection (optional)\n        \"contains_invisible_chars\"?: Bool,\n        \"invisible_chars_score\"?: Long,      // 0-100\n\n        // Security - Pattern Detection (optional)\n        \"command_injection_detected\"?: Bool,\n        \"command_injection_type\"?: String,       // \"reverse_shell\" | \"privilege_escalation\" | \"code_execution\" | \"destructive_command\" | \"data_exfiltration\"\n        \"command_injection_score\"?: Long,        // 0-100\n        \"path_traversal_detected\"?: Bool,\n        \"path_traversal_severity\"?: String,      // \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n        \"path_traversal_type\"?: String,\n        \"sql_injection_detected\"?: Bool,\n        \"sql_injection_type\"?: String,           // \"tautology\" | \"union_based\" | \"destructive\" | \"blind\" | \"error_based\"\n        \"sql_injection_score\"?: Long,            // 0-100\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Bool,\n        \"cross_origin_type\"?: String,            // \"cross_origin_tool\" | \"cross_origin_server\" | \"none\"\n        \"cross_origin_score\"?: Long,             // 0-100\n\n        // Security - Encoded Injection (optional)\n        \"encoded_content_detected\"?: Bool,\n        \"encoded_types\"?: Set<String>,           // [\"base64\", \"hex\", \"unicode\", \"url\", ...]\n        \"encoded_count\"?: Long,\n        \"encoded_score\"?: Long,                  // 0-100\n\n        // Language & Script Detection (optional)\n        \"detected_language\"?: String,            // ISO language code\n        \"is_english\"?: Bool,\n        \"language_confidence\"?: Long,            // 0-100\n        \"detected_script\"?: String,              // \"latin\" | \"cyrillic\" | \"arabic\" | \"unknown\" | ...\n        \"is_latin_script\"?: Bool,\n        \"script_confidence\"?: Long,              // 0-100\n\n        // Content Analysis (optional)\n        \"hallucination_score\"?: Long,\n        \"factuality_score\"?: Long,               // 0-100\n        \"sentiment_score\"?: Long,\n        \"contains_code\"?: Bool,\n        \"code_languages\"?: Set<String>,\n        \"code_ratio\"?: Long,                     // 0-100, percentage of content that is code\n        \"keyword_matched\"?: Bool,\n        \"keyword_categories\"?: Set<String>,\n        \"keyword_count\"?: Long,\n        \"contains_non_ascii\"?: Bool,\n        \"phishing_detected\"?: Bool,\n        \"content_safety_score\"?: Long,           // 0-100\n        \"content_safety_blocked\"?: Bool,\n\n        // Agentic - Multi-Turn Context (optional)\n        \"conversation_turn\"?: Long,\n        \"multi_turn_detection\"?: Bool,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        // Present when the request is made by an AI agent (API key or JWT with agent claims).\n        // Empty strings for human user requests. Use these to write agent-specific policies.\n        \"agent_id\"?: String,             // Unique agent identifier (e.g., \"agent_research_v3\")\n        \"agent_type\"?: String,           // \"orchestrator\" | \"autonomous\" | \"tool_agent\" | \"human_proxy\"\n        \"agent_trust_level\"?: String,    // \"first_party\" | \"verified_third_party\" | \"unverified\"\n        \"agent_framework\"?: String,      // Agent framework (e.g., \"claude-code\", \"langchain\", \"crewai\")\n        \"agent_publisher\"?: String,      // Organization that published the agent\n\n    };\n\n    /// Context for call_tool action (agentic tool execution)\n    type CallToolContext = {\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // Tool Risk (optional)\n        \"tool_name\"?: String,            // \"shell\", \"write_file\", \"http_post\", etc.\n        \"tool_risk_score\"?: Long,        // 0-100\n        \"tool_is_sensitive\"?: Bool,\n        \"tool_category\"?: String,        // \"safe\" | \"sensitive\" | \"dangerous\"\n        \"tool_is_builtin\"?: Bool,\n\n        // MCP context (optional \u2014 only present for MCP tool calls)\n        \"mcp_server\"?: String,           // MCP server name (e.g., \"github\", \"filesystem\")\n        \"mcp_tool\"?: String,             // MCP tool name within the server\n        \"mcp_server_verified\"?: Bool,    // Whether server is from verified registry\n\n        // Agentic - Behavioral Patterns (optional)\n        \"suspicious_pattern\"?: Bool,\n        \"pattern_type\"?: String,         // \"data_exfiltration\" | \"secret_exfiltration\" | \"db_exfiltration\" | \"credential_theft\" | \"destructive_sequence\" | \"none\"\n        \"sequence_risk\"?: Long,          // 0-100\n\n        // Agentic - Loop Detection (optional)\n        \"loop_detected\"?: Bool,\n        \"loop_count\"?: Long,\n        \"loop_tool\"?: String,\n\n        // Agentic - Budget Control (optional)\n        \"budget_remaining_pct\"?: Long,   // 0-100\n        \"budget_exceeded\"?: Bool,\n\n        // Semantic - Topic Classification (optional)\n        \"content_topics\"?: Set<String>,      // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n        \"topic_confidence\"?: Long,           // 0-100\n\n        // Security checks on tool arguments (optional)\n        \"contains_secrets\"?: Bool,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Bool,\n        \"pii_types\"?: Set<String>,\n        \"pii_count\"?: Long,              // Number of PII pattern matches in tool content\n        \"pii_confidence\"?: Long,         // PII ML classifier confidence (0-100)\n        \"injection_confidence\"?: Long,\n        \"injection_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"injection_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n\n        // Security - Pattern Detection (optional)\n        \"command_injection_detected\"?: Bool,\n        \"command_injection_type\"?: String,\n        \"command_injection_score\"?: Long,        // 0-100\n        \"path_traversal_detected\"?: Bool,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n        \"sql_injection_detected\"?: Bool,\n        \"sql_injection_type\"?: String,\n        \"sql_injection_score\"?: Long,            // 0-100\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Bool,\n        \"cross_origin_type\"?: String,\n        \"cross_origin_score\"?: Long,             // 0-100\n\n        // File & Path (optional \u2014 for path-based access control policies)\n        \"path\"?: String,                         // File path when tool operates on files\n\n        // Security - Invisible Character Detection in tool args (optional)\n        \"contains_invisible_chars\"?: Bool,       // Whether invisible Unicode chars detected in tool args\n        \"invisible_chars_score\"?: Long,          // Invisible character attack severity (0-100)\n\n        // Security - Encoded Injection (optional)\n        \"encoded_content_detected\"?: Bool,\n        \"encoded_types\"?: Set<String>,\n        \"encoded_count\"?: Long,\n        \"encoded_score\"?: Long,                  // 0-100\n\n        // Agentic - Agent Security (optional)\n        \"tool_poisoning_detected\"?: Bool,\n        \"tool_poisoning_score\"?: Long,           // 0-100\n        \"tool_poisoning_type\"?: String,          // \"hidden_instructions\" | \"system_prompt_injection\" | \"authority_hijack\"\n        \"rug_pull_detected\"?: Bool,\n        \"rug_pull_score\"?: Long,                 // 0-100\n        \"rug_pull_type\"?: String,                // \"risk_spike\" | \"pattern_change\" | \"combined\" | \"none\"\n\n        // Agentic - Indirect Prompt Injection (optional \u2014 injection via tool outputs/retrieved content)\n        \"indirect_injection_score\"?: Long,       // Indirect injection risk score (0-100)\n        \"indirect_injection_type\"?: String,      // Type of indirect injection detected\n\n        // Agentic - MCP Risk (optional)\n        \"mcp_config_risk\"?: Bool,\n        \"mcp_risk_type\"?: String,                // \"inline_execution\" | \"suspicious_url\" | \"cross_origin\"\n        \"mcp_risk_score\"?: Long,                 // 0-100\n\n        // Agentic - Multi-Turn Context (optional)\n        \"conversation_turn\"?: Long,\n        \"multi_turn_detection\"?: Bool,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for read_file action\n    type FileReadContext = {\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // File path (optional \u2014 for path-based access control policies)\n        \"path\"?: String,                 // File path being read\n\n        // Security checks on file content (optional)\n        \"contains_secrets\"?: Bool,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Bool,\n        \"pii_types\"?: Set<String>,\n\n        // Security - Path Traversal (optional)\n        \"path_traversal_detected\"?: Bool,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for write_file action\n    type FileWriteContext = {\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // File path (optional \u2014 for path-based access control policies)\n        \"path\"?: String,                         // File path being written\n\n        // Security - Invisible Character Detection in write content (optional)\n        \"contains_invisible_chars\"?: Bool,       // Whether invisible Unicode chars detected in write content\n        \"invisible_chars_score\"?: Long,          // Invisible character attack severity (0-100)\n\n        // Security checks on content being written (optional)\n        \"contains_secrets\"?: Bool,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Bool,\n        \"pii_types\"?: Set<String>,\n\n        // Security - Path Traversal (optional)\n        \"path_traversal_detected\"?: Bool,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for connect_server action (MCP server connections)\n    type ConnectServerContext = {\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // MCP context (optional)\n        \"mcp_server\"?: String,           // MCP server name (e.g., \"github\", \"filesystem\")\n        \"mcp_server_verified\"?: Bool,    // Whether server is from verified registry\n\n        // Agentic - Agent Security (optional)\n        \"tool_poisoning_detected\"?: Bool,\n        \"tool_poisoning_score\"?: Long,\n        \"tool_poisoning_type\"?: String,\n\n        // Agentic - MCP Risk (optional)\n        \"mcp_config_risk\"?: Bool,\n        \"mcp_risk_type\"?: String,\n        \"mcp_risk_score\"?: Long,\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Bool,\n        \"cross_origin_type\"?: String,\n        \"cross_origin_score\"?: Long,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n}\n";
+export declare const GUARDRAILS_SCHEMA = "// =============================================================================\n// Guardrails Cedar Schema\n// =============================================================================\n// Defines entity types, actions, and context attributes for the highflame-shield\n// guardrails service. This schema enables type-safe policy authoring and\n// validation in both Studio UI and backend.\n//\n// Service: highflame-shield (guardrails)\n// Namespace: Guardrails\n// =============================================================================\n\nnamespace Guardrails {\n    // =========================================================================\n    // Entity Types \u2014 ReBAC Hierarchy\n    // =========================================================================\n    // Entity hierarchy enables Cedar's `in` operator for policy scoping:\n    //   Account (org root)\n    //     \u2514\u2500\u2500 Project in [Account]\n    //           \u251C\u2500\u2500 App in [Project]\n    //           \u2502     \u2514\u2500\u2500 Session in [App, Agent]\n    //           \u2514\u2500\u2500 Agent in [Project]\n    //                 \u2514\u2500\u2500 Session in [App, Agent]\n    //\n    // Policy scoping examples:\n    //   resource == Guardrails::App::\"<uuid>\"              \u2192 app-scoped (app only)\n    //   resource == Guardrails::Agent::\"<agent_id>\"        \u2192 agent-only (exact match)\n    //   resource in Guardrails::Agent::\"<agent_id>\"        \u2192 agent + its sessions\n    //   resource in Guardrails::Project::\"<uuid>\"          \u2192 project-wide (apps + agents)\n    //   resource in Guardrails::Account::\"<uuid>\"          \u2192 org-wide\n    // =========================================================================\n\n    /// Account represents an organization (top-level tenant)\n    entity Account;\n\n    /// Project represents a project within an account\n    entity Project in [Account];\n\n    /// User represents a principal (human or service) making requests\n    entity User;\n\n    /// Agent represents an AI agent (Claude, Cursor, Copilot, etc.) making requests.\n    /// Used as both principal (who is acting) and resource (policy scoping target).\n    /// Agent + sessions: resource in Guardrails::Agent::\"<agent_id>\" (hierarchy match)\n    /// Agent only:       resource == Guardrails::Agent::\"<agent_id>\" (exact match)\n    entity Agent in [Project];\n\n    /// App represents a protected application (guardrails-enabled LLM app)\n    entity App in [Project];\n\n    /// Session represents an agentic conversation session with state tracking.\n    /// Sessions can belong to either an App or an Agent.\n    entity Session in [App, Agent];\n\n    // =========================================================================\n    // Actions\n    // =========================================================================\n\n    /// Process user prompts and AI responses for security threats and content violations\n    action \"process_prompt\" appliesTo {\n        principal: [User, Agent],\n        resource: [App, Agent, Session],\n        context: ProcessPromptContext\n    };\n\n    /// Execute tool calls (shell, file operations, MCP tools)\n    action \"call_tool\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: CallToolContext\n    };\n\n    /// Read file operations\n    action \"read_file\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: FileReadContext\n    };\n\n    /// Write file operations\n    action \"write_file\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: FileWriteContext\n    };\n\n    /// Connect to an MCP server\n    action \"connect_server\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: ConnectServerContext\n    };\n\n    // =========================================================================\n    // Context Types (Action-Specific)\n    // =========================================================================\n\n    /// Context for process_prompt action (user prompts & AI responses)\n    type ProcessPromptContext = {\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n        \"direction\": String,        // \"input\" | \"output\"\n        \"content_type\": String,     // \"prompt\" | \"response\" | \"tool_call\" | \"file\"\n        \"detector_count\": Long,\n\n        // Security - Injection & Jailbreak (optional)\n        \"injection_confidence\"?: Long,  // Combined injection confidence: MAX(pulse, deep_context)\n        \"jailbreak_confidence\"?: Long,  // Combined jailbreak confidence: MAX(pulse, deep_context)\n        \"injection_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"injection_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n        \"jailbreak_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"jailbreak_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n        \"injection_type\"?: String,       // \"prompt\" | \"sql\" | \"command\" | \"none\"\n\n        // Privacy - Secrets (optional)\n        \"contains_secrets\"?: Bool,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,    // [\"aws_access_key\", \"github_token\", ...]\n\n        // Privacy - PII (optional)\n        \"pii_detected\"?: Bool,\n        \"pii_count\"?: Long,\n        \"pii_types\"?: Set<String>,       // [\"email\", \"phone\", \"ssn\", \"credit_card\", ...]\n        \"pii_confidence\"?: Long,         // PII ML classifier confidence (0-100) \u2014 catches novel PII patterns that escape regex detection\n\n        // Threat Severity Aggregation (optional)\n        \"highest_severity\"?: String,     // Highest severity across all detectors: \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n\n        // Trust & Safety - Toxicity (optional)\n        \"violence_score\"?: Long,         // 0-100\n        \"hate_speech_score\"?: Long,      // 0-100\n        \"sexual_score\"?: Long,           // 0-100\n        \"weapons_score\"?: Long,          // 0-100\n        \"crime_score\"?: Long,            // 0-100\n        \"profanity_score\"?: Long,        // 0-100\n\n        // Semantic - Topic Classification (optional)\n        \"content_topics\"?: Set<String>,      // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n        \"topic_confidence\"?: Long,           // 0-100\n\n        // Security - Invisible Character Detection (optional)\n        \"contains_invisible_chars\"?: Bool,\n        \"invisible_chars_score\"?: Long,      // 0-100\n\n        // Security - Pattern Detection (optional)\n        \"command_injection_detected\"?: Bool,\n        \"command_injection_type\"?: String,       // \"reverse_shell\" | \"privilege_escalation\" | \"code_execution\" | \"destructive_command\" | \"data_exfiltration\"\n        \"command_injection_score\"?: Long,        // 0-100\n        \"path_traversal_detected\"?: Bool,\n        \"path_traversal_severity\"?: String,      // \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n        \"path_traversal_type\"?: String,\n        \"sql_injection_detected\"?: Bool,\n        \"sql_injection_type\"?: String,           // \"tautology\" | \"union_based\" | \"destructive\" | \"blind\" | \"error_based\"\n        \"sql_injection_score\"?: Long,            // 0-100\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Bool,\n        \"cross_origin_type\"?: String,            // \"cross_origin_tool\" | \"cross_origin_server\" | \"none\"\n        \"cross_origin_score\"?: Long,             // 0-100\n\n        // Security - Encoded Injection (optional)\n        \"encoded_content_detected\"?: Bool,\n        \"encoded_types\"?: Set<String>,           // [\"base64\", \"hex\", \"unicode\", \"url\", ...]\n        \"encoded_count\"?: Long,\n        \"encoded_score\"?: Long,                  // 0-100\n\n        // Language & Script Detection (optional)\n        \"detected_language\"?: String,            // ISO language code\n        \"is_english\"?: Bool,\n        \"language_confidence\"?: Long,            // 0-100\n        \"detected_script\"?: String,              // \"latin\" | \"cyrillic\" | \"arabic\" | \"unknown\" | ...\n        \"is_latin_script\"?: Bool,\n        \"script_confidence\"?: Long,              // 0-100\n\n        // Content Analysis (optional)\n        \"hallucination_score\"?: Long,\n        \"factuality_score\"?: Long,               // 0-100\n        \"sentiment_score\"?: Long,\n        \"contains_code\"?: Bool,\n        \"code_languages\"?: Set<String>,\n        \"code_ratio\"?: Long,                     // 0-100, percentage of content that is code\n        \"keyword_matched\"?: Bool,\n        \"keyword_categories\"?: Set<String>,\n        \"keyword_count\"?: Long,\n        \"contains_non_ascii\"?: Bool,\n        \"phishing_detected\"?: Bool,\n        \"content_safety_score\"?: Long,           // 0-100\n        \"content_safety_blocked\"?: Bool,\n\n        // Agentic - Multi-Turn Context (optional)\n        \"conversation_turn\"?: Long,\n        \"multi_turn_detection\"?: Bool,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        // Present when the request is made by an AI agent (API key or JWT with agent claims).\n        // Empty strings for human user requests. Use these to write agent-specific policies.\n        \"agent_id\"?: String,             // Unique agent identifier (e.g., \"agent_research_v3\")\n        \"agent_type\"?: String,           // \"orchestrator\" | \"autonomous\" | \"tool_agent\" | \"human_proxy\"\n        \"agent_trust_level\"?: String,    // \"first_party\" | \"verified_third_party\" | \"unverified\"\n        \"agent_framework\"?: String,      // Agent framework (e.g., \"claude-code\", \"langchain\", \"crewai\")\n        \"agent_publisher\"?: String,      // Organization that published the agent\n\n    };\n\n    /// Context for call_tool action (agentic tool execution)\n    type CallToolContext = {\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // Tool Risk (optional)\n        \"tool_name\"?: String,            // \"shell\", \"write_file\", \"http_post\", etc.\n        \"tool_risk_score\"?: Long,        // 0-100\n        \"tool_is_sensitive\"?: Bool,\n        \"tool_category\"?: String,        // \"safe\" | \"sensitive\" | \"dangerous\"\n        \"tool_is_builtin\"?: Bool,\n\n        // MCP context (optional \u2014 only present for MCP tool calls)\n        \"mcp_server\"?: String,           // MCP server name (e.g., \"github\", \"filesystem\")\n        \"mcp_tool\"?: String,             // MCP tool name within the server\n        \"mcp_server_verified\"?: Bool,    // Whether server is from verified registry\n\n        // Agentic - Behavioral Patterns (optional)\n        \"suspicious_pattern\"?: Bool,\n        \"pattern_type\"?: String,         // \"data_exfiltration\" | \"secret_exfiltration\" | \"db_exfiltration\" | \"credential_theft\" | \"destructive_sequence\" | \"none\"\n        \"sequence_risk\"?: Long,          // 0-100\n\n        // Agentic - Loop Detection (optional)\n        \"loop_detected\"?: Bool,\n        \"loop_count\"?: Long,\n        \"loop_tool\"?: String,\n\n        // Agentic - Budget Control (optional)\n        \"budget_remaining_pct\"?: Long,   // 0-100\n        \"budget_exceeded\"?: Bool,\n\n        // Semantic - Topic Classification (optional)\n        \"content_topics\"?: Set<String>,      // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n        \"topic_confidence\"?: Long,           // 0-100\n\n        // Security checks on tool arguments (optional)\n        \"contains_secrets\"?: Bool,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Bool,\n        \"pii_types\"?: Set<String>,\n        \"pii_count\"?: Long,              // Number of PII pattern matches in tool content\n        \"pii_confidence\"?: Long,         // PII ML classifier confidence (0-100)\n        \"injection_confidence\"?: Long,\n        \"injection_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"injection_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n\n        // Security - Pattern Detection (optional)\n        \"command_injection_detected\"?: Bool,\n        \"command_injection_type\"?: String,\n        \"command_injection_score\"?: Long,        // 0-100\n        \"path_traversal_detected\"?: Bool,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n        \"sql_injection_detected\"?: Bool,\n        \"sql_injection_type\"?: String,\n        \"sql_injection_score\"?: Long,            // 0-100\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Bool,\n        \"cross_origin_type\"?: String,\n        \"cross_origin_score\"?: Long,             // 0-100\n\n        // File & Path (optional \u2014 for path-based access control policies)\n        \"path\"?: String,                         // File path when tool operates on files\n\n        // Security - Invisible Character Detection in tool args (optional)\n        \"contains_invisible_chars\"?: Bool,       // Whether invisible Unicode chars detected in tool args\n        \"invisible_chars_score\"?: Long,          // Invisible character attack severity (0-100)\n\n        // Security - Encoded Injection (optional)\n        \"encoded_content_detected\"?: Bool,\n        \"encoded_types\"?: Set<String>,\n        \"encoded_count\"?: Long,\n        \"encoded_score\"?: Long,                  // 0-100\n\n        // Agentic - Agent Security (optional)\n        \"tool_poisoning_detected\"?: Bool,\n        \"tool_poisoning_score\"?: Long,           // 0-100\n        \"tool_poisoning_type\"?: String,          // \"hidden_instructions\" | \"system_prompt_injection\" | \"authority_hijack\"\n        \"rug_pull_detected\"?: Bool,\n        \"rug_pull_score\"?: Long,                 // 0-100\n        \"rug_pull_type\"?: String,                // \"risk_spike\" | \"pattern_change\" | \"combined\" | \"none\"\n\n        // Agentic - Indirect Prompt Injection (optional \u2014 injection via tool outputs/retrieved content)\n        \"indirect_injection_score\"?: Long,       // Indirect injection risk score (0-100)\n        \"indirect_injection_type\"?: String,      // Type of indirect injection detected\n\n        // Agentic - MCP Risk (optional)\n        \"mcp_config_risk\"?: Bool,\n        \"mcp_risk_type\"?: String,                // \"inline_execution\" | \"suspicious_url\" | \"cross_origin\"\n        \"mcp_risk_score\"?: Long,                 // 0-100\n\n        // Agentic - Multi-Turn Context (optional)\n        \"conversation_turn\"?: Long,\n        \"multi_turn_detection\"?: Bool,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for read_file action\n    type FileReadContext = {\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // File path (optional \u2014 for path-based access control policies)\n        \"path\"?: String,                 // File path being read\n\n        // Security checks on file content (optional)\n        \"contains_secrets\"?: Bool,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Bool,\n        \"pii_types\"?: Set<String>,\n\n        // Security - Path Traversal (optional)\n        \"path_traversal_detected\"?: Bool,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for write_file action\n    type FileWriteContext = {\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // File path (optional \u2014 for path-based access control policies)\n        \"path\"?: String,                         // File path being written\n\n        // Security - Invisible Character Detection in write content (optional)\n        \"contains_invisible_chars\"?: Bool,       // Whether invisible Unicode chars detected in write content\n        \"invisible_chars_score\"?: Long,          // Invisible character attack severity (0-100)\n\n        // Security checks on content being written (optional)\n        \"contains_secrets\"?: Bool,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Bool,\n        \"pii_types\"?: Set<String>,\n\n        // Security - Path Traversal (optional)\n        \"path_traversal_detected\"?: Bool,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for connect_server action (MCP server connections)\n    type ConnectServerContext = {\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // MCP context (optional)\n        \"mcp_server\"?: String,           // MCP server name (e.g., \"github\", \"filesystem\")\n        \"mcp_server_verified\"?: Bool,    // Whether server is from verified registry\n\n        // Agentic - Agent Security (optional)\n        \"tool_poisoning_detected\"?: Bool,\n        \"tool_poisoning_score\"?: Long,\n        \"tool_poisoning_type\"?: String,\n\n        // Agentic - MCP Risk (optional)\n        \"mcp_config_risk\"?: Bool,\n        \"mcp_risk_type\"?: String,\n        \"mcp_risk_score\"?: Long,\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Bool,\n        \"cross_origin_type\"?: String,\n        \"cross_origin_score\"?: Long,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n}\n";
 /**
  * Overwatch Cedar schema
  *
@@ -21,7 +21,7 @@ export declare const PALISADE_SCHEMA = "// Palisade Cedar Schema\n// ===========
  *
  * Full Cedar schema for sentry, embedded at codegen time.
  */
-export declare const SENTRY_SCHEMA = "// =============================================================================\n// Sentry Cedar Schema\n// =============================================================================\n// Browser Security \u2014 monitors AI chat interactions in the browser and enforces\n// data-protection, content-safety, and compliance policies at point of use.\n//\n// Sentry is a lightweight browser extension (JSA) that intercepts:\n//   - Messages sent to AI chat services (ChatGPT, Gemini, Claude, Copilot, etc.)\n//   - AI responses returned to the user\n//   - Cut/paste operations transferring content into AI chats\n//   - File/document uploads into AI chat services\n//\n// Architecture:\n//   User \u2192 Browser Extension \u2192 Shield Detection Engine \u2192 Cedar Policy \u2192 Allow/Block\n//\n// Threat Coverage:\n//   - Data Leakage: PII, PHI, credentials, source code, confidential documents\n//   - Content Safety: Violence, hate speech, sexual content, restricted topics\n//   - Prompt Injection: Direct and indirect injection via pasted/uploaded content\n//   - Document Sensitivity: MIP label enforcement, classification-aware blocking\n//   - Compliance: GDPR, HIPAA, PCI DSS, CCPA, EU AI Act\n//\n// Supported AI Services:\n//   - ChatGPT (chat.openai.com)\n//   - Google Gemini (gemini.google.com)\n//   - Claude (claude.ai)\n//   - GitHub Copilot Chat\n//   - Microsoft Copilot\n//   - Custom/enterprise AI chat endpoints\n\nnamespace Sentry {\n\n// =============================================================================\n// ENTITIES - Tenant Hierarchy (ReBAC)\n// =============================================================================\n// Aligned with Guardrails/Overwatch entity hierarchy (Account -> Project).\n//\n// Entity hierarchy enables Cedar's `in` operator for policy scoping:\n//   Account (org root)\n//     \u2514\u2500\u2500 Project in [Account]\n//           \u2514\u2500\u2500 ChatSession in [Project]\n//\n// Policy scoping examples:\n//   resource in Sentry::Account::\"<uuid>\"    \u2192 org-wide\n//   resource in Sentry::Project::\"<uuid>\"    \u2192 project-wide\n//   resource == Sentry::ChatSession::\"<id>\"  \u2192 specific session\n\n/// Account represents an organization (top-level tenant)\nentity Account;\n\n/// Project represents a project within an account\nentity Project in [Account];\n\n// =============================================================================\n// ENTITIES - Principals\n// =============================================================================\n\n/// Human user interacting with AI chat in the browser\nentity User;\n\n// =============================================================================\n// ENTITIES - Resources (scoped under Project)\n// =============================================================================\n\n/// AI chat session \u2014 resource for send_message and receive_response actions\nentity ChatSession in [Project];\n\n/// Document or file being uploaded \u2014 resource for upload_file action\nentity Document in [Project];\n\n// =============================================================================\n// ACTIONS\n// =============================================================================\n\n// User sends a message (prompt) to an AI chat service\n// Threat focus: data leakage (PII, secrets, confidential data), injection, content safety\naction send_message appliesTo {\n  principal: [User],\n  resource: [ChatSession],\n  context: {\n    // --- Core Metadata ---\n    content: String,                  // Raw message content being sent\n    source: String,                   // Browser extension identifier: \"sentry\"\n    event: String,                    // Event type: \"send_message\"\n    user_email: String,               // User identifier (SSO/OAuth verified)\n    target_app: String,               // AI service: \"chatgpt\", \"gemini\", \"claude\", \"copilot\", \"custom\"\n    target_url?: String,              // Full URL of the AI chat service\n\n    // --- Aggregated Threat Summary (from Shield NormalizeAggregation) ---\n    threat_count: Long,               // Total threats detected\n    highest_severity: String,         // \"critical\", \"high\", \"medium\", \"low\", \"none\"\n    threat_categories: Set<String>,   // Threat category names\n    detected_threats: Set<String>,    // Detection rule names that matched\n    max_threat_severity: Long,        // Numeric severity (0=none, 1=low, 2=medium, 3=high, 4=critical)\n\n    // --- Secrets Detection (from SecretsDetector) ---\n    contains_secrets: Bool,           // Whether secrets/credentials detected\n    secret_types?: Set<String>,       // Types: \"aws_access_key\", \"github_token\", \"ssh_private_key\", etc.\n    secret_count?: Long,              // Number of distinct secrets found\n\n    // --- PII Detection (from PIIRegexDetector, normalized) ---\n    pii_detected?: Bool,              // Whether any PII patterns matched\n    pii_types?: Set<String>,          // Types: \"ssn\", \"credit_card\", \"email\", \"phone\", etc.\n    pii_count?: Long,                 // Number of PII matches\n    pii_confidence?: Long,            // PII detection confidence (0-100)\n\n    // --- Content Safety Scores (from ToxicityDetector, 0-100) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    injection_score: Long,            // Prompt injection score (max of InjectionDetector + DeepContextDetector)\n    jailbreak_score: Long,            // Jailbreak detection score (max of JailbreakDetector + DeepContextDetector)\n\n    // --- Topic Classification (from TopicDetector) ---\n    content_topics?: Set<String>,     // Detected topics: \"controlled_substances\", \"weapons_manufacturing\", etc.\n    topic_confidence?: Long,          // Topic classifier confidence (0-100)\n\n    // --- Encoding & Unicode Attacks (from SecurityFiltersDetector, EncodedInjectionDetector) ---\n    contains_invisible_chars?: Bool,  // Zero-width chars, bidi overrides, tag chars\n    invisible_chars_score?: Long,     // Unicode attack severity (0-100)\n    encoded_content_detected?: Bool,  // Base64, hex, unicode, URL encoded content\n    encoded_types?: Set<String>,      // Encoding types detected\n    encoded_count?: Long,             // Number of encoded segments\n    encoded_score?: Long,             // Encoded injection severity (0-100)\n\n    // --- Code Detection (from CodeDetector) ---\n    contains_code?: Bool,             // Whether content contains source code\n    code_languages?: Set<String>,     // Detected languages: \"python\", \"javascript\", etc.\n    code_ratio?: Long,                // Percentage of content that is code (0-100)\n\n    // --- Language Detection (from LanguageDetector, ScriptDetector) ---\n    detected_language?: String,       // ISO language code\n    is_english?: Bool,\n    language_confidence?: Long,       // 0-100\n    detected_script?: String,         // \"latin\", \"cyrillic\", \"arabic\", \"unknown\"\n    is_latin_script?: Bool,\n    script_confidence?: Long,         // 0-100\n\n    // --- Keyword Detection (from KeywordDetector) ---\n    keyword_matched?: Bool,           // Whether any keywords matched\n    keyword_categories?: Set<String>, // Matched keyword categories\n    keyword_count?: Long,             // Number of keyword matches\n\n    // --- Phishing Detection (from CheckPhishDetector) ---\n    phishing_detected?: Bool,         // Whether phishing URLs detected in content\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_threat_turns?: Long,\n  },\n};\n\n// AI service responds to the user\n// Threat focus: harmful content in responses, hallucination, data leakage in output\naction receive_response appliesTo {\n  principal: [User],\n  resource: [ChatSession],\n  context: {\n    // --- Core Metadata ---\n    content: String,                  // AI response content\n    source: String,\n    event: String,                    // \"receive_response\"\n    user_email: String,\n    target_app: String,\n    target_url?: String,\n\n    // --- Aggregated Threat Summary ---\n    threat_count: Long,\n    highest_severity: String,\n    threat_categories: Set<String>,\n    detected_threats: Set<String>,\n    max_threat_severity: Long,\n\n    // --- Secrets Detection ---\n    contains_secrets: Bool,\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_confidence?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Scores (0-100) ---\n    injection_score: Long,            // Indirect injection in response content\n    jailbreak_score: Long,\n\n    // --- Hallucination Detection (from HallucinationDetector) ---\n    hallucination_score?: Long,       // Hallucination confidence (0-100)\n    factuality_score?: Long,          // Factuality score (0-100)\n\n    // --- Code in Response ---\n    contains_code?: Bool,\n    code_languages?: Set<String>,\n    code_ratio?: Long,\n\n    // --- Phishing ---\n    phishing_detected?: Bool,\n\n    // --- Session History ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_threat_turns?: Long,\n  },\n};\n\n// User pastes content into an AI chat (clipboard, cross-tab, cross-app)\n// Threat focus: data leakage via cut/paste, injection payloads in pasted content\naction paste_content appliesTo {\n  principal: [User],\n  resource: [ChatSession],\n  context: {\n    // --- Core Metadata ---\n    content: String,                  // Pasted content\n    source: String,\n    event: String,                    // \"paste_content\"\n    user_email: String,\n    target_app: String,\n    target_url?: String,\n\n    // --- Paste Context ---\n    paste_source_app?: String,        // Source application (e.g., \"outlook\", \"excel\", \"vscode\", \"terminal\")\n    paste_source_url?: String,        // Source URL if from another browser tab\n    paste_length?: Long,              // Character length of pasted content\n\n    // --- Aggregated Threat Summary ---\n    threat_count: Long,\n    highest_severity: String,\n    threat_categories: Set<String>,\n    detected_threats: Set<String>,\n    max_threat_severity: Long,\n\n    // --- Secrets Detection ---\n    contains_secrets: Bool,\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_confidence?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Scores (0-100) ---\n    injection_score: Long,\n    jailbreak_score: Long,\n\n    // --- Code Detection ---\n    contains_code?: Bool,\n    code_languages?: Set<String>,\n    code_ratio?: Long,\n\n    // --- Encoding Attacks ---\n    contains_invisible_chars?: Bool,\n    invisible_chars_score?: Long,\n    encoded_content_detected?: Bool,\n    encoded_types?: Set<String>,\n    encoded_count?: Long,\n    encoded_score?: Long,\n\n    // --- Keyword Detection ---\n    keyword_matched?: Bool,\n    keyword_categories?: Set<String>,\n    keyword_count?: Long,\n\n    // --- Session History ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_threat_turns?: Long,\n  },\n};\n\n// User uploads a file or document into an AI chat\n// Threat focus: document sensitivity (MIP labels), PII/secrets in files, malware\naction upload_file appliesTo {\n  principal: [User],\n  resource: [Document, ChatSession],\n  context: {\n    // --- Core Metadata ---\n    content: String,                  // Extracted file text content (for scanning)\n    source: String,\n    event: String,                    // \"upload_file\"\n    user_email: String,\n    target_app: String,\n    target_url?: String,\n\n    // --- File Metadata ---\n    file_name?: String,               // Original file name\n    file_type?: String,               // MIME type: \"application/pdf\", \"text/csv\", etc.\n    file_size_bytes?: Long,           // File size in bytes\n    file_extension?: String,          // Extension: \"pdf\", \"docx\", \"xlsx\", \"csv\", \"txt\"\n\n    // --- Document Sensitivity (MIP Labels) ---\n    mip_label_id?: String,            // Microsoft Information Protection label ID\n    mip_label_name?: String,          // Label display name: \"Public\", \"Internal\", \"Confidential\", \"Highly Confidential\"\n    sensitivity_level?: String,       // Normalized: \"public\", \"internal\", \"confidential\", \"restricted\"\n    is_encrypted?: Bool,              // Whether file is encrypted (MIP protection)\n    is_rights_managed?: Bool,         // Whether file has rights management restrictions\n\n    // --- Aggregated Threat Summary ---\n    threat_count: Long,\n    highest_severity: String,\n    threat_categories: Set<String>,\n    detected_threats: Set<String>,\n    max_threat_severity: Long,\n\n    // --- Secrets Detection ---\n    contains_secrets: Bool,\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_confidence?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Scores (0-100) ---\n    injection_score: Long,            // Prompt injection payloads hidden in documents\n    jailbreak_score: Long,\n\n    // --- Code Detection ---\n    contains_code?: Bool,\n    code_languages?: Set<String>,\n    code_ratio?: Long,\n\n    // --- Phishing ---\n    phishing_detected?: Bool,\n\n    // --- Encoding Attacks ---\n    contains_invisible_chars?: Bool,\n    invisible_chars_score?: Long,\n    encoded_content_detected?: Bool,\n    encoded_types?: Set<String>,\n    encoded_count?: Long,\n    encoded_score?: Long,\n\n    // --- Session History ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_threat_turns?: Long,\n  },\n};\n\n}\n";
+export declare const SENTRY_SCHEMA = "// =============================================================================\n// Sentry Cedar Schema\n// =============================================================================\n// Browser Security \u2014 monitors AI chat interactions in the browser and enforces\n// data-protection, content-safety, and compliance policies at point of use.\n//\n// Sentry is a lightweight browser extension (JSA) that intercepts:\n//   - Messages sent to AI chat services (ChatGPT, Gemini, Claude, Copilot, etc.)\n//   - AI responses returned to the user\n//   - Cut/paste operations transferring content into AI chats\n//   - File/document uploads into AI chat services\n//\n// Architecture:\n//   User \u2192 Browser Extension \u2192 Shield Detection Engine \u2192 Cedar Policy \u2192 Allow/Block\n//\n// Threat Coverage:\n//   - Data Leakage: PII, PHI, credentials, source code, confidential documents\n//   - Content Safety: Violence, hate speech, sexual content, restricted topics\n//   - Prompt Injection: Direct and indirect injection via pasted/uploaded content\n//   - Document Sensitivity: MIP label enforcement, classification-aware blocking\n//   - Compliance: GDPR, HIPAA, PCI DSS, CCPA, EU AI Act\n//\n// Supported AI Services:\n//   - ChatGPT (chat.openai.com)\n//   - Google Gemini (gemini.google.com)\n//   - Claude (claude.ai)\n//   - GitHub Copilot Chat\n//   - Microsoft Copilot\n//   - Custom/enterprise AI chat endpoints\n\nnamespace Sentry {\n\n// =============================================================================\n// ENTITIES - Tenant Hierarchy (ReBAC)\n// =============================================================================\n// Aligned with Guardrails/Overwatch entity hierarchy (Account -> Project).\n//\n// Entity hierarchy enables Cedar's `in` operator for policy scoping:\n//   Account (org root)\n//     \u2514\u2500\u2500 Project in [Account]\n//           \u2514\u2500\u2500 ChatSession in [Project]\n//\n// Policy scoping examples:\n//   resource in Sentry::Account::\"<uuid>\"    \u2192 org-wide\n//   resource in Sentry::Project::\"<uuid>\"    \u2192 project-wide\n//   resource == Sentry::ChatSession::\"<id>\"  \u2192 specific session\n\n/// Account represents an organization (top-level tenant)\nentity Account;\n\n/// Project represents a project within an account\nentity Project in [Account];\n\n// =============================================================================\n// ENTITIES - Principals\n// =============================================================================\n\n/// Human user interacting with AI chat in the browser\nentity User;\n\n// =============================================================================\n// ENTITIES - Resources (scoped under Project)\n// =============================================================================\n\n/// AI chat session \u2014 resource for send_message and receive_response actions\nentity ChatSession in [Project];\n\n/// Document or file being uploaded \u2014 resource for upload_file action\nentity Document in [Project];\n\n// =============================================================================\n// ACTIONS\n// =============================================================================\n\n// User sends a message (prompt) to an AI chat service\n// Threat focus: data leakage (PII, secrets, confidential data), injection, content safety\naction send_message appliesTo {\n  principal: [User],\n  resource: [ChatSession],\n  context: {\n    // --- Core Metadata ---\n    content: String,                  // Raw message content being sent\n    source: String,                   // Browser extension identifier: \"sentry\"\n    event: String,                    // Event type: \"send_message\"\n    user_email: String,               // User identifier (SSO/OAuth verified)\n    target_app: String,               // AI service: \"chatgpt\", \"gemini\", \"claude\", \"copilot\", \"custom\"\n    target_url?: String,              // Full URL of the AI chat service\n\n    // --- Aggregated Threat Summary (from Shield NormalizeAggregation) ---\n    threat_count: Long,               // Total threats detected\n    highest_severity: String,         // \"critical\", \"high\", \"medium\", \"low\", \"none\"\n    threat_categories: Set<String>,   // Threat category names\n    detected_threats: Set<String>,    // Detection rule names that matched\n    max_threat_severity: Long,        // Numeric severity (0=none, 1=low, 2=medium, 3=high, 4=critical)\n\n    // --- Secrets Detection (from SecretsDetector) ---\n    contains_secrets: Bool,           // Whether secrets/credentials detected\n    secret_types?: Set<String>,       // Types: \"aws_access_key\", \"github_token\", \"ssh_private_key\", etc.\n    secret_count?: Long,              // Number of distinct secrets found\n\n    // --- PII Detection (from PIIRegexDetector, normalized) ---\n    pii_detected?: Bool,              // Whether any PII patterns matched\n    pii_types?: Set<String>,          // Types: \"ssn\", \"credit_card\", \"email\", \"phone\", etc.\n    pii_count?: Long,                 // Number of PII matches\n    pii_confidence?: Long,            // PII detection confidence (0-100)\n\n    // --- Content Safety Scores (from ToxicityDetector, 0-100) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    injection_score: Long,            // Prompt injection score (max of InjectionDetector + DeepContextDetector)\n    jailbreak_score: Long,            // Jailbreak detection score (max of JailbreakDetector + DeepContextDetector)\n\n    // --- Topic Classification (from TopicDetector) ---\n    content_topics?: Set<String>,     // Detected topics: \"controlled_substances\", \"weapons_manufacturing\", etc.\n    topic_confidence?: Long,          // Topic classifier confidence (0-100)\n\n    // --- Encoding & Unicode Attacks (from SecurityFiltersDetector, EncodedInjectionDetector) ---\n    contains_invisible_chars?: Bool,  // Zero-width chars, bidi overrides, tag chars\n    invisible_chars_score?: Long,     // Unicode attack severity (0-100)\n    encoded_content_detected?: Bool,  // Base64, hex, unicode, URL encoded content\n    encoded_types?: Set<String>,      // Encoding types detected\n    encoded_count?: Long,             // Number of encoded segments\n    encoded_score?: Long,             // Encoded injection severity (0-100)\n\n    // --- Code Detection (from CodeDetector) ---\n    contains_code?: Bool,             // Whether content contains source code\n    code_languages?: Set<String>,     // Detected languages: \"python\", \"javascript\", etc.\n    code_ratio?: Long,                // Percentage of content that is code (0-100)\n\n    // --- Language Detection (from LanguageDetector, ScriptDetector) ---\n    detected_language?: String,       // ISO language code\n    is_english?: Bool,\n    language_confidence?: Long,       // 0-100\n    detected_script?: String,         // \"latin\", \"cyrillic\", \"arabic\", \"unknown\"\n    is_latin_script?: Bool,\n    script_confidence?: Long,         // 0-100\n\n    // --- Keyword Detection (from KeywordDetector) ---\n    keyword_matched?: Bool,           // Whether any keywords matched\n    keyword_categories?: Set<String>, // Matched keyword categories\n    keyword_count?: Long,             // Number of keyword matches\n\n    // --- Phishing Detection (from CheckPhishDetector) ---\n    phishing_detected?: Bool,         // Whether phishing URLs detected in content\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_threat_turns?: Long,\n  },\n};\n\n// AI service responds to the user\n// Threat focus: harmful content in responses, hallucination, data leakage in output\naction receive_response appliesTo {\n  principal: [User],\n  resource: [ChatSession],\n  context: {\n    // --- Core Metadata ---\n    content: String,                  // AI response content\n    source: String,\n    event: String,                    // \"receive_response\"\n    user_email: String,\n    target_app: String,\n    target_url?: String,\n\n    // --- Aggregated Threat Summary ---\n    threat_count: Long,\n    highest_severity: String,\n    threat_categories: Set<String>,\n    detected_threats: Set<String>,\n    max_threat_severity: Long,\n\n    // --- Secrets Detection ---\n    contains_secrets: Bool,\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_confidence?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Scores (0-100) ---\n    injection_score: Long,            // Indirect injection in response content\n    jailbreak_score: Long,\n\n    // --- Hallucination Detection (from HallucinationDetector) ---\n    hallucination_score?: Long,       // Hallucination confidence (0-100)\n    factuality_score?: Long,          // Factuality score (0-100)\n\n    // --- Code in Response ---\n    contains_code?: Bool,\n    code_languages?: Set<String>,\n    code_ratio?: Long,\n\n    // --- Phishing ---\n    phishing_detected?: Bool,\n\n    // --- Session History ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_threat_turns?: Long,\n  },\n};\n\n// User pastes content into an AI chat (clipboard, cross-tab, cross-app)\n// Threat focus: data leakage via cut/paste, injection payloads in pasted content\naction paste_content appliesTo {\n  principal: [User],\n  resource: [ChatSession, Document],\n  context: {\n    // --- Core Metadata ---\n    content: String,                  // Pasted content\n    source: String,\n    event: String,                    // \"paste_content\"\n    user_email: String,\n    target_app: String,\n    target_url?: String,\n\n    // --- Paste Context ---\n    paste_source_app?: String,        // Source application (e.g., \"outlook\", \"excel\", \"vscode\", \"terminal\")\n    paste_source_url?: String,        // Source URL if from another browser tab\n    paste_length?: Long,              // Character length of pasted content\n\n    // --- Aggregated Threat Summary ---\n    threat_count: Long,\n    highest_severity: String,\n    threat_categories: Set<String>,\n    detected_threats: Set<String>,\n    max_threat_severity: Long,\n\n    // --- Secrets Detection ---\n    contains_secrets: Bool,\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_confidence?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Scores (0-100) ---\n    injection_score: Long,\n    jailbreak_score: Long,\n\n    // --- Code Detection ---\n    contains_code?: Bool,\n    code_languages?: Set<String>,\n    code_ratio?: Long,\n\n    // --- Encoding Attacks ---\n    contains_invisible_chars?: Bool,\n    invisible_chars_score?: Long,\n    encoded_content_detected?: Bool,\n    encoded_types?: Set<String>,\n    encoded_count?: Long,\n    encoded_score?: Long,\n\n    // --- Keyword Detection ---\n    keyword_matched?: Bool,\n    keyword_categories?: Set<String>,\n    keyword_count?: Long,\n\n    // --- Session History ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_threat_turns?: Long,\n  },\n};\n\n// User uploads a file or document into an AI chat\n// Threat focus: document sensitivity (MIP labels), PII/secrets in files, malware\naction upload_file appliesTo {\n  principal: [User],\n  resource: [Document, ChatSession],\n  context: {\n    // --- Core Metadata ---\n    content: String,                  // Extracted file text content (for scanning)\n    source: String,\n    event: String,                    // \"upload_file\"\n    user_email: String,\n    target_app: String,\n    target_url?: String,\n\n    // --- File Metadata ---\n    file_name?: String,               // Original file name\n    file_type?: String,               // MIME type: \"application/pdf\", \"text/csv\", etc.\n    file_size_bytes?: Long,           // File size in bytes\n    file_extension?: String,          // Extension: \"pdf\", \"docx\", \"xlsx\", \"csv\", \"txt\"\n\n    // --- Document Sensitivity (MIP Labels) ---\n    mip_label_id?: String,            // Microsoft Information Protection label ID\n    mip_label_name?: String,          // Label display name: \"Public\", \"Internal\", \"Confidential\", \"Highly Confidential\"\n    sensitivity_level?: String,       // Normalized: \"public\", \"internal\", \"confidential\", \"restricted\"\n    is_encrypted?: Bool,              // Whether file is encrypted (MIP protection)\n    is_rights_managed?: Bool,         // Whether file has rights management restrictions\n\n    // --- Aggregated Threat Summary ---\n    threat_count: Long,\n    highest_severity: String,\n    threat_categories: Set<String>,\n    detected_threats: Set<String>,\n    max_threat_severity: Long,\n\n    // --- Secrets Detection ---\n    contains_secrets: Bool,\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_confidence?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Scores (0-100) ---\n    injection_score: Long,            // Prompt injection payloads hidden in documents\n    jailbreak_score: Long,\n\n    // --- Code Detection ---\n    contains_code?: Bool,\n    code_languages?: Set<String>,\n    code_ratio?: Long,\n\n    // --- Phishing ---\n    phishing_detected?: Bool,\n\n    // --- Encoding Attacks ---\n    contains_invisible_chars?: Bool,\n    invisible_chars_score?: Long,\n    encoded_content_detected?: Bool,\n    encoded_types?: Set<String>,\n    encoded_count?: Long,\n    encoded_score?: Long,\n\n    // --- Session History ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_threat_turns?: Long,\n  },\n};\n\n}\n";
 /**
  * Context attribute metadata for service actions.
  * Used by PolicyBuilder UI to generate form fields.

package/dist/service-schemas.gen.js

@@ -32,12 +32,16 @@ namespace Guardrails {
     // Entity hierarchy enables Cedar's \`in\` operator for policy scoping:
     //   Account (org root)
     //     └── Project in [Account]
-    //           └── App in [Project]
-    //                 └── Session in [App]
+    //           ├── App in [Project]
+    //           │     └── Session in [App, Agent]
+    //           └── Agent in [Project]
+    //                 └── Session in [App, Agent]
     //
     // Policy scoping examples:
-    //   resource == Guardrails::App::"<uuid>"              → app-scoped
-    //   resource in Guardrails::Project::"<uuid>"          → project-wide
+    //   resource == Guardrails::App::"<uuid>"              → app-scoped (app only)
+    //   resource == Guardrails::Agent::"<agent_id>"        → agent-only (exact match)
+    //   resource in Guardrails::Agent::"<agent_id>"        → agent + its sessions
+    //   resource in Guardrails::Project::"<uuid>"          → project-wide (apps + agents)
     //   resource in Guardrails::Account::"<uuid>"          → org-wide
     // =========================================================================
 
@@ -50,14 +54,18 @@ namespace Guardrails {
     /// User represents a principal (human or service) making requests
     entity User;
 
-    /// Agent represents an AI agent (Claude, Cursor, Copilot, etc.) making requests
-    entity Agent;
+    /// Agent represents an AI agent (Claude, Cursor, Copilot, etc.) making requests.
+    /// Used as both principal (who is acting) and resource (policy scoping target).
+    /// Agent + sessions: resource in Guardrails::Agent::"<agent_id>" (hierarchy match)
+    /// Agent only:       resource == Guardrails::Agent::"<agent_id>" (exact match)
+    entity Agent in [Project];
 
     /// App represents a protected application (guardrails-enabled LLM app)
     entity App in [Project];
 
-    /// Session represents an agentic conversation session with state tracking
-    entity Session in [App];
+    /// Session represents an agentic conversation session with state tracking.
+    /// Sessions can belong to either an App or an Agent.
+    entity Session in [App, Agent];
 
     // =========================================================================
     // Actions
@@ -66,35 +74,35 @@ namespace Guardrails {
     /// Process user prompts and AI responses for security threats and content violations
     action "process_prompt" appliesTo {
         principal: [User, Agent],
-        resource: [App, Session],
+        resource: [App, Agent, Session],
         context: ProcessPromptContext
     };
 
     /// Execute tool calls (shell, file operations, MCP tools)
     action "call_tool" appliesTo {
         principal: [User, Agent],
-        resource: [Session],
+        resource: [Agent, Session],
         context: CallToolContext
     };
 
     /// Read file operations
     action "read_file" appliesTo {
         principal: [User, Agent],
-        resource: [Session],
+        resource: [Agent, Session],
         context: FileReadContext
     };
 
     /// Write file operations
     action "write_file" appliesTo {
         principal: [User, Agent],
-        resource: [Session],
+        resource: [Agent, Session],
         context: FileWriteContext
     };
 
     /// Connect to an MCP server
     action "connect_server" appliesTo {
         principal: [User, Agent],
-        resource: [Session],
+        resource: [Agent, Session],
         context: ConnectServerContext
     };
 
@@ -1316,7 +1324,7 @@ action receive_response appliesTo {
 // Threat focus: data leakage via cut/paste, injection payloads in pasted content
 action paste_content appliesTo {
   principal: [User],
-  resource: [ChatSession],
+  resource: [ChatSession, Document],
   context: {
     // --- Core Metadata ---
     content: String,                  // Pasted content

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.1.11",
+  "version": "2.1.13",
   "description": "Highflame Cedar policy types and engine wrapper",
   "readme": "README.md",
   "main": "dist/index.js",