@highflame/policy 2.1.3 → 2.1.5

package/_schemas/guardrails/context.json

@@ -38,18 +38,40 @@
           "description": "Number of detectors that were executed for this request"
         },
         {
-          "key": "injection_score",
+          "key": "injection_confidence",
           "type": "number",
           "required": false,
-          "description": "ML-based confidence score for prompt injection attacks (0-100). Higher scores indicate higher confidence. Typical threshold: >85 for high-confidence blocks",
-          "range": "0-100"
+          "description": "Combined prompt injection confidence (0-100). MAX of all detector scores (Pulse + DeepContext). Use injection_pulse_score / injection_deep_context_score for individual detector control"
         },
         {
-          "key": "jailbreak_score",
+          "key": "jailbreak_confidence",
           "type": "number",
           "required": false,
-          "description": "ML-based confidence score for jailbreak attempts (0-100). Detects attempts to bypass safety guardrails. Typical threshold: >80 for blocks",
-          "range": "0-100"
+          "description": "Combined jailbreak detection confidence (0-100). MAX of all detector scores (Pulse + DeepContext). Use jailbreak_pulse_score / jailbreak_deep_context_score for individual detector control"
+        },
+        {
+          "key": "injection_pulse_score",
+          "type": "number",
+          "required": false,
+          "description": "Highflame single-turn classifier score for prompt injection (0-100). Raw score from Pulse detector before combination with deep-context. Use for per-detector policy control"
+        },
+        {
+          "key": "injection_deep_context_score",
+          "type": "number",
+          "required": false,
+          "description": "DeepContext multi-turn analyzer score for prompt injection (0-100). Tracks injection patterns across conversation history. Generally higher confidence than single-turn"
+        },
+        {
+          "key": "jailbreak_pulse_score",
+          "type": "number",
+          "required": false,
+          "description": "Highflame single-turn classifier score for jailbreak attempts (0-100). Raw score from Pulse detector before combination with deep-context"
+        },
+        {
+          "key": "jailbreak_deep_context_score",
+          "type": "number",
+          "required": false,
+          "description": "DeepContext multi-turn analyzer score for jailbreak attempts (0-100). Detects jailbreak escalation patterns across conversation turns"
         },
         {
           "key": "injection_type",
@@ -97,43 +119,37 @@
           "key": "violence_score",
           "type": "number",
           "required": false,
-          "description": "ML-based score for violent content references (0-100). Typical threshold: >90 for critical blocks, >60 for warnings",
-          "range": "0-100"
+          "description": "ML-based score for violent content references (0-100). Typical threshold: >90 for critical blocks, >60 for warnings"
         },
         {
           "key": "hate_speech_score",
           "type": "number",
           "required": false,
-          "description": "ML-based score for hate speech, discriminatory language, or targeted harassment (0-100). Typical threshold: >75 for blocks",
-          "range": "0-100"
+          "description": "ML-based score for hate speech, discriminatory language, or targeted harassment (0-100). Typical threshold: >75 for blocks"
         },
         {
           "key": "sexual_score",
           "type": "number",
           "required": false,
-          "description": "ML-based score for sexual or adult content (0-100). Adjust thresholds based on your application's audience",
-          "range": "0-100"
+          "description": "ML-based score for sexual or adult content (0-100). Adjust thresholds based on your application's audience"
         },
         {
           "key": "weapons_score",
           "type": "number",
           "required": false,
-          "description": "ML-based score for weapons references or violent imagery (0-100)",
-          "range": "0-100"
+          "description": "ML-based score for weapons references or violent imagery (0-100)"
         },
         {
           "key": "crime_score",
           "type": "number",
           "required": false,
-          "description": "ML-based score for criminal activity discussions (0-100)",
-          "range": "0-100"
+          "description": "ML-based score for criminal activity discussions (0-100)"
         },
         {
           "key": "profanity_score",
           "type": "number",
           "required": false,
-          "description": "ML-based score for profanity and vulgar language (0-100)",
-          "range": "0-100"
+          "description": "ML-based score for profanity and vulgar language (0-100)"
         },
         {
           "key": "content_topics",
@@ -145,8 +161,7 @@
           "key": "topic_confidence",
           "type": "number",
           "required": false,
-          "description": "Confidence score from topic classifier (0-100). Use with content_topics to tune sensitivity — higher thresholds reduce false positives",
-          "range": "0-100"
+          "description": "Confidence score from topic classifier (0-100). Use with content_topics to tune sensitivity — higher thresholds reduce false positives"
         },
         {
           "key": "contains_invisible_chars",
@@ -158,8 +173,7 @@
           "key": "invisible_chars_score",
           "type": "number",
           "required": false,
-          "description": "Density score for invisible characters in the content (0-100). Higher scores indicate more invisible characters, suggesting evasion attempts",
-          "range": "0-100"
+          "description": "Density score for invisible characters in the content (0-100). Higher scores indicate more invisible characters, suggesting evasion attempts"
         },
         {
           "key": "command_injection_detected",
@@ -177,8 +191,7 @@
           "key": "command_injection_score",
           "type": "number",
           "required": false,
-          "description": "Confidence score for command injection detection (0-100). Higher scores indicate stronger pattern matches",
-          "range": "0-100"
+          "description": "Confidence score for command injection detection (0-100). Higher scores indicate stronger pattern matches"
         },
         {
           "key": "path_traversal_detected",
@@ -214,8 +227,7 @@
           "key": "sql_injection_score",
           "type": "number",
           "required": false,
-          "description": "Confidence score for SQL injection detection (0-100). Typical threshold: >=75 for blocks",
-          "range": "0-100"
+          "description": "Confidence score for SQL injection detection (0-100). Typical threshold: >=75 for blocks"
         },
         {
           "key": "cross_origin_detected",
@@ -233,8 +245,7 @@
           "key": "cross_origin_score",
           "type": "number",
           "required": false,
-          "description": "Risk score for cross-origin escalation (0-100). Higher scores indicate more suspicious cross-boundary activity",
-          "range": "0-100"
+          "description": "Risk score for cross-origin escalation (0-100). Higher scores indicate more suspicious cross-boundary activity"
         },
         {
           "key": "encoded_content_detected",
@@ -258,8 +269,7 @@
           "key": "encoded_score",
           "type": "number",
           "required": false,
-          "description": "Risk score for encoded injection attempts (0-100). Considers encoding density and decoded content patterns",
-          "range": "0-100"
+          "description": "Risk score for encoded injection attempts (0-100). Considers encoding density and decoded content patterns"
         },
         {
           "key": "detected_language",
@@ -277,8 +287,7 @@
           "key": "language_confidence",
           "type": "number",
           "required": false,
-          "description": "Confidence score for language detection (0-100). Use with detected_language to tune sensitivity",
-          "range": "0-100"
+          "description": "Confidence score for language detection (0-100). Use with detected_language to tune sensitivity"
         },
         {
           "key": "detected_script",
@@ -296,29 +305,25 @@
           "key": "script_confidence",
           "type": "number",
           "required": false,
-          "description": "Confidence score for script detection (0-100)",
-          "range": "0-100"
+          "description": "Confidence score for script detection (0-100)"
         },
         {
           "key": "hallucination_score",
           "type": "number",
           "required": false,
-          "description": "ML-based score for hallucinated or fabricated content (0-100). Higher scores indicate higher likelihood of non-factual claims",
-          "range": "0-100"
+          "description": "ML-based score for hallucinated or fabricated content (0-100). Higher scores indicate higher likelihood of non-factual claims"
         },
         {
           "key": "factuality_score",
           "type": "number",
           "required": false,
-          "description": "ML-based factuality assessment score (0-100). Higher scores indicate more factually grounded content",
-          "range": "0-100"
+          "description": "ML-based factuality assessment score (0-100). Higher scores indicate more factually grounded content"
         },
         {
           "key": "sentiment_score",
           "type": "number",
           "required": false,
-          "description": "Sentiment analysis score. Use to detect overly negative or manipulative tone in prompts or responses",
-          "range": "0-100"
+          "description": "Sentiment analysis score. Use to detect overly negative or manipulative tone in prompts or responses"
         },
         {
           "key": "contains_code",
@@ -336,8 +341,7 @@
           "key": "code_ratio",
           "type": "number",
           "required": false,
-          "description": "Percentage of content that consists of code (0-100). High values may indicate code dumps or automated content",
-          "range": "0-100"
+          "description": "Percentage of content that consists of code (0-100). High values may indicate code dumps or automated content"
         },
         {
           "key": "keyword_matched",
@@ -373,8 +377,7 @@
           "key": "content_safety_score",
           "type": "number",
           "required": false,
-          "description": "Aggregate content safety score (0-100). Combines multiple safety signals into a single risk indicator",
-          "range": "0-100"
+          "description": "Aggregate content safety score (0-100). Combines multiple safety signals into a single risk indicator"
         },
         {
           "key": "content_safety_blocked",
@@ -393,6 +396,84 @@
           "type": "boolean",
           "required": false,
           "description": "Whether multi-turn injection patterns were detected (attack spread across multiple conversation turns)"
+        },
+        {
+          "key": "session_pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether PII was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_pii_types",
+          "type": "array",
+          "required": false,
+          "description": "PII types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether secrets were detected in any previous turn of the session"
+        },
+        {
+          "key": "session_secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Secret types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether prompt injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_command_injection",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether command injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_threat_turns",
+          "type": "number",
+          "required": false,
+          "description": "Number of turns in the session where threats were detected"
+        },
+        {
+          "key": "session_max_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions"
+        },
+        {
+          "key": "session_max_jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_max_command_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest command injection score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_max_pii_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest PII risk score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_max_secret_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest secret detection score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_cumulative_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
         }
       ]
     },
@@ -422,8 +503,7 @@
           "key": "tool_risk_score",
           "type": "number",
           "required": false,
-          "description": "Computed risk score for this tool call (0-100). Considers tool sensitivity, argument patterns, and MCP verification status. Typical threshold: >85 for dangerous tools",
-          "range": "0-100"
+          "description": "Computed risk score for this tool call (0-100). Considers tool sensitivity, argument patterns, and MCP verification status. Typical threshold: >85 for dangerous tools"
         },
         {
           "key": "tool_is_sensitive",
@@ -477,8 +557,7 @@
           "key": "sequence_risk",
           "type": "number",
           "required": false,
-          "description": "Risk score from action sequence analysis (0-100). Analyzes history of tool calls to detect attack patterns. Typical threshold: >80 for blocks",
-          "range": "0-100"
+          "description": "Risk score from action sequence analysis (0-100). Analyzes history of tool calls to detect attack patterns. Typical threshold: >80 for blocks"
         },
         {
           "key": "loop_detected",
@@ -502,8 +581,7 @@
           "key": "budget_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining token budget as percentage (0-100). Use this to warn or block when budget is low. Requires session with token budget configuration",
-          "range": "0-100"
+          "description": "Remaining token budget as percentage (0-100). Use this to warn or block when budget is low. Requires session with token budget configuration"
         },
         {
           "key": "budget_exceeded",
@@ -521,8 +599,7 @@
           "key": "topic_confidence",
           "type": "number",
           "required": false,
-          "description": "Confidence score from topic classifier for tool content (0-100)",
-          "range": "0-100"
+          "description": "Confidence score from topic classifier for tool content (0-100)"
         },
         {
           "key": "contains_secrets",
@@ -549,11 +626,22 @@
           "description": "Array of PII types found in tool arguments"
         },
         {
-          "key": "injection_score",
+          "key": "injection_confidence",
+          "type": "number",
+          "required": false,
+          "description": "Combined prompt injection confidence in tool arguments (0-100). MAX of all detector scores (Pulse + DeepContext). Use injection_pulse_score / injection_deep_context_score for individual detector control"
+        },
+        {
+          "key": "injection_pulse_score",
+          "type": "number",
+          "required": false,
+          "description": "Highflame single-turn classifier score for prompt injection in tool arguments (0-100). Raw score from Pulse detector before combination with deep-context"
+        },
+        {
+          "key": "injection_deep_context_score",
           "type": "number",
           "required": false,
-          "description": "ML-based confidence score for prompt injection in tool arguments (0-100)",
-          "range": "0-100"
+          "description": "DeepContext multi-turn analyzer score for prompt injection in tool arguments (0-100). Tracks injection patterns across tool call history"
         },
         {
           "key": "command_injection_detected",
@@ -571,8 +659,7 @@
           "key": "command_injection_score",
           "type": "number",
           "required": false,
-          "description": "Confidence score for command injection in tool arguments (0-100)",
-          "range": "0-100"
+          "description": "Confidence score for command injection in tool arguments (0-100)"
         },
         {
           "key": "path_traversal_detected",
@@ -608,8 +695,7 @@
           "key": "sql_injection_score",
           "type": "number",
           "required": false,
-          "description": "Confidence score for SQL injection in tool arguments (0-100)",
-          "range": "0-100"
+          "description": "Confidence score for SQL injection in tool arguments (0-100)"
         },
         {
           "key": "tool_poisoning_detected",
@@ -621,8 +707,7 @@
           "key": "tool_poisoning_score",
           "type": "number",
           "required": false,
-          "description": "Confidence score for tool poisoning detection (0-100). Typical threshold: >=70 for blocks",
-          "range": "0-100"
+          "description": "Confidence score for tool poisoning detection (0-100). Typical threshold: >=70 for blocks"
         },
         {
           "key": "tool_poisoning_type",
@@ -640,8 +725,7 @@
           "key": "rug_pull_score",
           "type": "number",
           "required": false,
-          "description": "Confidence score for rug pull detection based on behavioral drift analysis (0-100)",
-          "range": "0-100"
+          "description": "Confidence score for rug pull detection based on behavioral drift analysis (0-100)"
         },
         {
           "key": "mcp_config_risk",
@@ -659,8 +743,7 @@
           "key": "mcp_risk_score",
           "type": "number",
           "required": false,
-          "description": "Risk score for MCP configuration issues (0-100). Typical threshold: >=70 for blocks",
-          "range": "0-100"
+          "description": "Risk score for MCP configuration issues (0-100). Typical threshold: >=70 for blocks"
         },
         {
           "key": "cross_origin_detected",
@@ -678,8 +761,7 @@
           "key": "cross_origin_score",
           "type": "number",
           "required": false,
-          "description": "Risk score for cross-origin escalation in tool calls (0-100)",
-          "range": "0-100"
+          "description": "Risk score for cross-origin escalation in tool calls (0-100)"
         },
         {
           "key": "encoded_content_detected",
@@ -703,8 +785,7 @@
           "key": "encoded_score",
           "type": "number",
           "required": false,
-          "description": "Risk score for encoded injection in tool arguments (0-100)",
-          "range": "0-100"
+          "description": "Risk score for encoded injection in tool arguments (0-100)"
         },
         {
           "key": "rug_pull_type",
@@ -723,6 +804,84 @@
           "type": "boolean",
           "required": false,
           "description": "Whether multi-turn injection patterns were detected across tool calls in the session"
+        },
+        {
+          "key": "session_pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether PII was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_pii_types",
+          "type": "array",
+          "required": false,
+          "description": "PII types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether secrets were detected in any previous turn of the session"
+        },
+        {
+          "key": "session_secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Secret types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether prompt injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_command_injection",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether command injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_threat_turns",
+          "type": "number",
+          "required": false,
+          "description": "Number of turns in the session where threats were detected"
+        },
+        {
+          "key": "session_max_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions"
+        },
+        {
+          "key": "session_max_jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_max_command_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest command injection score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_max_pii_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest PII risk score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_max_secret_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest secret detection score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_cumulative_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
         }
       ]
     },
@@ -783,6 +942,84 @@
           "type": "string",
           "required": false,
           "description": "Type of path traversal detected in the file read path"
+        },
+        {
+          "key": "session_pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether PII was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_pii_types",
+          "type": "array",
+          "required": false,
+          "description": "PII types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether secrets were detected in any previous turn of the session"
+        },
+        {
+          "key": "session_secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Secret types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether prompt injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_command_injection",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether command injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_threat_turns",
+          "type": "number",
+          "required": false,
+          "description": "Number of turns in the session where threats were detected"
+        },
+        {
+          "key": "session_max_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions"
+        },
+        {
+          "key": "session_max_jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_max_command_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest command injection score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_max_pii_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest PII risk score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_max_secret_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest secret detection score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_cumulative_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
         }
       ]
     },
@@ -843,6 +1080,84 @@
           "type": "string",
           "required": false,
           "description": "Type of path traversal detected in the file write path"
+        },
+        {
+          "key": "session_pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether PII was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_pii_types",
+          "type": "array",
+          "required": false,
+          "description": "PII types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether secrets were detected in any previous turn of the session"
+        },
+        {
+          "key": "session_secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Secret types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether prompt injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_command_injection",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether command injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_threat_turns",
+          "type": "number",
+          "required": false,
+          "description": "Number of turns in the session where threats were detected"
+        },
+        {
+          "key": "session_max_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions"
+        },
+        {
+          "key": "session_max_jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_max_command_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest command injection score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_max_pii_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest PII risk score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_max_secret_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest secret detection score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_cumulative_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
         }
       ]
     },
@@ -884,8 +1199,7 @@
           "key": "tool_poisoning_score",
           "type": "number",
           "required": false,
-          "description": "Confidence score for tool poisoning in MCP server tools (0-100)",
-          "range": "0-100"
+          "description": "Confidence score for tool poisoning in MCP server tools (0-100)"
         },
         {
           "key": "tool_poisoning_type",
@@ -909,8 +1223,7 @@
           "key": "mcp_risk_score",
           "type": "number",
           "required": false,
-          "description": "Risk score for MCP configuration issues (0-100)",
-          "range": "0-100"
+          "description": "Risk score for MCP configuration issues (0-100)"
         },
         {
           "key": "cross_origin_detected",
@@ -928,10 +1241,87 @@
           "key": "cross_origin_score",
           "type": "number",
           "required": false,
-          "description": "Risk score for cross-origin escalation in server connection (0-100)",
-          "range": "0-100"
+          "description": "Risk score for cross-origin escalation in server connection (0-100)"
+        },
+        {
+          "key": "session_pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether PII was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_pii_types",
+          "type": "array",
+          "required": false,
+          "description": "PII types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether secrets were detected in any previous turn of the session"
+        },
+        {
+          "key": "session_secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Secret types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether prompt injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_command_injection",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether command injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_threat_turns",
+          "type": "number",
+          "required": false,
+          "description": "Number of turns in the session where threats were detected"
+        },
+        {
+          "key": "session_max_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions"
+        },
+        {
+          "key": "session_max_jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_max_command_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest command injection score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_max_pii_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest PII risk score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_max_secret_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest secret detection score seen in any turn of the session (0-100)"
+        },
+        {
+          "key": "session_cumulative_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
         }
       ]
     }
   ]
-}
+}