@highflame/policy 2.1.36 → 2.1.37

package/_schemas/guardrails/templates/templates.json

@@ -1,381 +1,359 @@
 {
   "service": "guardrails",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "description": "Guardrails policy templates for LLM application security",
   "categories": [
     {
       "id": "security",
       "name": "Security",
-      "description": "Detect and block prompt injection, jailbreak attempts, and credential leakage"
+      "description": "Block prompt injection, jailbreak attempts, command injection, path traversal, and SQL injection."
     },
     {
       "id": "privacy",
       "name": "Privacy",
-      "description": "Detect and block personally identifiable information (PII) in prompts and responses"
+      "description": "Block personally identifiable information (PII) in prompts and responses."
     },
     {
-      "id": "trust_safety",
+      "id": "data-protection",
+      "name": "Data Protection",
+      "description": "Block secrets, API keys, tokens, and bulk credential exposure."
+    },
+    {
+      "id": "trust-safety",
       "name": "Trust & Safety",
-      "description": "Detect and block toxic, violent, hateful, sexual, or profane content"
+      "description": "Block toxic, violent, hateful, sexual, or profane content; restrict regulated topics."
+    },
+    {
+      "id": "tools",
+      "name": "Tools",
+      "description": "Per-tool MCP access control, org-wide server exclusions, unverified server blocks."
     },
     {
-      "id": "agentic_security",
-      "name": "Agentic Security",
-      "description": "Detect tool abuse, data exfiltration patterns, infinite loops, and budget violations"
+      "id": "agent-security",
+      "name": "Agent Security",
+      "description": "Block tool abuse, exfiltration patterns, loops, budget violations, tool poisoning, rug pull, and risky MCP configs."
     },
     {
-      "id": "agent_identity",
-      "name": "Agent-to-Agent Security",
-      "description": "Trust-based access control for AI agents — tiered permissions by trust level, agent type restrictions, cross-turn session lockdowns for multi-agent orchestration"
+      "id": "agent-identity",
+      "name": "Agent Identity",
+      "description": "Trust-based access control for AI agents — tiered permissions by trust level, autonomous agent restrictions, cross-turn session lockdowns."
     },
     {
       "id": "organization",
       "name": "Organization",
-      "description": "Organization-wide baselines and default permit/deny policies"
+      "description": "Organization-wide baselines and default permit/deny policies."
     }
   ],
   "defaults": [
     {
-      "id": "baseline-default",
+      "id": "organization.permit-baseline",
       "name": "Baseline Permit",
-      "description": "Permits all actions by default — threat-specific forbid policies override this when threats are detected",
+      "description": "Permits all actions by default; threat-specific forbid policies override this when detectors fire.",
       "category": "organization",
       "file": "defaults/baseline.cedar",
       "severity": "low",
-      "tags": ["baseline", "permit-default", "organization"],
+      "tags": ["category:organization", "posture:permit-default"],
       "is_active": true
     }
   ],
   "templates": [
     {
-      "id": "baseline-default",
+      "id": "organization.permit-baseline",
       "name": "Baseline Permit",
-      "description": "Permits all actions by default — threat-specific forbid policies override this when threats are detected",
+      "description": "Permits all actions by default; threat-specific forbid policies override this when detectors fire.",
       "category": "organization",
       "file": "defaults/baseline.cedar",
       "severity": "low",
-      "tags": ["baseline", "permit-default", "organization"],
+      "tags": ["category:organization", "posture:permit-default"],
       "auto_deploy": true
     },
     {
-      "id": "secrets-default",
+      "id": "data-protection.defaults",
       "name": "Secrets Detection",
-      "description": "Block content containing API keys, tokens, credentials, or other secrets",
-      "category": "security",
+      "description": "Block content containing API keys, tokens, credentials, or other secrets across prompts, tool calls, and file operations.",
+      "category": "data-protection",
       "file": "defaults/secrets.cedar",
       "severity": "critical",
-      "tags": ["secrets", "api-keys", "credentials", "data-leak"]
+      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
     },
     {
-      "id": "injection-default",
+      "id": "security.injection",
       "name": "Injection & Jailbreak Detection",
-      "description": "Block prompt injection, jailbreak attempts, and command injection using ML confidence scores",
+      "description": "Block prompt injection and jailbreak attempts using ML classifier confidence plus invisible-character defence.",
       "category": "security",
       "file": "defaults/injection.cedar",
       "severity": "high",
-      "tags": ["injection", "jailbreak", "security"]
+      "tags": ["category:security", "threat:injection", "threat:jailbreak", "detection:ml", "owasp:llm01", "owasp:llm02"]
     },
     {
-      "id": "pii-default",
+      "id": "privacy.defaults",
       "name": "PII Detection",
-      "description": "Block content containing PII such as SSN, credit cards, or passport numbers in outputs",
+      "description": "Block LLM outputs containing PII, with a stricter rule for SSN, credit card, and passport numbers.",
       "category": "privacy",
       "file": "defaults/pii.cedar",
-      "severity": "high",
-      "tags": ["pii", "privacy", "data-protection"]
+      "severity": "critical",
+      "tags": ["category:privacy", "threat:pii", "compliance:gdpr", "compliance:hipaa", "compliance:pci-dss"]
     },
     {
-      "id": "toxicity-default",
+      "id": "trust-safety.toxicity",
       "name": "Toxicity & Content Moderation",
-      "description": "Block toxic, violent, hateful, sexual, and profane content based on classifier scores",
-      "category": "trust_safety",
+      "description": "Block toxic, violent, hateful, sexual, and profane content using classifier scores with a combined-toxicity catch-all.",
+      "category": "trust-safety",
       "file": "defaults/toxicity.cedar",
       "severity": "critical",
-      "tags": ["toxicity", "trust-safety", "content-moderation"]
+      "tags": ["category:trust-safety", "threat:harmful", "threat:hate-speech", "detection:ml", "compliance:eu-ai-act"]
     },
     {
-      "id": "tool-risk-default",
+      "id": "agent-security.tool-risk",
       "name": "Tool Risk",
-      "description": "Block dangerous tool calls, shell execution, and sensitive tool usage based on risk scoring",
-      "category": "agentic_security",
+      "description": "Block dangerous tool calls, shell execution, and sensitive tools with elevated risk scores.",
+      "category": "agent-security",
       "file": "defaults/tool_risk.cedar",
       "severity": "critical",
-      "tags": ["tools", "agentic", "security"]
+      "tags": ["category:agent-security", "threat:command-injection", "owasp:llm06", "owasp:asi02"]
     },
     {
-      "id": "agentic-safety-default",
+      "id": "agent-security.defaults",
       "name": "Agentic Safety",
-      "description": "Block tool call loops, data exfiltration patterns, high-risk sequences, budget violations, tool poisoning, rug pull attacks, and MCP configuration risks",
-      "category": "agentic_security",
+      "description": "Block tool-call loops, exfiltration patterns, budget violations, tool poisoning, rug pull, and MCP configuration risks.",
+      "category": "agent-security",
       "file": "defaults/agentic_safety.cedar",
-      "severity": "high",
-      "tags": ["agentic", "safety", "loops", "exfiltration", "budget", "tool-poisoning", "rug-pull", "mcp-risk"]
+      "severity": "critical",
+      "tags": ["category:agent-security", "threat:loop", "threat:exfiltration", "threat:tool-poisoning", "threat:rug-pull", "owasp:asi01", "owasp:asi04"]
     },
     {
-      "id": "security-patterns-default",
+      "id": "security.patterns",
       "name": "Security Pattern Detection",
-      "description": "Block command injection, path traversal, and SQL injection attacks using regex-based pattern detection",
+      "description": "Block command injection, path traversal, and SQL injection using regex-based pattern detection.",
       "category": "security",
       "file": "defaults/security_patterns.cedar",
       "severity": "critical",
-      "tags": ["command-injection", "path-traversal", "sql-injection", "security"]
+      "tags": ["category:security", "threat:command-injection", "threat:sql-injection", "threat:path-traversal", "detection:pattern", "mitre:t1059"]
     },
     {
-      "id": "agent-identity-trust",
+      "id": "trust-safety.semantic",
+      "name": "Semantic Topic Enforcement",
+      "description": "Block content classified into dangerous topics (weapons, controlled substances, illegal activity).",
+      "category": "trust-safety",
+      "file": "defaults/semantic.cedar",
+      "severity": "critical",
+      "tags": ["category:trust-safety", "threat:harmful", "detection:ml", "compliance:eu-ai-act", "compliance:iso-42001"]
+    },
+    {
+      "id": "agent-identity.defaults",
       "name": "Agent Identity & Trust",
-      "description": "Trust-based access control for AI agents: block unverified agents from dangerous/sensitive tools, apply stricter thresholds for autonomous agents, restrict unverified agents after session threats",
-      "category": "agent_identity",
+      "description": "Trust-based access control: block unverified agents from dangerous/sensitive tools, stricter thresholds for autonomous agents, cross-turn lockdown after session threats.",
+      "category": "agent-identity",
       "file": "defaults/agent_identity.cedar",
       "severity": "critical",
-      "tags": ["agent-identity", "trust", "a2a", "autonomous", "cross-turn"]
+      "tags": ["category:agent-identity", "scope:per-agent", "owasp:llm01"]
     },
     {
-      "id": "mcp-tool-permissions",
+      "id": "tools.mcp-tool-permissions",
       "name": "MCP Tool Permissions",
-      "description": "Per-tool access control for MCP servers — allow specific tools while denying others, exclude servers org-wide, block unverified sources",
-      "category": "agentic_security",
+      "description": "Per-tool MCP access control: example GitHub read/write split, org-wide exclusion list, unverified server block.",
+      "category": "tools",
       "file": "mcp_tool_permissions.cedar",
-      "severity": "high",
-      "tags": ["mcp", "tools", "least-privilege", "per-server", "exclusion"]
+      "severity": "critical",
+      "tags": ["category:tools", "threat:supply-chain", "posture:deny-default"]
     },
     {
-      "id": "chat-assistant-security",
+      "id": "security.chat-assistant",
       "name": "Chat Assistant — Security",
-      "description": "Aggressive injection and jailbreak defense for customer-facing chatbots with lower thresholds",
+      "description": "Aggressive injection and jailbreak defence for customer-facing chatbots (lower thresholds than defaults).",
       "category": "security",
       "file": "profiles/chat_assistant/security.cedar",
       "severity": "high",
-      "tags": ["profile", "chat-assistant", "injection", "jailbreak", "security"]
+      "tags": ["category:security", "threat:injection", "threat:jailbreak", "detection:ml"]
     },
     {
-      "id": "chat-assistant-privacy",
+      "id": "privacy.chat-block-pii",
       "name": "Chat Assistant — Privacy",
-      "description": "Block PII in both user inputs and assistant outputs for chat applications",
+      "description": "Block PII in both user inputs and assistant outputs for chat applications.",
       "category": "privacy",
       "file": "profiles/chat_assistant/privacy.cedar",
       "severity": "high",
-      "tags": ["profile", "chat-assistant", "pii", "privacy"]
+      "tags": ["category:privacy", "threat:pii", "compliance:gdpr"]
     },
     {
-      "id": "chat-assistant-trust-safety",
+      "id": "trust-safety.chat-assistant",
       "name": "Chat Assistant — Trust & Safety",
-      "description": "Strict content moderation with lower toxicity thresholds and topic restrictions for public-facing chat",
-      "category": "trust_safety",
+      "description": "Strict content moderation and topic restrictions for public-facing chat (lower toxicity thresholds).",
+      "category": "trust-safety",
       "file": "profiles/chat_assistant/trust_safety.cedar",
       "severity": "critical",
-      "tags": ["profile", "chat-assistant", "toxicity", "trust-safety", "topics"]
-    },
-    {
-      "id": "code-agent-agentic-security",
-      "name": "Code Agent — Agentic Security",
-      "description": "Tool risk controls, shell blocking, loop detection, exfiltration prevention, and budget enforcement for coding assistants",
-      "category": "agentic_security",
-      "file": "profiles/code_agent/agentic_security.cedar",
-      "severity": "high",
-      "tags": ["profile", "code-agent", "tools", "agentic", "exfiltration", "budget"]
+      "tags": ["category:trust-safety", "threat:harmful", "compliance:eu-ai-act"]
     },
     {
-      "id": "code-agent-security",
-      "name": "Code Agent — Security",
-      "description": "Prevent code agents from writing detected secrets to output files",
-      "category": "security",
+      "id": "data-protection.code-block-write-secrets",
+      "name": "Code Agent — Secrets Protection",
+      "description": "Prevent code agents from writing detected secrets to output files.",
+      "category": "data-protection",
       "file": "profiles/code_agent/security.cedar",
       "severity": "critical",
-      "tags": ["profile", "code-agent", "secrets", "security"]
+      "tags": ["category:data-protection", "threat:secrets"]
     },
     {
-      "id": "data-pipeline-privacy",
-      "name": "Data Pipeline — Privacy",
-      "description": "Strict PII protection with zero-tolerance for sensitive PII types in data pipelines",
-      "category": "privacy",
-      "file": "profiles/data_pipeline/privacy.cedar",
+      "id": "security.code-agent-encoding",
+      "name": "Code Agent — Encoding Attacks",
+      "description": "Block invisible Unicode characters in tool arguments and file writes for coding agents.",
+      "category": "security",
+      "file": "profiles/code_agent/encoding.cedar",
       "severity": "critical",
-      "tags": ["profile", "data-pipeline", "pii", "privacy", "compliance"]
+      "tags": ["category:security", "threat:invisible-chars", "threat:injection"]
     },
     {
-      "id": "data-pipeline-security",
-      "name": "Data Pipeline — Security",
-      "description": "Strict secrets detection and lower injection thresholds for RAG and data processing pipelines",
+      "id": "security.code-agent-path-security",
+      "name": "Code Agent — Path Security",
+      "description": "Block .env files, credential files, system directories, key material, and destructive file operations for coding agents.",
       "category": "security",
-      "file": "profiles/data_pipeline/security.cedar",
+      "file": "profiles/code_agent/path_security.cedar",
       "severity": "critical",
-      "tags": ["profile", "data-pipeline", "secrets", "injection", "security"]
+      "tags": ["category:security", "threat:secrets", "threat:path-traversal"]
     },
     {
-      "id": "data-pipeline-agentic-security",
-      "name": "Data Pipeline — Agentic Security",
-      "description": "Exfiltration prevention and tool risk controls for data processing pipelines",
-      "category": "agentic_security",
-      "file": "profiles/data_pipeline/agentic_security.cedar",
+      "id": "agent-security.code-agent",
+      "name": "Code Agent — Agentic Security",
+      "description": "Tool risk controls, shell blocking, loop detection, exfiltration prevention, and budget enforcement for coding assistants.",
+      "category": "agent-security",
+      "file": "profiles/code_agent/agentic_security.cedar",
       "severity": "critical",
-      "tags": ["profile", "data-pipeline", "exfiltration", "tools"]
+      "tags": ["category:agent-security", "threat:exfiltration", "threat:loop", "owasp:llm06"]
     },
     {
-      "id": "multi-agent-trust",
-      "name": "Multi-Agent Orchestration — Agent Trust",
-      "description": "Tiered trust policies for multi-agent systems: only first-party agents can use dangerous tools, unverified agents restricted to safe tools, autonomous agents have lower risk ceilings, MCP server connection trust enforcement",
-      "category": "agent_identity",
-      "file": "profiles/multi_agent/agent_trust.cedar",
+      "id": "agent-security.code-agent-supply-chain",
+      "name": "Code Agent — Supply Chain",
+      "description": "Block MCP server poisoning, indirect prompt injection, credential theft chains, and destructive sequences for coding agents.",
+      "category": "agent-security",
+      "file": "profiles/code_agent/supply_chain.cedar",
       "severity": "critical",
-      "tags": ["profile", "multi-agent", "trust", "a2a", "autonomous", "mcp"]
+      "tags": ["category:agent-security", "threat:tool-poisoning", "threat:indirect-injection", "threat:exfiltration", "owasp:asi01", "owasp:asi04"]
     },
     {
-      "id": "multi-agent-safety",
-      "name": "Multi-Agent Orchestration — Cross-Turn Safety",
-      "description": "Session-aware agent safety policies: PII containment across agents, secrets lockdown, injection escalation response, cumulative risk circuit breakers for multi-agent sessions",
-      "category": "agent_identity",
-      "file": "profiles/multi_agent/agent_safety.cedar",
+      "id": "privacy.data-pipeline",
+      "name": "Data Pipeline — Privacy",
+      "description": "Strict PII protection with zero tolerance for sensitive PII types in data pipelines.",
+      "category": "privacy",
+      "file": "profiles/data_pipeline/privacy.cedar",
       "severity": "critical",
-      "tags": ["profile", "multi-agent", "cross-turn", "a2a", "pii", "secrets", "injection", "circuit-breaker"]
-    },
-    {
-      "id": "code-agent-path-security",
-      "name": "Code Agent — Path Security",
-      "description": "Block access to .env files, credential files, system directories, credential directories, and destructive file operations for coding agents",
-      "category": "security",
-      "file": "profiles/code_agent/path_security.cedar",
-      "severity": "high",
-      "tags": ["profile", "code-agent", "path-security", "credentials", "system-paths"]
+      "tags": ["category:privacy", "threat:pii", "compliance:gdpr", "compliance:hipaa"]
     },
     {
-      "id": "code-agent-supply-chain",
-      "name": "Code Agent — Supply Chain Security",
-      "description": "Block MCP server poisoning, indirect prompt injection from tool outputs, credential theft patterns, and destructive operation sequences for coding agents",
-      "category": "agentic_security",
-      "file": "profiles/code_agent/supply_chain.cedar",
+      "id": "data-protection.data-pipeline",
+      "name": "Data Pipeline — Secrets",
+      "description": "Strict secrets detection for data pipelines and zero-tolerance secret writes.",
+      "category": "data-protection",
+      "file": "profiles/data_pipeline/data_protection.cedar",
       "severity": "critical",
-      "tags": ["profile", "code-agent", "supply-chain", "tool-poisoning", "indirect-injection"]
+      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
     },
     {
-      "id": "code-agent-encoding",
-      "name": "Code Agent — Encoding Attacks",
-      "description": "Block invisible Unicode characters in tool arguments and file writes to prevent encoding-based prompt injection for coding agents",
+      "id": "security.data-pipeline-block-injection",
+      "name": "Data Pipeline — Injection Defence",
+      "description": "Lower injection threshold for RAG and data processing pipelines.",
       "category": "security",
-      "file": "profiles/code_agent/encoding.cedar",
+      "file": "profiles/data_pipeline/security.cedar",
       "severity": "high",
-      "tags": ["profile", "code-agent", "encoding", "unicode", "invisible-chars"]
+      "tags": ["category:security", "threat:injection", "owasp:llm01"]
     },
     {
-      "id": "advanced-detection-secrets",
-      "name": "Advanced Detection — Granular Secrets",
-      "description": "Granular secret type blocking for high-risk credentials (cloud provider keys, GitHub tokens, SSH keys, database URLs) and API keys/tokens",
-      "category": "security",
-      "file": "profiles/advanced_detection/secrets.cedar",
+      "id": "agent-security.data-pipeline",
+      "name": "Data Pipeline — Agentic Security",
+      "description": "Exfiltration prevention and tool risk controls for data processing pipelines.",
+      "category": "agent-security",
+      "file": "profiles/data_pipeline/agentic_security.cedar",
       "severity": "critical",
-      "tags": ["profile", "advanced-detection", "secrets", "credentials", "cloud-keys"]
+      "tags": ["category:agent-security", "threat:exfiltration"]
     },
     {
-      "id": "advanced-detection-pii",
-      "name": "Advanced Detection — PII",
-      "description": "Bulk PII exposure blocking, high-confidence ML PII detection, and PII in file operations for advanced threat detection",
-      "category": "privacy",
-      "file": "profiles/advanced_detection/pii.cedar",
+      "id": "agent-identity.multi-agent-trust",
+      "name": "Multi-Agent Orchestration — Agent Trust",
+      "description": "Tiered trust access control: only first-party agents can use dangerous tools, unverified restricted to safe tools, lower risk ceilings for autonomous agents.",
+      "category": "agent-identity",
+      "file": "profiles/multi_agent/agent_trust.cedar",
       "severity": "critical",
-      "tags": ["profile", "advanced-detection", "pii", "privacy", "ml-classifier"]
+      "tags": ["category:agent-identity", "scope:per-agent", "owasp:llm01", "owasp:llm02"]
     },
     {
-      "id": "advanced-detection-threat-severity",
-      "name": "Advanced Detection — Threat Severity",
-      "description": "Block any content flagged with critical severity by detection engines as a catch-all safety net",
-      "category": "security",
-      "file": "profiles/advanced_detection/threat_severity.cedar",
+      "id": "agent-identity.multi-agent-safety",
+      "name": "Multi-Agent Orchestration — Cross-Turn Safety",
+      "description": "Session-aware policies: PII/secrets containment, injection lockdown, cumulative risk circuit breakers for multi-agent sessions.",
+      "category": "agent-identity",
+      "file": "profiles/multi_agent/agent_safety.cedar",
       "severity": "critical",
-      "tags": ["profile", "advanced-detection", "severity", "critical", "catch-all"]
+      "tags": ["category:agent-identity", "scope:per-agent", "threat:pii", "threat:secrets", "threat:injection"]
     },
     {
-      "id": "a2a-cross-origin",
-      "name": "A2A Security — Cross-Origin Trust Boundaries",
-      "description": "Block confused deputy attacks and trust boundary violations from cross-system agent communication — critical cross-origin blocking, unverified agent restrictions, sensitive tool protection",
-      "category": "agent_identity",
+      "id": "agent-identity.a2a-cross-origin",
+      "name": "A2A Security — Cross-Origin Trust",
+      "description": "Block confused-deputy attacks and trust-boundary violations from cross-system agent communication.",
+      "category": "agent-identity",
       "file": "profiles/a2a_security/cross_origin.cedar",
       "severity": "critical",
-      "tags": ["profile", "a2a-security", "cross-origin", "confused-deputy", "trust-boundary"]
+      "tags": ["category:agent-identity", "threat:supply-chain", "owasp:llm08", "owasp:asi03"]
     },
     {
-      "id": "a2a-inter-agent-injection",
-      "name": "A2A Security — Inter-Agent Injection Defense",
-      "description": "Block indirect prompt injection via tool outputs, multi-turn progressive attacks using deep context models, and encoded payload delivery between independent agents",
-      "category": "agent_identity",
+      "id": "agent-identity.a2a-inter-agent-injection",
+      "name": "A2A Security — Inter-Agent Injection Defence",
+      "description": "Block indirect injection via tool outputs, multi-turn progressive attacks via deep-context detection, and encoded payload delivery between agents.",
+      "category": "agent-identity",
       "file": "profiles/a2a_security/inter_agent_injection.cedar",
       "severity": "critical",
-      "tags": ["profile", "a2a-security", "indirect-injection", "multi-turn", "encoded-injection", "deep-context"]
+      "tags": ["category:agent-identity", "threat:indirect-injection", "threat:encoded-payload", "owasp:llm01"]
     },
     {
-      "id": "a2a-supply-chain",
-      "name": "A2A Security — Supply Chain & Behavioral Drift",
-      "description": "Block tool poisoning from external agent ecosystems, rug pull behavioral drift, and credential theft chains initiated by compromised agents",
-      "category": "agent_identity",
+      "id": "agent-identity.a2a-supply-chain",
+      "name": "A2A Security — Supply Chain & Behavioural Drift",
+      "description": "Block tool poisoning from external agent ecosystems, rug pull behavioural drift, and credential theft chains.",
+      "category": "agent-identity",
       "file": "profiles/a2a_security/supply_chain.cedar",
       "severity": "critical",
-      "tags": ["profile", "a2a-security", "supply-chain", "tool-poisoning", "rug-pull", "credential-theft"]
+      "tags": ["category:agent-identity", "threat:tool-poisoning", "threat:rug-pull", "threat:exfiltration", "owasp:asi04"]
     },
     {
-      "id": "a2a-identity-enforcement",
+      "id": "agent-identity.a2a-identity-enforcement",
       "name": "A2A Security — Agent Identity Enforcement",
-      "description": "Enforce strict identity requirements for cross-system agents — block anonymous agents, require framework registration, prevent unverified autonomous agents",
-      "category": "agent_identity",
+      "description": "Enforce strict identity requirements for cross-system agents: block anonymous, require framework registration, prevent unverified autonomous.",
+      "category": "agent-identity",
       "file": "profiles/a2a_security/identity_enforcement.cedar",
       "severity": "critical",
-      "tags": ["profile", "a2a-security", "identity", "spoofing", "framework", "autonomous"]
+      "tags": ["category:agent-identity", "threat:spoofing", "scope:per-agent", "owasp:asi04"]
     },
     {
-      "id": "a2a-escalation-detection",
-      "name": "A2A Security — Escalation Detection & Circuit Breakers",
-      "description": "Detect progressive capability escalation across turns with session peak score monitoring and cumulative risk circuit breakers tuned for adversarial A2A communication",
-      "category": "agent_identity",
+      "id": "agent-identity.a2a-escalation",
+      "name": "A2A Security — Escalation Detection",
+      "description": "Detect progressive capability escalation across turns with session peak monitoring and cumulative risk circuit breakers.",
+      "category": "agent-identity",
       "file": "profiles/a2a_security/escalation_detection.cedar",
       "severity": "critical",
-      "tags": ["profile", "a2a-security", "escalation", "circuit-breaker", "session-peak", "cumulative-risk"]
-    }
-  ],
-  "profiles": [
-    {
-      "id": "chat-assistant",
-      "name": "Chat Assistant",
-      "description": "Optimized for customer-facing chatbots — strict toxicity, PII blocking, aggressive injection defense, topic restrictions",
-      "severity": "high",
-      "tags": ["chat-assistant", "toxicity", "pii", "injection"],
-      "template_ids": ["chat-assistant-security", "chat-assistant-privacy", "chat-assistant-trust-safety"]
+      "tags": ["category:agent-identity", "threat:escalation", "scope:per-agent", "owasp:llm01"]
     },
     {
-      "id": "code-agent",
-      "name": "Code Agent",
-      "description": "Optimized for coding assistants — tool risk controls, shell blocking, loop detection, exfiltration prevention, budget enforcement, path security, supply chain defense, and encoding attack protection",
-      "severity": "high",
-      "tags": ["code-agent", "tools", "agentic", "exfiltration", "path-security", "supply-chain", "encoding"],
-      "template_ids": ["code-agent-agentic-security", "code-agent-security", "code-agent-path-security", "code-agent-supply-chain", "code-agent-encoding"]
-    },
-    {
-      "id": "data-pipeline",
-      "name": "Data Pipeline",
-      "description": "Optimized for RAG and data processing — strict PII/secrets protection, exfiltration detection, pipeline injection defense",
-      "severity": "critical",
-      "tags": ["data-pipeline", "pii", "secrets", "exfiltration"],
-      "template_ids": ["data-pipeline-privacy", "data-pipeline-security", "data-pipeline-agentic-security"]
-    },
-    {
-      "id": "multi-agent",
-      "name": "Multi-Agent Orchestration (MAS)",
-      "description": "Production-grade guardrails for multi-agent systems with shared orchestration — tiered trust access control, autonomous agent safeguards, cross-turn PII/secrets containment, injection escalation response, cumulative risk circuit breakers. For independent agent-to-agent communication across separate trust domains, use the A2A Security profile",
+      "id": "data-protection.advanced-secrets",
+      "name": "Advanced Detection — Granular Secrets",
+      "description": "Block specific high-risk credential types (cloud, GitHub, SSH, database) and general API tokens.",
+      "category": "data-protection",
+      "file": "profiles/advanced_detection/secrets.cedar",
       "severity": "critical",
-      "tags": ["multi-agent", "mas", "trust", "cross-turn", "circuit-breaker"],
-      "template_ids": ["agent-identity-trust", "multi-agent-trust", "multi-agent-safety"]
+      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
     },
     {
-      "id": "a2a-security",
-      "name": "A2A Security",
-      "description": "Production-grade security for independent agent-to-agent communication across separate trust domains — cross-origin trust enforcement, inter-agent injection defense (indirect, multi-turn, encoded), supply chain protection (tool poisoning, rug pull), identity enforcement, and escalation circuit breakers",
+      "id": "privacy.advanced-pii",
+      "name": "Advanced Detection — PII",
+      "description": "Bulk PII exposure threshold, ML classifier confidence, and file-operation blocking.",
+      "category": "privacy",
+      "file": "profiles/advanced_detection/pii.cedar",
       "severity": "critical",
-      "tags": ["a2a-security", "cross-origin", "injection", "supply-chain", "identity", "escalation"],
-      "template_ids": ["a2a-cross-origin", "a2a-inter-agent-injection", "a2a-supply-chain", "a2a-identity-enforcement", "a2a-escalation-detection"]
+      "tags": ["category:privacy", "threat:pii", "threat:exfiltration", "detection:ml", "compliance:gdpr"]
     },
     {
-      "id": "advanced-detection",
-      "name": "Advanced Detection",
-      "description": "Production-grade advanced threat detection — granular secret type blocking, ML-based PII detection, bulk exposure prevention, and critical severity catch-all for high-security environments",
+      "id": "security.advanced-block-critical-severity",
+      "name": "Advanced Detection — Threat Severity",
+      "description": "Catch-all that blocks any content flagged as critical severity by any detector.",
+      "category": "security",
+      "file": "profiles/advanced_detection/threat_severity.cedar",
       "severity": "critical",
-      "tags": ["advanced-detection", "secrets", "pii", "severity", "ml-detection"],
-      "template_ids": ["advanced-detection-secrets", "advanced-detection-pii", "advanced-detection-threat-severity"]
+      "tags": ["category:security", "detection:aggregate", "posture:catch-all"]
     }
   ]
 }