@highflame/policy 2.1.40 → 2.1.42

package/_schemas/ai_gateway/context.json

@@ -7,6 +7,18 @@
       "name": "call_tool",
       "description": "Call an MCP tool — threat focus: command injection, tool poisoning, rug pull, secrets, PII",
       "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
         {
           "key": "content",
           "type": "string",
@@ -169,6 +181,12 @@
           "required": false,
           "description": "Built-in tool flag"
         },
+        {
+          "key": "tool_operation_classes",
+          "type": "array",
+          "required": false,
+          "description": "All operation classes observed in the tool call. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. 'unknown' appears when any unrecognized or variable-expanded command was seen."
+        },
         {
           "key": "mcp_server_verified",
           "type": "boolean",
@@ -337,6 +355,18 @@
       "name": "connect_server",
       "description": "Connect to an MCP server — threat focus: supply chain, tool poisoning, config risk",
       "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
         {
           "key": "content",
           "type": "string",
@@ -547,6 +577,18 @@
       "name": "process_prompt",
       "description": "Process a prompt (MCP or LLM chat completion) — threat focus: injection, jailbreak, secrets, PII, content safety",
       "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
         {
           "key": "content",
           "type": "string",
@@ -787,6 +829,18 @@
       "name": "read_file",
       "description": "Read an MCP resource — threat focus: secrets exposure, PII exposure",
       "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
         {
           "key": "content",
           "type": "string",
@@ -955,6 +1009,18 @@
       "name": "write_file",
       "description": "Write an MCP resource — threat focus: secrets in output, PII in output",
       "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
         {
           "key": "content",
           "type": "string",

package/_schemas/ai_gateway/schema.cedarschema

@@ -73,6 +73,9 @@ action call_tool appliesTo {
   principal: [User, MCP_Client],
   resource: [Tool],
   context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
     // --- Content ---
     content: String,                  // Raw content being scanned
 
@@ -116,6 +119,9 @@ action call_tool appliesTo {
     tool_is_sensitive?: Bool,
     tool_is_builtin?: Bool,
 
+    // --- Tool Operation Classifier ---
+    tool_operation_classes?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
+
     // --- MCP Trust ---
     mcp_server_verified?: Bool,       // Whether server is from verified registry
 
@@ -176,6 +182,9 @@ action connect_server appliesTo {
   principal: [User, MCP_Client],
   resource: [Server],
   context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
     content?: String,                 // Server config content (if available)
     mcp_server?: String,
 
@@ -245,6 +254,9 @@ action process_prompt appliesTo {
   principal: [User, MCP_Client],
   resource: [LlmPrompt],
   context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
     content: String,
     mcp_server?: String,
 
@@ -323,6 +335,9 @@ action read_file appliesTo {
   principal: [User, MCP_Client],
   resource: [FilePath],
   context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
     content: String,
     mcp_server?: String,
 
@@ -381,6 +396,9 @@ action write_file appliesTo {
   principal: [User, MCP_Client],
   resource: [FilePath],
   context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
     content: String,
     mcp_server?: String,
 

package/_schemas/guardrails/context.json

@@ -7,6 +7,18 @@
       "name": "process_prompt",
       "description": "Analyze user prompts and AI responses for security threats, PII, and content violations",
       "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
         {
           "key": "request_id",
           "type": "string",
@@ -523,6 +535,18 @@
       "name": "call_tool",
       "description": "Execute agentic tool calls, including shell commands, file operations, and MCP tools",
       "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
         {
           "key": "request_id",
           "type": "string",
@@ -805,6 +829,12 @@
           "required": false,
           "description": "Risk score for MCP configuration issues (0-100). Typical threshold: >=70 for blocks"
         },
+        {
+          "key": "tool_operation_classes",
+          "type": "array",
+          "required": false,
+          "description": "All operation classes observed in the tool call. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. 'unknown' appears when any unrecognized or variable-expanded command was seen."
+        },
         {
           "key": "cross_origin_detected",
           "type": "boolean",
@@ -1009,6 +1039,18 @@
       "name": "read_file",
       "description": "Read file operations for analyzing file content before allowing access",
       "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
         {
           "key": "request_id",
           "type": "string",
@@ -1189,6 +1231,18 @@
       "name": "write_file",
       "description": "Write file operations for preventing writes of sensitive content",
       "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
         {
           "key": "request_id",
           "type": "string",
@@ -1381,6 +1435,18 @@
       "name": "connect_server",
       "description": "Connect to an MCP server, used to control which MCP servers are allowed",
       "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
         {
           "key": "request_id",
           "type": "string",

package/_schemas/guardrails/schema.cedarschema

@@ -96,6 +96,9 @@ namespace Guardrails {
 
     /// Context for process_prompt action (user prompts & AI responses)
     type ProcessPromptContext = {
+        // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+        "role"?: String,
+        "privilege_scope"?: Set<String>,
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -235,6 +238,9 @@ namespace Guardrails {
 
     /// Context for call_tool action (agentic tool execution)
     type CallToolContext = {
+        // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+        "role"?: String,
+        "privilege_scope"?: Set<String>,
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -338,6 +344,9 @@ namespace Guardrails {
         "mcp_risk_type"?: String,                // "inline_execution" | "suspicious_url" | "cross_origin"
         "mcp_risk_score"?: Long,                 // 0-100
 
+        // Tool Operation Classifier (optional) — populated by AST-based classifiers (bash, python, etc.)
+        "tool_operation_classes"?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
+
         // Agentic - Multi-Turn Context (optional)
         "conversation_turn"?: Long,
         "multi_turn_detection"?: Bool,
@@ -368,6 +377,9 @@ namespace Guardrails {
 
     /// Context for read_file action
     type FileReadContext = {
+        // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+        "role"?: String,
+        "privilege_scope"?: Set<String>,
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -428,6 +440,9 @@ namespace Guardrails {
 
     /// Context for write_file action
     type FileWriteContext = {
+        // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+        "role"?: String,
+        "privilege_scope"?: Set<String>,
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -492,6 +507,9 @@ namespace Guardrails {
 
     /// Context for connect_server action (MCP server connections)
     type ConnectServerContext = {
+        // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+        "role"?: String,
+        "privilege_scope"?: Set<String>,
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,

package/_schemas/overwatch/context.json

@@ -7,6 +7,18 @@
       "name": "process_prompt",
       "description": "User submits a prompt or receives AI response",
       "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
         {
           "key": "content",
           "type": "string",
@@ -301,6 +313,18 @@
       "name": "call_tool",
       "description": "User calls a tool (native IDE tool or MCP tool)",
       "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
         {
           "key": "content",
           "type": "string",
@@ -619,6 +643,12 @@
           "required": false,
           "description": "Whether the MCP server is from a verified registry"
         },
+        {
+          "key": "tool_operation_classes",
+          "type": "array",
+          "required": false,
+          "description": "All operation classes observed in the tool call. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. 'unknown' appears when any unrecognized or variable-expanded command was seen."
+        },
         {
           "key": "session_pii_detected",
           "type": "boolean",
@@ -703,6 +733,18 @@
       "name": "connect_server",
       "description": "Connect to an MCP server",
       "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
         {
           "key": "content",
           "type": "string",
@@ -895,6 +937,18 @@
       "name": "read_file",
       "description": "Read a file from disk",
       "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
         {
           "key": "content",
           "type": "string",
@@ -1087,6 +1141,18 @@
       "name": "write_file",
       "description": "Write a file to disk",
       "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
         {
           "key": "content",
           "type": "string",

package/_schemas/overwatch/schema.cedarschema

@@ -79,6 +79,9 @@ action process_prompt appliesTo {
   principal: [User, Agent],
   resource: [LlmPrompt],
   context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
     // --- Event & Source ---
     content: String,                  // Raw content being scanned
     source: String,                   // IDE source: "cursor", "claudecode", "github_copilot"
@@ -157,6 +160,9 @@ action call_tool appliesTo {
   principal: [User, Agent],
   resource: [Tool, FilePath],
   context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
     // --- Event & Source ---
     content: String,                  // Raw content being scanned (e.g., shell command, tool args)
     source: String,                   // IDE source
@@ -237,6 +243,9 @@ action call_tool appliesTo {
     // --- MCP Trust ---
     mcp_server_verified?: Bool,       // Whether server is from verified registry
 
+    // --- Tool Operation Classifier ---
+    tool_operation_classes?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
+
     // --- Session Detection History (cross-turn sticky flags) ---
     session_pii_detected?: Bool,
     session_pii_types?: Set<String>,
@@ -263,6 +272,9 @@ action connect_server appliesTo {
   principal: [User, Agent],
   resource: [Server],
   context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
     content?: String,                 // Server config content (if available)
     source: String,
     event: String,
@@ -310,6 +322,9 @@ action read_file appliesTo {
   principal: [User, Agent],
   resource: [FilePath],
   context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
     content: String,
     source: String,
     event: String,
@@ -361,6 +376,9 @@ action write_file appliesTo {
   principal: [User, Agent],
   resource: [FilePath],
   context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
     content: String,
     source: String,
     event: String,

package/_schemas/sentry/context.json

@@ -7,6 +7,18 @@
       "name": "process_prompt",
       "description": "User sends a message (prompt) to an AI chat service via the browser",
       "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
         {
           "key": "content",
           "type": "string",
@@ -331,6 +343,18 @@
       "name": "receive_response",
       "description": "AI service responds to the user — scan response content for harmful output",
       "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
         {
           "key": "content",
           "type": "string",
@@ -565,6 +589,18 @@
       "name": "paste_content",
       "description": "User pastes content into an AI chat (clipboard, cross-tab, cross-app)",
       "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
         {
           "key": "content",
           "type": "string",
@@ -853,6 +889,18 @@
       "name": "upload_file",
       "description": "User uploads a file or document into an AI chat service",
       "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
         {
           "key": "content",
           "type": "string",

package/_schemas/sentry/schema.cedarschema

@@ -78,6 +78,9 @@ action process_prompt appliesTo {
   principal: [User],
   resource: [ChatSession],
   context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
     // --- Core Metadata ---
     content: String,                  // Raw message content being sent
     source: String,                   // Browser extension identifier: "sentry"
@@ -165,6 +168,9 @@ action receive_response appliesTo {
   principal: [User],
   resource: [ChatSession],
   context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
     // --- Core Metadata ---
     content: String,                  // AI response content
     source: String,
@@ -231,6 +237,9 @@ action paste_content appliesTo {
   principal: [User],
   resource: [ChatSession, Document],
   context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
     // --- Core Metadata ---
     content: String,                  // Pasted content
     source: String,
@@ -308,6 +317,9 @@ action upload_file appliesTo {
   principal: [User],
   resource: [Document, ChatSession],
   context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
     // --- Core Metadata ---
     content: String,                  // Extracted file text content (for scanning)
     source: String,