@highflame/policy 2.1.6 → 2.1.7

package/_schemas/guardrails/templates/defaults/agent_identity.cedar

@@ -45,7 +45,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level == "unverified" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
     context has tool_category && context.tool_category == "dangerous"
 };
 
@@ -59,7 +59,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level == "unverified" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
     context has tool_name &&
     (context.tool_name == "shell" ||
      context.tool_name == "execute_command" ||
@@ -76,7 +76,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level == "unverified" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
     context has tool_is_sensitive && context.tool_is_sensitive == true &&
     context has tool_risk_score && context.tool_risk_score > 60
 };
@@ -95,7 +95,7 @@ forbid (
     action == Guardrails::Action::"process_prompt",
     resource
 ) when {
-    context.agent_type == "autonomous" &&
+    context has agent_type && context.agent_type == "autonomous" &&
     context has injection_confidence && context.injection_confidence > 50
 };
 
@@ -113,6 +113,6 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level == "unverified" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
     context has session_threat_turns && context.session_threat_turns > 0
 };

package/_schemas/guardrails/templates/defaults/semantic.cedar

@@ -22,9 +22,10 @@ forbid (
     action == Guardrails::Action::"process_prompt",
     resource
 ) when {
-    context.content_topics.contains("weapons_manufacturing") ||
-    context.content_topics.contains("explosive_materials") ||
-    context.content_topics.contains("illegal_synthesis")
+    context has content_topics &&
+    (context.content_topics.contains("weapons_manufacturing") ||
+     context.content_topics.contains("explosive_materials") ||
+     context.content_topics.contains("illegal_synthesis"))
 };
 
 @id("semantic-block-controlled-substances")
@@ -37,9 +38,10 @@ forbid (
     action == Guardrails::Action::"process_prompt",
     resource
 ) when {
-    context.content_topics.contains("controlled_substances") ||
-    context.content_topics.contains("drug_manufacturing") ||
-    context.content_topics.contains("precursor_chemicals")
+    context has content_topics &&
+    (context.content_topics.contains("controlled_substances") ||
+     context.content_topics.contains("drug_manufacturing") ||
+     context.content_topics.contains("precursor_chemicals"))
 };
 
 @id("semantic-block-high-confidence-restricted")
@@ -52,7 +54,8 @@ forbid (
     action == Guardrails::Action::"process_prompt",
     resource
 ) when {
-    context.topic_confidence > 80 &&
+    context has topic_confidence && context.topic_confidence > 80 &&
+    context has content_topics &&
     (context.content_topics.contains("illegal_activity") ||
      context.content_topics.contains("financial_fraud") ||
      context.content_topics.contains("social_engineering"))

package/_schemas/guardrails/templates/mcp_tool_permissions.cedar

@@ -28,7 +28,8 @@ permit (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.mcp_server == "github" &&
+    context has mcp_server && context.mcp_server == "github" &&
+    context has tool_name &&
     (context.tool_name == "read_issues" ||
      context.tool_name == "get_issue" ||
      context.tool_name == "list_repos" ||
@@ -47,7 +48,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.mcp_server == "github"
+    context has mcp_server && context.mcp_server == "github"
 };
 
 // -- Organization-wide MCP server exclusions --------------------------------
@@ -64,8 +65,9 @@ forbid (
 ) when {
     // Add server names to block across the organization.
     // Modify this list to match your exclusion requirements.
-    context.mcp_server == "untrusted-server" ||
-    context.mcp_server == "deprecated-server"
+    context has mcp_server &&
+    (context.mcp_server == "untrusted-server" ||
+     context.mcp_server == "deprecated-server")
 };
 
 // -- Block unverified MCP servers -------------------------------------------
@@ -80,5 +82,5 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.mcp_server_verified == false
+    context has mcp_server_verified && context.mcp_server_verified == false
 };

package/_schemas/guardrails/templates/profiles/multi_agent/agent_safety.cedar

@@ -43,7 +43,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level != "first_party" &&
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
     context has session_pii_detected && context.session_pii_detected == true &&
     context has tool_name &&
     (context.tool_name == "http_post" ||
@@ -62,7 +62,7 @@ forbid (
     action == Guardrails::Action::"write_file",
     resource
 ) when {
-    context.agent_trust_level == "unverified" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
     context has session_pii_detected && context.session_pii_detected == true
 };
 
@@ -80,7 +80,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level != "first_party" &&
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
     context has session_secrets_detected && context.session_secrets_detected == true &&
     context has tool_is_sensitive && context.tool_is_sensitive == true
 };
@@ -99,7 +99,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level == "unverified" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
     context has session_injection_detected && context.session_injection_detected == true
 };
 
@@ -134,7 +134,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level != "first_party" &&
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
     context has session_cumulative_risk_score && context.session_cumulative_risk_score > 200 &&
     context has tool_is_sensitive && context.tool_is_sensitive == true
 };
@@ -149,7 +149,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level == "unverified" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
     (
         (context has session_cumulative_risk_score && context.session_cumulative_risk_score > 500) ||
         (context has session_threat_turns && context.session_threat_turns > 5)

package/_schemas/guardrails/templates/profiles/multi_agent/agent_trust.cedar

@@ -44,7 +44,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level != "first_party" &&
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
     context has tool_category && context.tool_category == "dangerous"
 };
 
@@ -58,7 +58,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level == "unverified" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
     context has tool_is_sensitive && context.tool_is_sensitive == true
 };
 
@@ -72,7 +72,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level == "unverified" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
     context has mcp_server_verified && context.mcp_server_verified == false
 };
 
@@ -90,7 +90,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_type == "autonomous" &&
+    context has agent_type && context.agent_type == "autonomous" &&
     context has tool_risk_score && context.tool_risk_score > 70
 };
 
@@ -104,7 +104,7 @@ forbid (
     action == Guardrails::Action::"process_prompt",
     resource
 ) when {
-    context.agent_type == "autonomous" &&
+    context has agent_type && context.agent_type == "autonomous" &&
     context has injection_confidence && context.injection_confidence > 50
 };
 
@@ -118,7 +118,7 @@ forbid (
     action == Guardrails::Action::"process_prompt",
     resource
 ) when {
-    context.agent_type == "autonomous" &&
+    context has agent_type && context.agent_type == "autonomous" &&
     context has jailbreak_confidence && context.jailbreak_confidence > 50
 };
 
@@ -136,5 +136,5 @@ forbid (
     action == Guardrails::Action::"connect_server",
     resource
 ) when {
-    context.agent_trust_level == "unverified"
+    context has agent_trust_level && context.agent_trust_level == "unverified"
 };

package/_schemas/guardrails/templates/templates.json

@@ -114,19 +114,18 @@
       "severity": "critical",
       "tags": ["command-injection", "path-traversal", "sql-injection", "security"],
       "is_active": true
-    },
+    }
+  ],
+  "templates": [
     {
-      "id": "agent-identity-default",
+      "id": "agent-identity-trust",
       "name": "Agent Identity & Trust",
       "description": "Trust-based access control for AI agents: block unverified agents from dangerous/sensitive tools, apply stricter thresholds for autonomous agents, restrict unverified agents after session threats",
       "category": "agent_identity",
       "file": "defaults/agent_identity.cedar",
       "severity": "critical",
-      "tags": ["agent-identity", "trust", "a2a", "autonomous", "cross-turn"],
-      "is_active": true
-    }
-  ],
-  "templates": [
+      "tags": ["agent-identity", "trust", "a2a", "autonomous", "cross-turn"]
+    },
     {
       "id": "mcp-tool-permissions",
       "name": "MCP Tool Permissions",
@@ -258,7 +257,7 @@
       "description": "Production-grade A2A guardrails for multi-agent systems — tiered trust access control, autonomous agent safeguards, cross-turn PII/secrets containment, injection escalation response, cumulative risk circuit breakers",
       "severity": "critical",
       "tags": ["multi-agent", "a2a", "trust", "cross-turn", "circuit-breaker"],
-      "template_ids": ["multi-agent-trust", "multi-agent-safety"]
+      "template_ids": ["agent-identity-trust", "multi-agent-trust", "multi-agent-safety"]
     }
   ]
 }

package/dist/engine.d.ts

@@ -10,7 +10,7 @@ import { ActionType } from "./actions.gen.js";
  */
 export declare const DEFAULT_LIMITS: {
     /** Maximum number of keys in a context map */
-    readonly maxContextKeys: 100;
+    readonly maxContextKeys: 200;
     /** Maximum length of any string value (1MB) */
     readonly maxStringLength: 1000000;
     /** Maximum nesting depth for objects/arrays */

package/dist/engine.js

@@ -13,7 +13,7 @@ import * as cedar from "@cedar-policy/cedar-wasm/nodejs";
  */
 export const DEFAULT_LIMITS = {
     /** Maximum number of keys in a context map */
-    maxContextKeys: 100,
+    maxContextKeys: 200,
     /** Maximum length of any string value (1MB) */
     maxStringLength: 1_000_000,
     /** Maximum nesting depth for objects/arrays */

package/dist/guardrails-defaults.gen.js

@@ -529,7 +529,7 @@ forbid (
     context has sql_injection_score && context.sql_injection_score >= 75
 };
 `;
-const GUARDRAILS_AGENT_IDENTITY_DEFAULT_CEDAR = `// =============================================================================
+const GUARDRAILS_AGENT_IDENTITY_TRUST_CEDAR = `// =============================================================================
 // Agent Identity Policy — Agent-to-Agent Security Defaults
 // =============================================================================
 // Enforces trust-based access control for AI agents authenticated via API key
@@ -576,7 +576,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level == "unverified" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
     context has tool_category && context.tool_category == "dangerous"
 };
 
@@ -590,7 +590,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level == "unverified" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
     context has tool_name &&
     (context.tool_name == "shell" ||
      context.tool_name == "execute_command" ||
@@ -607,7 +607,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level == "unverified" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
     context has tool_is_sensitive && context.tool_is_sensitive == true &&
     context has tool_risk_score && context.tool_risk_score > 60
 };
@@ -626,7 +626,7 @@ forbid (
     action == Guardrails::Action::"process_prompt",
     resource
 ) when {
-    context.agent_type == "autonomous" &&
+    context has agent_type && context.agent_type == "autonomous" &&
     context has injection_confidence && context.injection_confidence > 50
 };
 
@@ -644,7 +644,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level == "unverified" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
     context has session_threat_turns && context.session_threat_turns > 0
 };
 `;
@@ -678,7 +678,8 @@ permit (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.mcp_server == "github" &&
+    context has mcp_server && context.mcp_server == "github" &&
+    context has tool_name &&
     (context.tool_name == "read_issues" ||
      context.tool_name == "get_issue" ||
      context.tool_name == "list_repos" ||
@@ -697,7 +698,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.mcp_server == "github"
+    context has mcp_server && context.mcp_server == "github"
 };
 
 // -- Organization-wide MCP server exclusions --------------------------------
@@ -714,8 +715,9 @@ forbid (
 ) when {
     // Add server names to block across the organization.
     // Modify this list to match your exclusion requirements.
-    context.mcp_server == "untrusted-server" ||
-    context.mcp_server == "deprecated-server"
+    context has mcp_server &&
+    (context.mcp_server == "untrusted-server" ||
+     context.mcp_server == "deprecated-server")
 };
 
 // -- Block unverified MCP servers -------------------------------------------
@@ -730,7 +732,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.mcp_server_verified == false
+    context has mcp_server_verified && context.mcp_server_verified == false
 };
 `;
 const GUARDRAILS_CHAT_ASSISTANT_SECURITY_CEDAR = `// =============================================================================
@@ -1145,7 +1147,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level != "first_party" &&
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
     context has tool_category && context.tool_category == "dangerous"
 };
 
@@ -1159,7 +1161,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level == "unverified" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
     context has tool_is_sensitive && context.tool_is_sensitive == true
 };
 
@@ -1173,7 +1175,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level == "unverified" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
     context has mcp_server_verified && context.mcp_server_verified == false
 };
 
@@ -1191,7 +1193,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_type == "autonomous" &&
+    context has agent_type && context.agent_type == "autonomous" &&
     context has tool_risk_score && context.tool_risk_score > 70
 };
 
@@ -1205,7 +1207,7 @@ forbid (
     action == Guardrails::Action::"process_prompt",
     resource
 ) when {
-    context.agent_type == "autonomous" &&
+    context has agent_type && context.agent_type == "autonomous" &&
     context has injection_confidence && context.injection_confidence > 50
 };
 
@@ -1219,7 +1221,7 @@ forbid (
     action == Guardrails::Action::"process_prompt",
     resource
 ) when {
-    context.agent_type == "autonomous" &&
+    context has agent_type && context.agent_type == "autonomous" &&
     context has jailbreak_confidence && context.jailbreak_confidence > 50
 };
 
@@ -1237,7 +1239,7 @@ forbid (
     action == Guardrails::Action::"connect_server",
     resource
 ) when {
-    context.agent_trust_level == "unverified"
+    context has agent_trust_level && context.agent_trust_level == "unverified"
 };
 `;
 const GUARDRAILS_MULTI_AGENT_SAFETY_CEDAR = `// =============================================================================
@@ -1285,7 +1287,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level != "first_party" &&
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
     context has session_pii_detected && context.session_pii_detected == true &&
     context has tool_name &&
     (context.tool_name == "http_post" ||
@@ -1304,7 +1306,7 @@ forbid (
     action == Guardrails::Action::"write_file",
     resource
 ) when {
-    context.agent_trust_level == "unverified" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
     context has session_pii_detected && context.session_pii_detected == true
 };
 
@@ -1322,7 +1324,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level != "first_party" &&
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
     context has session_secrets_detected && context.session_secrets_detected == true &&
     context has tool_is_sensitive && context.tool_is_sensitive == true
 };
@@ -1341,7 +1343,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level == "unverified" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
     context has session_injection_detected && context.session_injection_detected == true
 };
 
@@ -1376,7 +1378,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level != "first_party" &&
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
     context has session_cumulative_risk_score && context.session_cumulative_risk_score > 200 &&
     context has tool_is_sensitive && context.tool_is_sensitive == true
 };
@@ -1391,7 +1393,7 @@ forbid (
     action == Guardrails::Action::"call_tool",
     resource
 ) when {
-    context.agent_trust_level == "unverified" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
     (
         (context has session_cumulative_risk_score && context.session_cumulative_risk_score > 500) ||
         (context has session_threat_turns && context.session_threat_turns > 5)
@@ -1493,21 +1495,20 @@ export const GUARDRAILS_DEFAULTS = [
         tags: ['command-injection', 'path-traversal', 'sql-injection', 'security'],
         isActive: true,
     },
+];
+// =============================================================================
+// ALL TEMPLATES
+// =============================================================================
+export const GUARDRAILS_TEMPLATES = [
     {
-        id: 'agent-identity-default',
+        id: 'agent-identity-trust',
         name: 'Agent Identity & Trust',
         description: 'Trust-based access control for AI agents: block unverified agents from dangerous/sensitive tools, apply stricter thresholds for autonomous agents, restrict unverified agents after session threats',
         category: 'agent_identity',
-        cedarText: GUARDRAILS_AGENT_IDENTITY_DEFAULT_CEDAR,
+        cedarText: GUARDRAILS_AGENT_IDENTITY_TRUST_CEDAR,
         severity: 'critical',
         tags: ['agent-identity', 'trust', 'a2a', 'autonomous', 'cross-turn'],
-        isActive: true,
     },
-];
-// =============================================================================
-// ALL TEMPLATES
-// =============================================================================
-export const GUARDRAILS_TEMPLATES = [
     {
         id: 'mcp-tool-permissions',
         name: 'MCP Tool Permissions',
@@ -1728,19 +1729,18 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "severity": "critical",
       "tags": ["command-injection", "path-traversal", "sql-injection", "security"],
       "is_active": true
-    },
+    }
+  ],
+  "templates": [
     {
-      "id": "agent-identity-default",
+      "id": "agent-identity-trust",
       "name": "Agent Identity & Trust",
       "description": "Trust-based access control for AI agents: block unverified agents from dangerous/sensitive tools, apply stricter thresholds for autonomous agents, restrict unverified agents after session threats",
       "category": "agent_identity",
       "file": "defaults/agent_identity.cedar",
       "severity": "critical",
-      "tags": ["agent-identity", "trust", "a2a", "autonomous", "cross-turn"],
-      "is_active": true
-    }
-  ],
-  "templates": [
+      "tags": ["agent-identity", "trust", "a2a", "autonomous", "cross-turn"]
+    },
     {
       "id": "mcp-tool-permissions",
       "name": "MCP Tool Permissions",
@@ -1872,7 +1872,7 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "description": "Production-grade A2A guardrails for multi-agent systems — tiered trust access control, autonomous agent safeguards, cross-turn PII/secrets containment, injection escalation response, cumulative risk circuit breakers",
       "severity": "critical",
       "tags": ["multi-agent", "a2a", "trust", "cross-turn", "circuit-breaker"],
-      "template_ids": ["multi-agent-trust", "multi-agent-safety"]
+      "template_ids": ["agent-identity-trust", "multi-agent-trust", "multi-agent-safety"]
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.1.6",
+  "version": "2.1.7",
   "description": "Highflame Cedar policy types and engine wrapper",
   "readme": "README.md",
   "main": "dist/index.js",