@highflame/policy 2.2.24 → 2.2.25

package/_schemas/ai_gateway/context.json

@@ -353,7 +353,8 @@
           "key": "rpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "rpm_exceeded",
@@ -365,7 +366,8 @@
           "key": "tpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "tpm_exceeded",
@@ -395,7 +397,8 @@
           "key": "malicious_package_score",
           "type": "number",
           "required": false,
-          "description": "100 when a malicious package was detected, 0 otherwise"
+          "description": "100 when a malicious package was detected, 0 otherwise",
+          "range": "0-100"
         },
         {
           "key": "malicious_packages",
@@ -425,7 +428,8 @@
           "key": "package_risk_score",
           "type": "number",
           "required": false,
-          "description": "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory count for advisory-only packages; 0 when all packages are clean."
+          "description": "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory count for advisory-only packages; 0 when all packages are clean.",
+          "range": "0-100"
         },
         {
           "key": "package_check_status",
@@ -659,7 +663,8 @@
           "key": "rpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "rpm_exceeded",
@@ -671,7 +676,8 @@
           "key": "tpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "tpm_exceeded",
@@ -701,7 +707,8 @@
           "key": "malicious_package_score",
           "type": "number",
           "required": false,
-          "description": "100 when a malicious package was detected, 0 otherwise"
+          "description": "100 when a malicious package was detected, 0 otherwise",
+          "range": "0-100"
         },
         {
           "key": "malicious_packages",
@@ -731,7 +738,8 @@
           "key": "package_risk_score",
           "type": "number",
           "required": false,
-          "description": "Graduated supply-chain risk score (0-100)"
+          "description": "Graduated supply-chain risk score (0-100)",
+          "range": "0-100"
         },
         {
           "key": "package_check_status",
@@ -995,7 +1003,8 @@
           "key": "rpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "rpm_exceeded",
@@ -1007,7 +1016,8 @@
           "key": "tpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "tpm_exceeded",
@@ -1199,7 +1209,8 @@
           "key": "rpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "rpm_exceeded",
@@ -1211,7 +1222,8 @@
           "key": "tpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "tpm_exceeded",
@@ -1403,7 +1415,8 @@
           "key": "rpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "rpm_exceeded",
@@ -1415,7 +1428,8 @@
           "key": "tpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "tpm_exceeded",

package/_schemas/ai_gateway/templates/defaults/malicious_package.cedar

@@ -0,0 +1,59 @@
+// =============================================================================
+// Malicious Package (Default)
+// =============================================================================
+// Blocks tool calls that install or download packages flagged as malicious
+// by the osv.dev database (OpenSSF MAL- advisories). The malicious_package
+// detector (Shield, Tier Slow) parses package-manager invocations (pip, npm,
+// yarn, pnpm, bun, uv, gem, cargo, go, composer) out of tool-call arguments
+// and checks each referenced package against the OSV batch API.
+//
+// Context keys consumed:
+//   - malicious_package_detected: Bool
+//   - package_install_detected:   Bool
+//   - package_check_status:       String ("" | "degraded")
+//
+// Compliance:
+//   - OWASP LLM03 (Supply Chain), OWASP ASI02
+//
+// Category:  agent-security
+// Namespace: AIGateway
+// =============================================================================
+
+@id("agent-security.block-malicious-package")
+@name("Block malicious package installs")
+@description("Blocks call_tool when a referenced package carries a known-malicious osv.dev (MAL-) advisory.")
+@severity("critical")
+@tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:llm03,owasp:asi02")
+@reject_message("Package install blocked: the requested package is flagged as malicious in the osv.dev database.")
+forbid (
+    principal,
+    action == AIGateway::Action::"call_tool",
+    resource
+)
+when {
+    context has malicious_package_detected &&
+    context.malicious_package_detected == true
+};
+
+// Alternative (fail-closed): the detector fails OPEN by design — when the
+// OSV lookup is unavailable, installs proceed with package_check_status set
+// to "degraded". Uncomment to block package installs whenever they cannot be
+// verified, trading install availability for supply-chain certainty.
+//
+// @id("agent-security.block-unverified-package")
+// @name("Block unverified package installs")
+// @description("Blocks call_tool package installs when the malicious-package lookup is degraded.")
+// @severity("medium")
+// @tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:llm03")
+// @reject_message("Package install blocked: the package could not be verified against the malicious-package database.")
+// forbid (
+//     principal,
+//     action == AIGateway::Action::"call_tool",
+//     resource
+// )
+// when {
+//     context has package_install_detected &&
+//     context.package_install_detected == true &&
+//     context has package_check_status &&
+//     context.package_check_status == "degraded"
+// };

package/_schemas/ai_gateway/templates/templates.json

@@ -103,6 +103,20 @@
         "owasp:asi04"
       ]
     },
+    {
+      "id": "agent-security.malicious-package",
+      "name": "Malicious Package",
+      "description": "Block package installs (pip, npm, yarn, pnpm, bun, uv, gem, cargo, go, composer) flagged as malicious.",
+      "category": "agent-security",
+      "file": "defaults/malicious_package.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-security",
+        "threat:supply-chain",
+        "owasp:llm03",
+        "owasp:asi02"
+      ]
+    },
     {
       "id": "tools.mcp-server-allowlist",
       "name": "MCP Server Allowlist",