@highflame/policy 2.2.26 → 2.2.28

package/_schemas/agent_ops/templates/profiles/data_processing.cedar

@@ -0,0 +1,114 @@
+// =============================================================================
+// Sandbox profile — Data processing
+// =============================================================================
+// Offline batch data work (ADR 0019 D4): read/write under /scratch, /data and
+// /tmp; run python and a POSIX shell; no network egress; no mechanism toggles;
+// kernel-tier isolation or stronger (Forge IsolationTier kernel/hardware).
+//
+// Enforcement model (ADR 0019 D1/D3): the ceiling is expressed as `forbid`
+// rules so it overrides AgentOps' `organization.permit-baseline`; the single
+// `permit` turns provisioning ON. Every forbid `has`-guards the optional
+// attribute it reads — an absent-attribute access errors and silently voids the
+// forbid (fail-open), so the guard is load-bearing.
+//
+// Context keys consumed: isolation_tier, writable_paths, network_egress,
+//   exec_allowlist, mechanism_capabilities.
+//
+// Category:  sandbox
+// Namespace: AgentOps
+// =============================================================================
+
+@id("sandbox.allow-data-processing")
+@name("Permit data-processing sandbox provisioning")
+@description("Permits provision_sandbox so this identity can create sandboxes within the data-processing ceiling enforced by the forbid rules below.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+permit (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+);
+
+@id("sandbox.block-data-processing-tier")
+@name("Block weak isolation for data sandbox")
+@description("Blocks provision_sandbox when the requested isolation tier is weaker than the kernel tier.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: data-processing profile requires kernel-tier isolation or stronger.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has isolation_tier &&
+    !(["kernel", "hardware"].contains(context.isolation_tier))
+};
+
+@id("sandbox.block-data-processing-write")
+@name("Block writable paths outside data dirs")
+@description("Blocks provision_sandbox when a requested writable path prefix is outside /scratch, /data or /tmp.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: data-processing profile permits writes only under /scratch, /data or /tmp.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has writable_paths &&
+    !(["/scratch", "/data", "/tmp"].containsAll(context.writable_paths))
+};
+
+@id("sandbox.block-data-processing-exec")
+@name("Block executables outside python and shell")
+@description("Blocks provision_sandbox when the requested exec allowlist includes anything other than python or a POSIX shell.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: data-processing profile permits only python, python3, bash and sh.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has exec_allowlist &&
+    !(["python", "python3", "bash", "sh"].containsAll(context.exec_allowlist))
+};
+
+@id("sandbox.block-data-processing-egress")
+@name("Block network egress for data sandbox")
+@description("Blocks provision_sandbox when outbound network egress is requested.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: data-processing profile forbids all network egress.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    (context has network_egress && context.network_egress == true) ||
+    (context has egress_hosts)
+};
+
+@id("sandbox.block-data-processing-mechanisms")
+@name("Block mechanism toggles for data sandbox")
+@description("Blocks provision_sandbox when any curated mechanism toggle is requested.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: data-processing profile forbids all mechanism toggles.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has mechanism_capabilities &&
+    (context.mechanism_capabilities.contains("sys:ptrace") ||
+     context.mechanism_capabilities.contains("sys:bpf") ||
+     context.mechanism_capabilities.contains("sys:raw_socket") ||
+     context.mechanism_capabilities.contains("dev:gpu") ||
+     context.mechanism_capabilities.contains("virt:nested"))
+};

package/_schemas/agent_ops/templates/profiles/gpu_training.cedar

@@ -0,0 +1,117 @@
+// =============================================================================
+// Sandbox profile — GPU training
+// =============================================================================
+// GPU-accelerated training/fine-tuning (ADR 0019 D4): write under /scratch,
+// /data, /workspace and /tmp; run python and the common launchers; reach model
+// and dataset hubs; the ONLY permitted mechanism toggle is `dev:gpu`; kernel-tier
+// isolation or stronger (Forge IsolationTier kernel/hardware — GPU passthrough
+// needs a real kernel, ADR 0019 D4 "KERNEL-tier floor").
+//
+// Enforcement model (ADR 0019 D1/D3): the ceiling is expressed as `forbid`
+// rules so it overrides AgentOps' `organization.permit-baseline`; the single
+// `permit` turns provisioning ON. `dev:gpu` is allowed; every OTHER mechanism
+// toggle (ptrace, bpf, raw_socket, nested virt) is still forbidden. Every forbid
+// `has`-guards the optional attribute it reads (absent-attribute access errors
+// and silently voids a forbid — fail-open).
+//
+// Context keys consumed: isolation_tier, writable_paths, exec_allowlist,
+//   egress_hosts, mechanism_capabilities.
+//
+// Category:  sandbox
+// Namespace: AgentOps
+// =============================================================================
+
+@id("sandbox.allow-gpu-training")
+@name("Permit gpu-training sandbox provisioning")
+@description("Permits provision_sandbox so this identity can create sandboxes within the gpu-training ceiling enforced by the forbid rules below.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+permit (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+);
+
+@id("sandbox.block-gpu-training-tier")
+@name("Block weak isolation for gpu sandbox")
+@description("Blocks provision_sandbox when the requested isolation tier is weaker than the kernel tier required for GPU passthrough.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: gpu-training profile requires kernel-tier isolation or stronger.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has isolation_tier &&
+    !(["kernel", "hardware"].contains(context.isolation_tier))
+};
+
+@id("sandbox.block-gpu-training-write")
+@name("Block writable paths outside training dirs")
+@description("Blocks provision_sandbox when a requested writable path prefix is outside /scratch, /data, /workspace or /tmp.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: gpu-training profile permits writes only under /scratch, /data, /workspace or /tmp.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has writable_paths &&
+    !(["/scratch", "/data", "/workspace", "/tmp"].containsAll(context.writable_paths))
+};
+
+@id("sandbox.block-gpu-training-exec")
+@name("Block executables outside training launchers")
+@description("Blocks provision_sandbox when the requested exec allowlist includes anything outside python and the approved launchers.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: gpu-training profile permits only python, bash, sh, accelerate and torchrun.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has exec_allowlist &&
+    !(["python", "python3", "bash", "sh", "accelerate", "torchrun"].containsAll(context.exec_allowlist))
+};
+
+@id("sandbox.block-gpu-training-egress")
+@name("Block egress outside model and dataset hubs")
+@description("Blocks provision_sandbox when a requested egress host is outside the approved model and dataset hubs.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: gpu-training profile permits egress only to approved model and dataset hubs.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    (context has egress_hosts &&
+     !(["huggingface.co", "cdn-lfs.huggingface.co", "pypi.org", "files.pythonhosted.org", "storage.googleapis.com"].containsAll(context.egress_hosts))) ||
+    (context has network_egress && context.network_egress == true && !(context has egress_hosts))
+};
+
+@id("sandbox.block-gpu-training-mechanisms")
+@name("Block mechanism toggles beyond gpu")
+@description("Blocks provision_sandbox when a mechanism toggle other than dev:gpu is requested.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: gpu-training profile permits only the dev:gpu mechanism toggle.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has mechanism_capabilities &&
+    (context.mechanism_capabilities.contains("sys:ptrace") ||
+     context.mechanism_capabilities.contains("sys:bpf") ||
+     context.mechanism_capabilities.contains("sys:raw_socket") ||
+     context.mechanism_capabilities.contains("virt:nested"))
+};

package/_schemas/agent_ops/templates/profiles/locked_down.cedar

@@ -0,0 +1,118 @@
+// =============================================================================
+// Sandbox profile — Locked down
+// =============================================================================
+// The tightest Forge sandbox envelope (ADR 0019 D4): execute `python` only,
+// write only under `/scratch`, no network egress, no mechanism toggles,
+// kernel-tier isolation or stronger (Forge IsolationTier kernel/hardware).
+// Deploy to an agent to let it provision sandboxes for pure, offline compute
+// and nothing more.
+//
+// Enforcement model (ADR 0019 D1/D3): AgentOps ships `organization.permit-baseline`
+// which permits every action — including provision_sandbox — so the ceiling here
+// is expressed as `forbid` rules (forbid overrides permit in Cedar). The single
+// `permit` below turns provisioning ON when this profile is deployed without the
+// baseline. Every forbid `has`-guards the optional context attribute it reads:
+// touching an absent attribute is a Cedar evaluation error that silently voids
+// the forbid (fail-open), so the guard is load-bearing, not decorative.
+//
+// Context keys consumed: isolation_tier, writable_paths, network_egress,
+//   egress_hosts, exec_allowlist, mechanism_capabilities.
+//
+// Category:  sandbox
+// Namespace: AgentOps
+// =============================================================================
+
+@id("sandbox.allow-locked-down")
+@name("Permit locked-down sandbox provisioning")
+@description("Permits provision_sandbox so this identity can create sandboxes within the locked-down ceiling enforced by the forbid rules below.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+permit (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+);
+
+@id("sandbox.block-locked-down-tier")
+@name("Block weak isolation for locked-down sandbox")
+@description("Blocks provision_sandbox when the requested isolation tier is weaker than the kernel tier.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: locked-down profile requires kernel-tier isolation or stronger.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has isolation_tier &&
+    !(["kernel", "hardware"].contains(context.isolation_tier))
+};
+
+@id("sandbox.block-locked-down-write")
+@name("Block writable paths outside scratch")
+@description("Blocks provision_sandbox when a requested writable path prefix is outside /scratch.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: locked-down profile permits writes only under /scratch.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has writable_paths &&
+    !(["/scratch"].containsAll(context.writable_paths))
+};
+
+@id("sandbox.block-locked-down-exec")
+@name("Block executables outside python")
+@description("Blocks provision_sandbox when the requested exec allowlist includes anything other than python.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: locked-down profile permits only python and python3.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has exec_allowlist &&
+    !(["python", "python3"].containsAll(context.exec_allowlist))
+};
+
+@id("sandbox.block-locked-down-egress")
+@name("Block network egress for locked-down sandbox")
+@description("Blocks provision_sandbox when outbound network egress is requested.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: locked-down profile forbids all network egress.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    (context has network_egress && context.network_egress == true) ||
+    (context has egress_hosts)
+};
+
+@id("sandbox.block-locked-down-mechanisms")
+@name("Block mechanism toggles for locked-down sandbox")
+@description("Blocks provision_sandbox when any curated mechanism toggle is requested.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: locked-down profile forbids all mechanism toggles.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has mechanism_capabilities &&
+    (context.mechanism_capabilities.contains("sys:ptrace") ||
+     context.mechanism_capabilities.contains("sys:bpf") ||
+     context.mechanism_capabilities.contains("sys:raw_socket") ||
+     context.mechanism_capabilities.contains("dev:gpu") ||
+     context.mechanism_capabilities.contains("virt:nested"))
+};

package/_schemas/agent_ops/templates/profiles/network_dev.cedar

@@ -0,0 +1,117 @@
+// =============================================================================
+// Sandbox profile — Network dev
+// =============================================================================
+// Interactive/dev workloads that need controlled egress (ADR 0019 D4): write
+// under /scratch, /workspace and /tmp; run the common dev toolchain; reach ONLY
+// an approved set of package and source hosts; no mechanism toggles; kernel-tier
+// isolation or stronger (Forge IsolationTier kernel/hardware).
+//
+// Enforcement model (ADR 0019 D1/D3): the ceiling is expressed as `forbid`
+// rules so it overrides AgentOps' `organization.permit-baseline`; the single
+// `permit` turns provisioning ON. Network egress is PERMITTED here but the host
+// allowlist is enforced by the egress forbid. Every forbid `has`-guards the
+// optional attribute it reads (absent-attribute access errors and silently
+// voids a forbid — fail-open).
+//
+// Context keys consumed: isolation_tier, writable_paths, exec_allowlist,
+//   egress_hosts, mechanism_capabilities.
+//
+// Category:  sandbox
+// Namespace: AgentOps
+// =============================================================================
+
+@id("sandbox.allow-network-dev")
+@name("Permit network-dev sandbox provisioning")
+@description("Permits provision_sandbox so this identity can create sandboxes within the network-dev ceiling enforced by the forbid rules below.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+permit (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+);
+
+@id("sandbox.block-network-dev-tier")
+@name("Block weak isolation for network-dev sandbox")
+@description("Blocks provision_sandbox when the requested isolation tier is weaker than the kernel tier.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: network-dev profile requires kernel-tier isolation or stronger.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has isolation_tier &&
+    !(["kernel", "hardware"].contains(context.isolation_tier))
+};
+
+@id("sandbox.block-network-dev-write")
+@name("Block writable paths outside workspace")
+@description("Blocks provision_sandbox when a requested writable path prefix is outside /scratch, /workspace or /tmp.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: network-dev profile permits writes only under /scratch, /workspace or /tmp.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has writable_paths &&
+    !(["/scratch", "/workspace", "/tmp"].containsAll(context.writable_paths))
+};
+
+@id("sandbox.block-network-dev-exec")
+@name("Block executables outside the dev toolchain")
+@description("Blocks provision_sandbox when the requested exec allowlist includes anything outside the approved dev toolchain.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: network-dev profile permits only python, node, npm, pip, git and a POSIX shell.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has exec_allowlist &&
+    !(["python", "python3", "node", "npm", "pip", "git", "bash", "sh"].containsAll(context.exec_allowlist))
+};
+
+@id("sandbox.block-network-dev-egress")
+@name("Block egress outside approved hosts")
+@description("Blocks provision_sandbox when a requested egress host is outside the approved package and source hosts.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: network-dev profile permits egress only to approved package and source hosts.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    (context has egress_hosts &&
+     !(["pypi.org", "files.pythonhosted.org", "registry.npmjs.org", "github.com", "objects.githubusercontent.com"].containsAll(context.egress_hosts))) ||
+    (context has network_egress && context.network_egress == true && !(context has egress_hosts))
+};
+
+@id("sandbox.block-network-dev-mechanisms")
+@name("Block mechanism toggles for network-dev sandbox")
+@description("Blocks provision_sandbox when any curated mechanism toggle is requested.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: network-dev profile forbids all mechanism toggles.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has mechanism_capabilities &&
+    (context.mechanism_capabilities.contains("sys:ptrace") ||
+     context.mechanism_capabilities.contains("sys:bpf") ||
+     context.mechanism_capabilities.contains("sys:raw_socket") ||
+     context.mechanism_capabilities.contains("dev:gpu") ||
+     context.mechanism_capabilities.contains("virt:nested"))
+};

package/_schemas/agent_ops/templates/templates.json

@@ -37,6 +37,11 @@
       "id": "organization",
       "name": "Organization",
       "description": "Organization-wide baselines and default permit/deny policies."
+    },
+    {
+      "id": "sandbox",
+      "name": "Sandbox",
+      "description": "Forge sandbox provisioning profiles — capability ceilings for the OS-layer envelope (writable paths, egress, exec, mechanism toggles, isolation tier)."
     }
   ],
   "defaults": [
@@ -61,6 +66,42 @@
       "severity": "low",
       "tags": ["category:organization", "posture:permit-default"],
       "auto_deploy": true
+    },
+    {
+      "id": "sandbox.locked-down",
+      "name": "Sandbox: Locked down",
+      "description": "Permits sandbox provisioning within the tightest ceiling: python only, writes under /scratch, no network, no mechanism toggles, kernel-tier isolation or stronger.",
+      "category": "sandbox",
+      "file": "profiles/locked_down.cedar",
+      "severity": "high",
+      "tags": ["category:sandbox", "surface:provision-sandbox", "scope:per-agent", "posture:deny-default"]
+    },
+    {
+      "id": "sandbox.data-processing",
+      "name": "Sandbox: Data processing",
+      "description": "Permits sandbox provisioning for offline batch data work: python and a POSIX shell, writes under /scratch, /data and /tmp, no network, no mechanism toggles.",
+      "category": "sandbox",
+      "file": "profiles/data_processing.cedar",
+      "severity": "high",
+      "tags": ["category:sandbox", "surface:provision-sandbox", "scope:per-agent", "posture:deny-default"]
+    },
+    {
+      "id": "sandbox.network-dev",
+      "name": "Sandbox: Network dev",
+      "description": "Permits sandbox provisioning for dev workloads with controlled egress: common dev toolchain, writes under /scratch, /workspace and /tmp, egress limited to approved package and source hosts.",
+      "category": "sandbox",
+      "file": "profiles/network_dev.cedar",
+      "severity": "high",
+      "tags": ["category:sandbox", "surface:provision-sandbox", "scope:per-agent", "posture:deny-default"]
+    },
+    {
+      "id": "sandbox.gpu-training",
+      "name": "Sandbox: GPU training",
+      "description": "Permits sandbox provisioning for GPU training: dev:gpu the only mechanism toggle, kernel-tier isolation or stronger, writes under training dirs, egress limited to model and dataset hubs.",
+      "category": "sandbox",
+      "file": "profiles/gpu_training.cedar",
+      "severity": "high",
+      "tags": ["category:sandbox", "surface:provision-sandbox", "scope:per-agent", "posture:deny-default"]
     }
   ]
 }

package/_schemas/guardrails/templates/mcp_server_allowlist.cedar

@@ -0,0 +1,41 @@
+// =============================================================================
+// MCP Server Allowlist
+// =============================================================================
+// Restricts MCP server connections to a pre-approved list. Customize the
+// `context.mcp_server` values in the permit rule to match the allowed
+// servers for your environment.
+//
+// Context keys consumed:
+//   - mcp_server: String
+//
+// Category:  tools
+// Namespace: Guardrails
+// =============================================================================
+
+@id("tools.allow-mcp-allowlist")
+@name("Allow allowlisted MCP servers")
+@description("Permits connect_server when mcp_server is in the allowlist.")
+@severity("medium")
+@tags("category:tools,surface:connect-server,scope:org-wide,posture:deny-default")
+permit (
+    principal,
+    action == Guardrails::Action::"connect_server",
+    resource
+)
+when {
+    context has mcp_server &&
+    (context.mcp_server == "filesystem" ||
+     context.mcp_server == "playwright")
+};
+
+@id("tools.deny-non-allowlisted-mcp")
+@name("Block non-allowlisted MCP servers")
+@description("Blocks connect_server unconditionally so only the allowlist permit applies.")
+@severity("medium")
+@tags("category:tools,surface:connect-server,scope:org-wide,posture:deny-default")
+@reject_message("MCP server connection blocked: server is not on the allowlist.")
+forbid (
+    principal,
+    action == Guardrails::Action::"connect_server",
+    resource
+);

package/_schemas/guardrails/templates/templates.json

@@ -231,6 +231,15 @@
       "severity": "critical",
       "tags": ["category:tools", "threat:supply-chain", "posture:deny-default"]
     },
+    {
+      "id": "tools.mcp-server-allowlist",
+      "name": "MCP Server Allowlist",
+      "description": "Restrict MCP server connections to a pre-approved list. Customize the allowlist values to match the servers permitted in your environment.",
+      "category": "tools",
+      "file": "mcp_server_allowlist.cedar",
+      "severity": "medium",
+      "tags": ["category:tools", "surface:connect-server", "scope:org-wide", "posture:deny-default"]
+    },
     {
       "id": "security.chat-assistant",
       "name": "Chat Assistant — Security",

package/dist/actions.gen.d.ts

@@ -28,6 +28,7 @@ export declare const ActionType: {
     readonly LoadModel: "load_model";
     readonly ProcessPrompt: "process_prompt";
     readonly ProcessResponse: "process_response";
+    readonly ProvisionSandbox: "provision_sandbox";
     readonly QuarantineArtifact: "quarantine_artifact";
     readonly ReadFile: "read_file";
     readonly RunBuild: "run_build";

package/dist/actions.gen.js

@@ -29,6 +29,7 @@ export const ActionType = {
     LoadModel: 'load_model',
     ProcessPrompt: 'process_prompt',
     ProcessResponse: 'process_response',
+    ProvisionSandbox: 'provision_sandbox',
     QuarantineArtifact: 'quarantine_artifact',
     ReadFile: 'read_file',
     RunBuild: 'run_build',