@highflame/policy 2.2.26 → 2.2.28

package/dist/agent_ops-defaults.gen.js

@@ -29,6 +29,476 @@ permit (
     resource
 );
 `;
+const AGENT_OPS_SANDBOX_LOCKED_DOWN_CEDAR = `// =============================================================================
+// Sandbox profile — Locked down
+// =============================================================================
+// The tightest Forge sandbox envelope (ADR 0019 D4): execute \`python\` only,
+// write only under \`/scratch\`, no network egress, no mechanism toggles,
+// kernel-tier isolation or stronger (Forge IsolationTier kernel/hardware).
+// Deploy to an agent to let it provision sandboxes for pure, offline compute
+// and nothing more.
+//
+// Enforcement model (ADR 0019 D1/D3): AgentOps ships \`organization.permit-baseline\`
+// which permits every action — including provision_sandbox — so the ceiling here
+// is expressed as \`forbid\` rules (forbid overrides permit in Cedar). The single
+// \`permit\` below turns provisioning ON when this profile is deployed without the
+// baseline. Every forbid \`has\`-guards the optional context attribute it reads:
+// touching an absent attribute is a Cedar evaluation error that silently voids
+// the forbid (fail-open), so the guard is load-bearing, not decorative.
+//
+// Context keys consumed: isolation_tier, writable_paths, network_egress,
+//   egress_hosts, exec_allowlist, mechanism_capabilities.
+//
+// Category:  sandbox
+// Namespace: AgentOps
+// =============================================================================
+
+@id("sandbox.allow-locked-down")
+@name("Permit locked-down sandbox provisioning")
+@description("Permits provision_sandbox so this identity can create sandboxes within the locked-down ceiling enforced by the forbid rules below.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+permit (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+);
+
+@id("sandbox.block-locked-down-tier")
+@name("Block weak isolation for locked-down sandbox")
+@description("Blocks provision_sandbox when the requested isolation tier is weaker than the kernel tier.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: locked-down profile requires kernel-tier isolation or stronger.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has isolation_tier &&
+    !(["kernel", "hardware"].contains(context.isolation_tier))
+};
+
+@id("sandbox.block-locked-down-write")
+@name("Block writable paths outside scratch")
+@description("Blocks provision_sandbox when a requested writable path prefix is outside /scratch.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: locked-down profile permits writes only under /scratch.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has writable_paths &&
+    !(["/scratch"].containsAll(context.writable_paths))
+};
+
+@id("sandbox.block-locked-down-exec")
+@name("Block executables outside python")
+@description("Blocks provision_sandbox when the requested exec allowlist includes anything other than python.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: locked-down profile permits only python and python3.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has exec_allowlist &&
+    !(["python", "python3"].containsAll(context.exec_allowlist))
+};
+
+@id("sandbox.block-locked-down-egress")
+@name("Block network egress for locked-down sandbox")
+@description("Blocks provision_sandbox when outbound network egress is requested.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: locked-down profile forbids all network egress.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    (context has network_egress && context.network_egress == true) ||
+    (context has egress_hosts)
+};
+
+@id("sandbox.block-locked-down-mechanisms")
+@name("Block mechanism toggles for locked-down sandbox")
+@description("Blocks provision_sandbox when any curated mechanism toggle is requested.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: locked-down profile forbids all mechanism toggles.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has mechanism_capabilities &&
+    (context.mechanism_capabilities.contains("sys:ptrace") ||
+     context.mechanism_capabilities.contains("sys:bpf") ||
+     context.mechanism_capabilities.contains("sys:raw_socket") ||
+     context.mechanism_capabilities.contains("dev:gpu") ||
+     context.mechanism_capabilities.contains("virt:nested"))
+};
+`;
+const AGENT_OPS_SANDBOX_DATA_PROCESSING_CEDAR = `// =============================================================================
+// Sandbox profile — Data processing
+// =============================================================================
+// Offline batch data work (ADR 0019 D4): read/write under /scratch, /data and
+// /tmp; run python and a POSIX shell; no network egress; no mechanism toggles;
+// kernel-tier isolation or stronger (Forge IsolationTier kernel/hardware).
+//
+// Enforcement model (ADR 0019 D1/D3): the ceiling is expressed as \`forbid\`
+// rules so it overrides AgentOps' \`organization.permit-baseline\`; the single
+// \`permit\` turns provisioning ON. Every forbid \`has\`-guards the optional
+// attribute it reads — an absent-attribute access errors and silently voids the
+// forbid (fail-open), so the guard is load-bearing.
+//
+// Context keys consumed: isolation_tier, writable_paths, network_egress,
+//   exec_allowlist, mechanism_capabilities.
+//
+// Category:  sandbox
+// Namespace: AgentOps
+// =============================================================================
+
+@id("sandbox.allow-data-processing")
+@name("Permit data-processing sandbox provisioning")
+@description("Permits provision_sandbox so this identity can create sandboxes within the data-processing ceiling enforced by the forbid rules below.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+permit (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+);
+
+@id("sandbox.block-data-processing-tier")
+@name("Block weak isolation for data sandbox")
+@description("Blocks provision_sandbox when the requested isolation tier is weaker than the kernel tier.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: data-processing profile requires kernel-tier isolation or stronger.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has isolation_tier &&
+    !(["kernel", "hardware"].contains(context.isolation_tier))
+};
+
+@id("sandbox.block-data-processing-write")
+@name("Block writable paths outside data dirs")
+@description("Blocks provision_sandbox when a requested writable path prefix is outside /scratch, /data or /tmp.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: data-processing profile permits writes only under /scratch, /data or /tmp.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has writable_paths &&
+    !(["/scratch", "/data", "/tmp"].containsAll(context.writable_paths))
+};
+
+@id("sandbox.block-data-processing-exec")
+@name("Block executables outside python and shell")
+@description("Blocks provision_sandbox when the requested exec allowlist includes anything other than python or a POSIX shell.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: data-processing profile permits only python, python3, bash and sh.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has exec_allowlist &&
+    !(["python", "python3", "bash", "sh"].containsAll(context.exec_allowlist))
+};
+
+@id("sandbox.block-data-processing-egress")
+@name("Block network egress for data sandbox")
+@description("Blocks provision_sandbox when outbound network egress is requested.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: data-processing profile forbids all network egress.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    (context has network_egress && context.network_egress == true) ||
+    (context has egress_hosts)
+};
+
+@id("sandbox.block-data-processing-mechanisms")
+@name("Block mechanism toggles for data sandbox")
+@description("Blocks provision_sandbox when any curated mechanism toggle is requested.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: data-processing profile forbids all mechanism toggles.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has mechanism_capabilities &&
+    (context.mechanism_capabilities.contains("sys:ptrace") ||
+     context.mechanism_capabilities.contains("sys:bpf") ||
+     context.mechanism_capabilities.contains("sys:raw_socket") ||
+     context.mechanism_capabilities.contains("dev:gpu") ||
+     context.mechanism_capabilities.contains("virt:nested"))
+};
+`;
+const AGENT_OPS_SANDBOX_NETWORK_DEV_CEDAR = `// =============================================================================
+// Sandbox profile — Network dev
+// =============================================================================
+// Interactive/dev workloads that need controlled egress (ADR 0019 D4): write
+// under /scratch, /workspace and /tmp; run the common dev toolchain; reach ONLY
+// an approved set of package and source hosts; no mechanism toggles; kernel-tier
+// isolation or stronger (Forge IsolationTier kernel/hardware).
+//
+// Enforcement model (ADR 0019 D1/D3): the ceiling is expressed as \`forbid\`
+// rules so it overrides AgentOps' \`organization.permit-baseline\`; the single
+// \`permit\` turns provisioning ON. Network egress is PERMITTED here but the host
+// allowlist is enforced by the egress forbid. Every forbid \`has\`-guards the
+// optional attribute it reads (absent-attribute access errors and silently
+// voids a forbid — fail-open).
+//
+// Context keys consumed: isolation_tier, writable_paths, exec_allowlist,
+//   egress_hosts, mechanism_capabilities.
+//
+// Category:  sandbox
+// Namespace: AgentOps
+// =============================================================================
+
+@id("sandbox.allow-network-dev")
+@name("Permit network-dev sandbox provisioning")
+@description("Permits provision_sandbox so this identity can create sandboxes within the network-dev ceiling enforced by the forbid rules below.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+permit (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+);
+
+@id("sandbox.block-network-dev-tier")
+@name("Block weak isolation for network-dev sandbox")
+@description("Blocks provision_sandbox when the requested isolation tier is weaker than the kernel tier.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: network-dev profile requires kernel-tier isolation or stronger.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has isolation_tier &&
+    !(["kernel", "hardware"].contains(context.isolation_tier))
+};
+
+@id("sandbox.block-network-dev-write")
+@name("Block writable paths outside workspace")
+@description("Blocks provision_sandbox when a requested writable path prefix is outside /scratch, /workspace or /tmp.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: network-dev profile permits writes only under /scratch, /workspace or /tmp.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has writable_paths &&
+    !(["/scratch", "/workspace", "/tmp"].containsAll(context.writable_paths))
+};
+
+@id("sandbox.block-network-dev-exec")
+@name("Block executables outside the dev toolchain")
+@description("Blocks provision_sandbox when the requested exec allowlist includes anything outside the approved dev toolchain.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: network-dev profile permits only python, node, npm, pip, git and a POSIX shell.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has exec_allowlist &&
+    !(["python", "python3", "node", "npm", "pip", "git", "bash", "sh"].containsAll(context.exec_allowlist))
+};
+
+@id("sandbox.block-network-dev-egress")
+@name("Block egress outside approved hosts")
+@description("Blocks provision_sandbox when a requested egress host is outside the approved package and source hosts.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: network-dev profile permits egress only to approved package and source hosts.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    (context has egress_hosts &&
+     !(["pypi.org", "files.pythonhosted.org", "registry.npmjs.org", "github.com", "objects.githubusercontent.com"].containsAll(context.egress_hosts))) ||
+    (context has network_egress && context.network_egress == true && !(context has egress_hosts))
+};
+
+@id("sandbox.block-network-dev-mechanisms")
+@name("Block mechanism toggles for network-dev sandbox")
+@description("Blocks provision_sandbox when any curated mechanism toggle is requested.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: network-dev profile forbids all mechanism toggles.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has mechanism_capabilities &&
+    (context.mechanism_capabilities.contains("sys:ptrace") ||
+     context.mechanism_capabilities.contains("sys:bpf") ||
+     context.mechanism_capabilities.contains("sys:raw_socket") ||
+     context.mechanism_capabilities.contains("dev:gpu") ||
+     context.mechanism_capabilities.contains("virt:nested"))
+};
+`;
+const AGENT_OPS_SANDBOX_GPU_TRAINING_CEDAR = `// =============================================================================
+// Sandbox profile — GPU training
+// =============================================================================
+// GPU-accelerated training/fine-tuning (ADR 0019 D4): write under /scratch,
+// /data, /workspace and /tmp; run python and the common launchers; reach model
+// and dataset hubs; the ONLY permitted mechanism toggle is \`dev:gpu\`; kernel-tier
+// isolation or stronger (Forge IsolationTier kernel/hardware — GPU passthrough
+// needs a real kernel, ADR 0019 D4 "KERNEL-tier floor").
+//
+// Enforcement model (ADR 0019 D1/D3): the ceiling is expressed as \`forbid\`
+// rules so it overrides AgentOps' \`organization.permit-baseline\`; the single
+// \`permit\` turns provisioning ON. \`dev:gpu\` is allowed; every OTHER mechanism
+// toggle (ptrace, bpf, raw_socket, nested virt) is still forbidden. Every forbid
+// \`has\`-guards the optional attribute it reads (absent-attribute access errors
+// and silently voids a forbid — fail-open).
+//
+// Context keys consumed: isolation_tier, writable_paths, exec_allowlist,
+//   egress_hosts, mechanism_capabilities.
+//
+// Category:  sandbox
+// Namespace: AgentOps
+// =============================================================================
+
+@id("sandbox.allow-gpu-training")
+@name("Permit gpu-training sandbox provisioning")
+@description("Permits provision_sandbox so this identity can create sandboxes within the gpu-training ceiling enforced by the forbid rules below.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+permit (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+);
+
+@id("sandbox.block-gpu-training-tier")
+@name("Block weak isolation for gpu sandbox")
+@description("Blocks provision_sandbox when the requested isolation tier is weaker than the kernel tier required for GPU passthrough.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: gpu-training profile requires kernel-tier isolation or stronger.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has isolation_tier &&
+    !(["kernel", "hardware"].contains(context.isolation_tier))
+};
+
+@id("sandbox.block-gpu-training-write")
+@name("Block writable paths outside training dirs")
+@description("Blocks provision_sandbox when a requested writable path prefix is outside /scratch, /data, /workspace or /tmp.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: gpu-training profile permits writes only under /scratch, /data, /workspace or /tmp.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has writable_paths &&
+    !(["/scratch", "/data", "/workspace", "/tmp"].containsAll(context.writable_paths))
+};
+
+@id("sandbox.block-gpu-training-exec")
+@name("Block executables outside training launchers")
+@description("Blocks provision_sandbox when the requested exec allowlist includes anything outside python and the approved launchers.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: gpu-training profile permits only python, bash, sh, accelerate and torchrun.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has exec_allowlist &&
+    !(["python", "python3", "bash", "sh", "accelerate", "torchrun"].containsAll(context.exec_allowlist))
+};
+
+@id("sandbox.block-gpu-training-egress")
+@name("Block egress outside model and dataset hubs")
+@description("Blocks provision_sandbox when a requested egress host is outside the approved model and dataset hubs.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: gpu-training profile permits egress only to approved model and dataset hubs.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    (context has egress_hosts &&
+     !(["huggingface.co", "cdn-lfs.huggingface.co", "pypi.org", "files.pythonhosted.org", "storage.googleapis.com"].containsAll(context.egress_hosts))) ||
+    (context has network_egress && context.network_egress == true && !(context has egress_hosts))
+};
+
+@id("sandbox.block-gpu-training-mechanisms")
+@name("Block mechanism toggles beyond gpu")
+@description("Blocks provision_sandbox when a mechanism toggle other than dev:gpu is requested.")
+@severity("high")
+@tags("category:sandbox,surface:provision-sandbox,scope:per-agent,posture:deny-default")
+@reject_message("Sandbox provisioning blocked: gpu-training profile permits only the dev:gpu mechanism toggle.")
+forbid (
+    principal,
+    action == AgentOps::Action::"provision_sandbox",
+    resource
+)
+when {
+    context has mechanism_capabilities &&
+    (context.mechanism_capabilities.contains("sys:ptrace") ||
+     context.mechanism_capabilities.contains("sys:bpf") ||
+     context.mechanism_capabilities.contains("sys:raw_socket") ||
+     context.mechanism_capabilities.contains("virt:nested"))
+};
+`;
 // =============================================================================
 // CATEGORIES
 // =============================================================================
@@ -40,6 +510,7 @@ export const AGENT_OPS_CATEGORIES = [
     { id: 'code-security', name: 'Code Security', description: 'Enforce safe coding patterns: no exfiltration commands, no destructive write operations.' },
     { id: 'content-safety', name: 'Content Safety', description: 'Block harmful, toxic, or policy-violating content in agent inputs and outputs.' },
     { id: 'organization', name: 'Organization', description: 'Organization-wide baselines and default permit/deny policies.' },
+    { id: 'sandbox', name: 'Sandbox', description: 'Forge sandbox provisioning profiles — capability ceilings for the OS-layer envelope (writable paths, egress, exec, mechanism toggles, isolation tier).' },
 ];
 // =============================================================================
 // DEFAULT POLICIES
@@ -70,6 +541,42 @@ export const AGENT_OPS_TEMPLATES = [
         tags: ['category:organization', 'posture:permit-default'],
         autoDeploy: true,
     },
+    {
+        id: 'sandbox.locked-down',
+        name: 'Sandbox: Locked down',
+        description: 'Permits sandbox provisioning within the tightest ceiling: python only, writes under /scratch, no network, no mechanism toggles, kernel-tier isolation or stronger.',
+        category: 'sandbox',
+        cedarText: AGENT_OPS_SANDBOX_LOCKED_DOWN_CEDAR,
+        severity: 'high',
+        tags: ['category:sandbox', 'surface:provision-sandbox', 'scope:per-agent', 'posture:deny-default'],
+    },
+    {
+        id: 'sandbox.data-processing',
+        name: 'Sandbox: Data processing',
+        description: 'Permits sandbox provisioning for offline batch data work: python and a POSIX shell, writes under /scratch, /data and /tmp, no network, no mechanism toggles.',
+        category: 'sandbox',
+        cedarText: AGENT_OPS_SANDBOX_DATA_PROCESSING_CEDAR,
+        severity: 'high',
+        tags: ['category:sandbox', 'surface:provision-sandbox', 'scope:per-agent', 'posture:deny-default'],
+    },
+    {
+        id: 'sandbox.network-dev',
+        name: 'Sandbox: Network dev',
+        description: 'Permits sandbox provisioning for dev workloads with controlled egress: common dev toolchain, writes under /scratch, /workspace and /tmp, egress limited to approved package and source hosts.',
+        category: 'sandbox',
+        cedarText: AGENT_OPS_SANDBOX_NETWORK_DEV_CEDAR,
+        severity: 'high',
+        tags: ['category:sandbox', 'surface:provision-sandbox', 'scope:per-agent', 'posture:deny-default'],
+    },
+    {
+        id: 'sandbox.gpu-training',
+        name: 'Sandbox: GPU training',
+        description: 'Permits sandbox provisioning for GPU training: dev:gpu the only mechanism toggle, kernel-tier isolation or stronger, writes under training dirs, egress limited to model and dataset hubs.',
+        category: 'sandbox',
+        cedarText: AGENT_OPS_SANDBOX_GPU_TRAINING_CEDAR,
+        severity: 'high',
+        tags: ['category:sandbox', 'surface:provision-sandbox', 'scope:per-agent', 'posture:deny-default'],
+    },
 ];
 // =============================================================================
 // TEMPLATES METADATA
@@ -114,6 +621,11 @@ export const AGENT_OPS_TEMPLATES_JSON = `{
       "id": "organization",
       "name": "Organization",
       "description": "Organization-wide baselines and default permit/deny policies."
+    },
+    {
+      "id": "sandbox",
+      "name": "Sandbox",
+      "description": "Forge sandbox provisioning profiles — capability ceilings for the OS-layer envelope (writable paths, egress, exec, mechanism toggles, isolation tier)."
     }
   ],
   "defaults": [
@@ -138,6 +650,42 @@ export const AGENT_OPS_TEMPLATES_JSON = `{
       "severity": "low",
       "tags": ["category:organization", "posture:permit-default"],
       "auto_deploy": true
+    },
+    {
+      "id": "sandbox.locked-down",
+      "name": "Sandbox: Locked down",
+      "description": "Permits sandbox provisioning within the tightest ceiling: python only, writes under /scratch, no network, no mechanism toggles, kernel-tier isolation or stronger.",
+      "category": "sandbox",
+      "file": "profiles/locked_down.cedar",
+      "severity": "high",
+      "tags": ["category:sandbox", "surface:provision-sandbox", "scope:per-agent", "posture:deny-default"]
+    },
+    {
+      "id": "sandbox.data-processing",
+      "name": "Sandbox: Data processing",
+      "description": "Permits sandbox provisioning for offline batch data work: python and a POSIX shell, writes under /scratch, /data and /tmp, no network, no mechanism toggles.",
+      "category": "sandbox",
+      "file": "profiles/data_processing.cedar",
+      "severity": "high",
+      "tags": ["category:sandbox", "surface:provision-sandbox", "scope:per-agent", "posture:deny-default"]
+    },
+    {
+      "id": "sandbox.network-dev",
+      "name": "Sandbox: Network dev",
+      "description": "Permits sandbox provisioning for dev workloads with controlled egress: common dev toolchain, writes under /scratch, /workspace and /tmp, egress limited to approved package and source hosts.",
+      "category": "sandbox",
+      "file": "profiles/network_dev.cedar",
+      "severity": "high",
+      "tags": ["category:sandbox", "surface:provision-sandbox", "scope:per-agent", "posture:deny-default"]
+    },
+    {
+      "id": "sandbox.gpu-training",
+      "name": "Sandbox: GPU training",
+      "description": "Permits sandbox provisioning for GPU training: dev:gpu the only mechanism toggle, kernel-tier isolation or stronger, writes under training dirs, egress limited to model and dataset hubs.",
+      "category": "sandbox",
+      "file": "profiles/gpu_training.cedar",
+      "severity": "high",
+      "tags": ["category:sandbox", "surface:provision-sandbox", "scope:per-agent", "posture:deny-default"]
     }
   ]
 }

package/dist/agent_ops-entities.gen.js

@@ -7,7 +7,7 @@
 export const AGENT_OPS_ENTITIES = {
     principals: ['Agent', 'User'],
     resources: ['Agent', 'App', 'Session'],
-    actions: ['call_tool', 'connect_server', 'process_prompt', 'read_file', 'write_file'],
+    actions: ['call_tool', 'connect_server', 'process_prompt', 'provision_sandbox', 'read_file', 'write_file'],
 };
 /**
  * Per-action entity mapping for AgentOps.
@@ -26,6 +26,10 @@ export const AGENT_OPS_ACTION_ENTITIES = {
         principals: ['Agent', 'User'],
         resources: ['Agent', 'App', 'Session'],
     },
+    'provision_sandbox': {
+        principals: ['Agent', 'User'],
+        resources: ['Agent', 'Session'],
+    },
     'read_file': {
         principals: ['Agent', 'User'],
         resources: ['Agent', 'Session'],