@highflame/policy 2.2.27 → 2.2.28

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (19) hide show
  1. package/_schemas/agent_ops/context.json +292 -5
  2. package/_schemas/agent_ops/schema.cedarschema +167 -0
  3. package/_schemas/agent_ops/templates/profiles/data_processing.cedar +114 -0
  4. package/_schemas/agent_ops/templates/profiles/gpu_training.cedar +117 -0
  5. package/_schemas/agent_ops/templates/profiles/locked_down.cedar +118 -0
  6. package/_schemas/agent_ops/templates/profiles/network_dev.cedar +117 -0
  7. package/_schemas/agent_ops/templates/templates.json +41 -0
  8. package/dist/actions.gen.d.ts +1 -0
  9. package/dist/actions.gen.js +1 -0
  10. package/dist/agent_ops-context.gen.d.ts +18 -1
  11. package/dist/agent_ops-context.gen.js +34 -0
  12. package/dist/agent_ops-defaults.gen.d.ts +1 -1
  13. package/dist/agent_ops-defaults.gen.js +548 -0
  14. package/dist/agent_ops-entities.gen.js +5 -1
  15. package/dist/schema.gen.d.ts +1 -1
  16. package/dist/schema.gen.js +1 -0
  17. package/dist/service-schemas.gen.d.ts +1 -1
  18. package/dist/service-schemas.gen.js +216 -5
  19. package/package.json +1 -1
package/dist/service-schemas.gen.d.ts CHANGED
@@ -3,7 +3,7 @@
3
3
  *
4
4
  * Full Cedar schema for agent_ops, embedded at codegen time.
5
5
  */
6
- export declare const AGENT_OPS_SCHEMA = "// =============================================================================\n// AgentOps Cedar Schema\n// =============================================================================\n// Unified schema for all agent guardrail policies. Covers every request path\n// where an AI agent touches the Highflame platform:\n// - LLM prompt/response (Guardrails path)\n// - IDE tool calls and file access (Overwatch path)\n// - MCP server connections (AI Gateway path)\n//\n// The context types are a superset of Guardrails, Overwatch, and AI Gateway\n// schemas. All extra fields are optional \u2014 Shield projects only what is present\n// in the request, Cedar ignores absent optional attributes.\n//\n// Service: highflame-shield (agent_ops product)\n// Namespace: AgentOps\n// =============================================================================\n\nnamespace AgentOps {\n // =========================================================================\n // Entity Types \u2014 ReBAC Hierarchy\n // =========================================================================\n // Entity hierarchy enables Cedar's `in` operator for policy scoping:\n // Account (org root)\n // \u2514\u2500\u2500 Project in [Account]\n // \u251C\u2500\u2500 App in [Project]\n // \u2502 \u2514\u2500\u2500 Session in [App, Agent]\n // \u2514\u2500\u2500 Agent in [Project]\n // \u2514\u2500\u2500 Session in [App, Agent]\n //\n // Policy scoping examples:\n // resource in AgentOps::Project::\"<uuid>\" \u2192 project-wide (all agents)\n // resource in AgentOps::Agent::\"<external_id>\" \u2192 named agent + its sessions\n // resource == AgentOps::Agent::\"<external_id>\" \u2192 named agent only (exact match)\n // resource in AgentOps::Account::\"<uuid>\" \u2192 org-wide\n // =========================================================================\n\n /// Account represents an organization (top-level tenant)\n entity Account;\n\n /// Project represents a project within an account\n entity Project in [Account];\n\n /// User represents a principal (human or service) making requests\n entity User;\n\n /// Agent represents an AI agent (Claude, Cursor, Copilot, MCP client, etc.)\n /// Used as both principal (who is acting) and resource (policy scoping target).\n /// Agent + sessions: resource in AgentOps::Agent::\"<external_id>\" (hierarchy match)\n /// Agent only: resource == AgentOps::Agent::\"<external_id>\" (exact match)\n entity Agent in [Project];\n\n /// App represents a protected application (guardrails-enabled LLM app)\n entity App in [Project];\n\n /// Session represents an agentic conversation session with state tracking.\n /// Sessions can belong to either an App or an Agent.\n entity Session in [App, Agent];\n\n // =========================================================================\n // Actions\n // =========================================================================\n\n /// Process user prompts and AI responses for security threats and content violations\n action \"process_prompt\" appliesTo {\n principal: [User, Agent],\n resource: [App, Agent, Session],\n context: ProcessPromptContext\n };\n\n /// Execute tool calls (shell, file operations, MCP tools)\n action \"call_tool\" appliesTo {\n principal: [User, Agent],\n resource: [Agent, Session],\n context: CallToolContext\n };\n\n /// Read file operations\n action \"read_file\" appliesTo {\n principal: [User, Agent],\n resource: [Agent, Session],\n context: FileReadContext\n };\n\n /// Write file operations\n action \"write_file\" appliesTo {\n principal: [User, Agent],\n resource: [Agent, Session],\n context: FileWriteContext\n };\n\n /// Connect to an MCP server\n action \"connect_server\" appliesTo {\n principal: [User, Agent],\n resource: [Agent, Session],\n context: ConnectServerContext\n };\n\n // =========================================================================\n // Context Types (Action-Specific)\n // =========================================================================\n\n /// Context for process_prompt action (user prompts & AI responses)\n type ProcessPromptContext = {\n // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n \"role\"?: String,\n \"privilege_scope\"?: Set<String>,\n \"identity_type\"?: String, // Principal identity class: \"human\" | \"agent\" | \"service\" | \"mcp_server\"\n \"principal\"?: String, // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)\n // Core metadata (required)\n \"request_id\": String,\n \"timestamp\": Long,\n \"direction\": String, // \"input\" | \"output\"\n \"content_type\": String, // \"prompt\" | \"response\" | \"tool_call\" | \"file\"\n \"detector_count\": Long,\n\n // IDE / workspace context (optional \u2014 present for Overwatch/code-agent traffic)\n \"source\"?: String, // Traffic origin: \"ide\" | \"cli\" | \"api\" | \"browser\"\n \"event\"?: String, // Event type: \"prompt\" | \"tool_call\" | \"file_read\" | ...\n \"user_email\"?: String, // Human operator email (IDE sessions)\n \"cwd\"?: String, // Current working directory\n \"workspace_root\"?: String, // IDE workspace root path\n\n // Model context (optional \u2014 present for AI Gateway traffic)\n \"model_name\"?: String, // LLM model name: \"claude-3-5-sonnet\", \"gpt-4o\", ...\n \"model_provider\"?: String, // Model provider: \"anthropic\" | \"openai\" | \"google\" | ...\n\n // Security - Injection & Jailbreak (optional)\n \"injection_score\"?: Long, // Combined injection confidence: MAX(pulse, deep_context)\n \"jailbreak_score\"?: Long, // Combined jailbreak confidence: MAX(pulse, deep_context)\n \"injection_pulse_score\"?: Long, // 0-100 Pulse single-turn classifier\n \"injection_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n \"jailbreak_pulse_score\"?: Long, // 0-100 Pulse single-turn classifier\n \"jailbreak_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n \"injection_type\"?: String, // \"prompt\" | \"sql\" | \"command\" | \"none\"\n \"indirect_injection_score\"?: Long, // Indirect injection via tool outputs (0-100)\n\n // Privacy - Secrets (optional)\n \"secrets_detected\"?: Boolean,\n \"secret_count\"?: Long,\n \"secret_types\"?: Set<String>, // [\"aws_access_key\", \"github_token\", ...]\n\n // Privacy - PII (optional)\n \"pii_detected\"?: Boolean,\n \"pii_count\"?: Long,\n \"pii_types\"?: Set<String>, // [\"email\", \"phone\", \"ssn\", \"credit_card\", ...]\n \"pii_score\"?: Long, // PII ML classifier confidence (0-100)\n\n // Aggregated threat summary (optional \u2014 populated by aggregation detectors)\n \"highest_severity\"?: String, // \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n \"threat_count\"?: Long,\n \"threat_categories\"?: Set<String>,\n \"detected_threats\"?: Set<String>,\n\n // Trust & Safety - Toxicity (optional)\n \"violence_score\"?: Long, // 0-100\n \"hate_speech_score\"?: Long, // 0-100\n \"sexual_score\"?: Long, // 0-100\n \"weapons_score\"?: Long, // 0-100\n \"crime_score\"?: Long, // 0-100\n \"profanity_score\"?: Long, // 0-100\n\n // Semantic - Topic Classification (optional)\n \"content_topics\"?: Set<String>, // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n \"topic_confidence\"?: Long, // 0-100\n\n // Security - Invisible Character Detection (optional)\n \"invisible_chars_detected\"?: Boolean,\n \"invisible_chars_score\"?: Long, // 0-100\n\n // Security - Pattern Detection (optional)\n \"command_injection_detected\"?: Boolean,\n \"command_injection_type\"?: String, // \"reverse_shell\" | \"privilege_escalation\" | ...\n \"command_injection_score\"?: Long, // 0-100\n \"path_traversal_detected\"?: Boolean,\n \"path_traversal_severity\"?: String, // \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n \"path_traversal_type\"?: String,\n \"sql_injection_detected\"?: Boolean,\n \"sql_injection_type\"?: String, // \"tautology\" | \"union_based\" | \"destructive\" | ...\n \"sql_injection_score\"?: Long, // 0-100\n\n // Security - Cross-Origin Escalation (optional)\n \"cross_origin_detected\"?: Boolean,\n \"cross_origin_type\"?: String, // \"cross_origin_tool\" | \"cross_origin_server\" | \"none\"\n \"cross_origin_score\"?: Long, // 0-100\n\n // Security - Encoded Injection (optional)\n \"encoded_content_detected\"?: Boolean,\n \"encoded_types\"?: Set<String>, // [\"base64\", \"hex\", \"unicode\", \"url\", ...]\n \"encoded_count\"?: Long,\n \"encoded_score\"?: Long, // 0-100\n\n // Language & Script Detection (optional)\n \"detected_language\"?: String, // ISO language code\n \"is_english\"?: Boolean,\n \"language_confidence\"?: Long, // 0-100\n \"detected_script\"?: String, // \"latin\" | \"cyrillic\" | \"arabic\" | \"unknown\" | ...\n \"is_latin_script\"?: Boolean,\n \"script_confidence\"?: Long, // 0-100\n\n // Content Analysis (optional)\n \"hallucination_score\"?: Long,\n \"factuality_score\"?: Long, // 0-100\n \"sentiment_score\"?: Long,\n \"contains_code\"?: Boolean,\n \"code_languages\"?: Set<String>,\n \"code_ratio\"?: Long, // 0-100\n \"keyword_matched\"?: Boolean,\n \"keyword_categories\"?: Set<String>,\n \"keyword_count\"?: Long,\n \"contains_non_ascii\"?: Boolean,\n \"phishing_detected\"?: Boolean,\n \"content_safety_score\"?: Long, // 0-100\n \"content_safety_blocked\"?: Boolean,\n\n // Agentic - Multi-Turn Context (optional)\n \"conversation_turn\"?: Long,\n \"multi_turn_detection\"?: Boolean,\n\n // Session Detection History \u2014 cross-turn sticky flags (optional)\n \"session_pii_detected\"?: Boolean,\n \"session_pii_types\"?: Set<String>,\n \"session_secrets_detected\"?: Boolean,\n \"session_secret_types\"?: Set<String>,\n \"session_injection_detected\"?: Boolean,\n \"session_command_injection\"?: Boolean,\n \"session_threat_turns\"?: Long,\n \"session_max_injection_score\"?: Long,\n \"session_max_jailbreak_score\"?: Long,\n \"session_max_command_injection_score\"?: Long,\n \"session_max_pii_score\"?: Long,\n \"session_max_secret_score\"?: Long,\n \"session_cumulative_risk_score\"?: Long,\n \"session_original_request\"?: String,\n \"session_max_sensitivity\"?: String,\n\n // Usage Budget \u2014 multi-window token & cost enforcement (optional)\n \"budget_remaining_pct\"?: Long,\n \"budget_exceeded\"?: Boolean,\n \"budget_cost_micros_this_turn\"?: Long,\n \"budget_model\"?: String,\n \"budget_tokens_pct_session\"?: Long,\n \"budget_tokens_pct_daily\"?: Long,\n \"budget_tokens_pct_monthly\"?: Long,\n \"budget_cost_pct_daily\"?: Long,\n \"budget_cost_pct_monthly\"?: Long,\n \"budget_exceeded_session\"?: Boolean,\n \"budget_exceeded_daily\"?: Boolean,\n \"budget_exceeded_monthly\"?: Boolean,\n\n // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n \"rpm_remaining_pct\"?: Long,\n \"rpm_exceeded\"?: Boolean,\n \"tpm_remaining_pct\"?: Long,\n \"tpm_exceeded\"?: Boolean,\n\n // Agent Identity \u2014 authenticated agent principal metadata (optional)\n \"agent_id\"?: String,\n \"agent_type\"?: String, // \"orchestrator\" | \"autonomous\" | \"tool_agent\" | \"human_proxy\"\n \"agent_trust_level\"?: String, // \"first_party\" | \"verified_third_party\" | \"unverified\"\n \"agent_framework\"?: String,\n \"agent_publisher\"?: String,\n\n };\n\n /// Context for call_tool action (agentic tool execution)\n type CallToolContext = {\n // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n \"role\"?: String,\n \"privilege_scope\"?: Set<String>,\n \"identity_type\"?: String,\n \"principal\"?: String,\n // Core metadata (required)\n \"request_id\": String,\n \"timestamp\": Long,\n\n // IDE / workspace context (optional)\n \"source\"?: String,\n \"event\"?: String,\n \"user_email\"?: String,\n \"cwd\"?: String,\n \"workspace_root\"?: String,\n\n // Tool Risk (optional)\n \"tool_name\"?: String,\n \"tool_risk_score\"?: Long, // 0-100\n \"tool_is_sensitive\"?: Boolean,\n \"tool_category\"?: String, // \"safe\" | \"sensitive\" | \"dangerous\"\n \"tool_is_builtin\"?: Boolean,\n\n // AARM R3 (CAP-ENF-007) \u2014 Action Parameter Validation\n \"action_params\"?: {\n \"amount\"?: Long,\n \"count\"?: Long,\n \"command\"?: String,\n \"path\"?: String,\n \"url\"?: String,\n \"recipient\"?: String,\n \"target\"?: String,\n \"query\"?: String,\n },\n \"param_type_violation\"?: Boolean,\n \"param_type_violations\"?: Set<String>,\n\n // MCP context (optional)\n \"mcp_server\"?: String,\n \"mcp_tool\"?: String,\n \"mcp_server_verified\"?: Boolean,\n\n // Agentic - Behavioral Patterns (optional)\n \"suspicious_pattern\"?: Boolean,\n \"pattern_type\"?: String, // \"data_exfiltration\" | \"secret_exfiltration\" | ...\n \"sequence_risk\"?: Long, // 0-100\n\n // Agentic - Loop Detection (optional)\n \"loop_detected\"?: Boolean,\n \"loop_count\"?: Long,\n \"loop_tool\"?: String,\n\n // Security checks on tool arguments (optional)\n \"secrets_detected\"?: Boolean,\n \"secret_count\"?: Long,\n \"secret_types\"?: Set<String>,\n \"pii_detected\"?: Boolean,\n \"pii_types\"?: Set<String>,\n \"pii_count\"?: Long,\n \"pii_score\"?: Long,\n \"injection_score\"?: Long,\n \"injection_pulse_score\"?: Long,\n \"injection_deep_context_score\"?: Long,\n \"indirect_injection_score\"?: Long,\n \"indirect_injection_type\"?: String, // Type of indirect injection detected\n\n // Semantic - Topic Classification (optional)\n \"content_topics\"?: Set<String>, // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n \"topic_confidence\"?: Long, // 0-100\n\n // Security - Pattern Detection (optional)\n \"command_injection_detected\"?: Boolean,\n \"command_injection_type\"?: String,\n \"command_injection_score\"?: Long,\n \"path_traversal_detected\"?: Boolean,\n \"path_traversal_severity\"?: String,\n \"path_traversal_type\"?: String,\n \"sql_injection_detected\"?: Boolean,\n \"sql_injection_type\"?: String,\n \"sql_injection_score\"?: Long,\n\n // Security - Cross-Origin Escalation (optional)\n \"cross_origin_detected\"?: Boolean,\n \"cross_origin_type\"?: String,\n \"cross_origin_score\"?: Long,\n\n // Security - Invisible Character Detection (optional)\n \"invisible_chars_detected\"?: Boolean,\n \"invisible_chars_score\"?: Long,\n\n // Security - Encoded Injection (optional)\n \"encoded_content_detected\"?: Boolean,\n \"encoded_types\"?: Set<String>,\n \"encoded_count\"?: Long,\n \"encoded_score\"?: Long,\n\n // Agentic - Agent Security (optional)\n \"tool_poisoning_detected\"?: Boolean,\n \"tool_poisoning_score\"?: Long,\n \"tool_poisoning_type\"?: String,\n \"rug_pull_detected\"?: Boolean,\n \"rug_pull_score\"?: Long,\n \"rug_pull_type\"?: String,\n\n // Agentic - MCP Risk (optional)\n \"mcp_config_risk\"?: Boolean,\n \"mcp_risk_type\"?: String,\n \"mcp_risk_score\"?: Long,\n\n // Tool Operation Classifier (optional)\n \"tool_operation_classes\"?: Set<String>,\n\n // Agentic - Multi-Turn Context (optional)\n \"conversation_turn\"?: Long,\n \"multi_turn_detection\"?: Boolean,\n\n // Session Detection History \u2014 cross-turn sticky flags (optional)\n \"session_pii_detected\"?: Boolean,\n \"session_pii_types\"?: Set<String>,\n \"session_secrets_detected\"?: Boolean,\n \"session_secret_types\"?: Set<String>,\n \"session_injection_detected\"?: Boolean,\n \"session_command_injection\"?: Boolean,\n \"session_threat_turns\"?: Long,\n \"session_max_injection_score\"?: Long,\n \"session_max_jailbreak_score\"?: Long,\n \"session_max_command_injection_score\"?: Long,\n \"session_max_pii_score\"?: Long,\n \"session_max_secret_score\"?: Long,\n \"session_cumulative_risk_score\"?: Long,\n \"session_original_request\"?: String,\n \"session_max_sensitivity\"?: String,\n\n // Usage Budget (optional)\n \"budget_remaining_pct\"?: Long,\n \"budget_exceeded\"?: Boolean,\n \"budget_cost_micros_this_turn\"?: Long,\n \"budget_model\"?: String,\n \"budget_tokens_pct_session\"?: Long,\n \"budget_tokens_pct_daily\"?: Long,\n \"budget_tokens_pct_monthly\"?: Long,\n \"budget_cost_pct_daily\"?: Long,\n \"budget_cost_pct_monthly\"?: Long,\n \"budget_exceeded_session\"?: Boolean,\n \"budget_exceeded_daily\"?: Boolean,\n \"budget_exceeded_monthly\"?: Boolean,\n\n // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n \"rpm_remaining_pct\"?: Long,\n \"rpm_exceeded\"?: Boolean,\n \"tpm_remaining_pct\"?: Long,\n \"tpm_exceeded\"?: Boolean,\n\n // Aggregated threat summary (optional)\n \"highest_severity\"?: String,\n \"threat_count\"?: Long,\n \"detected_threats\"?: Set<String>,\n\n // Agent Identity (optional)\n \"agent_id\"?: String,\n \"agent_type\"?: String,\n \"agent_trust_level\"?: String,\n \"agent_framework\"?: String,\n \"agent_publisher\"?: String,\n\n // File & Path (optional)\n \"path\"?: String,\n\n };\n\n /// Context for read_file action\n type FileReadContext = {\n // Identity (optional)\n \"role\"?: String,\n \"privilege_scope\"?: Set<String>,\n \"identity_type\"?: String,\n \"principal\"?: String,\n // Core metadata (required)\n \"request_id\": String,\n \"timestamp\": Long,\n\n // IDE / workspace context (optional)\n \"source\"?: String,\n \"event\"?: String,\n \"user_email\"?: String,\n \"cwd\"?: String,\n \"workspace_root\"?: String,\n\n // File path (optional)\n \"path\"?: String,\n\n // Security checks on file content (optional)\n \"secrets_detected\"?: Boolean,\n \"secret_count\"?: Long,\n \"secret_types\"?: Set<String>,\n \"pii_detected\"?: Boolean,\n \"pii_types\"?: Set<String>,\n\n // Security - Path Traversal (optional)\n \"path_traversal_detected\"?: Boolean,\n \"path_traversal_severity\"?: String,\n \"path_traversal_type\"?: String,\n\n // Aggregated threat summary (optional)\n \"highest_severity\"?: String,\n \"threat_count\"?: Long,\n \"detected_threats\"?: Set<String>,\n\n // Session Detection History (optional)\n \"session_pii_detected\"?: Boolean,\n \"session_pii_types\"?: Set<String>,\n \"session_secrets_detected\"?: Boolean,\n \"session_secret_types\"?: Set<String>,\n \"session_injection_detected\"?: Boolean,\n \"session_command_injection\"?: Boolean,\n \"session_threat_turns\"?: Long,\n \"session_max_injection_score\"?: Long,\n \"session_max_jailbreak_score\"?: Long,\n \"session_max_command_injection_score\"?: Long,\n \"session_max_pii_score\"?: Long,\n \"session_max_secret_score\"?: Long,\n \"session_cumulative_risk_score\"?: Long,\n \"session_original_request\"?: String,\n \"session_max_sensitivity\"?: String,\n\n // Usage Budget (optional)\n \"budget_remaining_pct\"?: Long,\n \"budget_exceeded\"?: Boolean,\n \"budget_cost_micros_this_turn\"?: Long,\n \"budget_model\"?: String,\n \"budget_tokens_pct_session\"?: Long,\n \"budget_tokens_pct_daily\"?: Long,\n \"budget_tokens_pct_monthly\"?: Long,\n \"budget_cost_pct_daily\"?: Long,\n \"budget_cost_pct_monthly\"?: Long,\n \"budget_exceeded_session\"?: Boolean,\n \"budget_exceeded_daily\"?: Boolean,\n \"budget_exceeded_monthly\"?: Boolean,\n\n // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n \"rpm_remaining_pct\"?: Long,\n \"rpm_exceeded\"?: Boolean,\n \"tpm_remaining_pct\"?: Long,\n \"tpm_exceeded\"?: Boolean,\n\n // Agent Identity (optional)\n \"agent_id\"?: String,\n \"agent_type\"?: String,\n \"agent_trust_level\"?: String,\n \"agent_framework\"?: String,\n \"agent_publisher\"?: String,\n\n };\n\n /// Context for write_file action\n type FileWriteContext = {\n // Identity (optional)\n \"role\"?: String,\n \"privilege_scope\"?: Set<String>,\n \"identity_type\"?: String,\n \"principal\"?: String,\n // Core metadata (required)\n \"request_id\": String,\n \"timestamp\": Long,\n\n // IDE / workspace context (optional)\n \"source\"?: String,\n \"event\"?: String,\n \"user_email\"?: String,\n \"cwd\"?: String,\n \"workspace_root\"?: String,\n\n // File path (optional)\n \"path\"?: String,\n\n // Security - Invisible Character Detection in write content (optional)\n \"invisible_chars_detected\"?: Boolean,\n \"invisible_chars_score\"?: Long,\n\n // Security checks on content being written (optional)\n \"secrets_detected\"?: Boolean,\n \"secret_count\"?: Long,\n \"secret_types\"?: Set<String>,\n \"pii_detected\"?: Boolean,\n \"pii_types\"?: Set<String>,\n\n // Security - Path Traversal (optional)\n \"path_traversal_detected\"?: Boolean,\n \"path_traversal_severity\"?: String,\n \"path_traversal_type\"?: String,\n\n // Aggregated threat summary (optional)\n \"highest_severity\"?: String,\n \"threat_count\"?: Long,\n \"detected_threats\"?: Set<String>,\n\n // Session Detection History (optional)\n \"session_pii_detected\"?: Boolean,\n \"session_pii_types\"?: Set<String>,\n \"session_secrets_detected\"?: Boolean,\n \"session_secret_types\"?: Set<String>,\n \"session_injection_detected\"?: Boolean,\n \"session_command_injection\"?: Boolean,\n \"session_threat_turns\"?: Long,\n \"session_max_injection_score\"?: Long,\n \"session_max_jailbreak_score\"?: Long,\n \"session_max_command_injection_score\"?: Long,\n \"session_max_pii_score\"?: Long,\n \"session_max_secret_score\"?: Long,\n \"session_cumulative_risk_score\"?: Long,\n \"session_original_request\"?: String,\n \"session_max_sensitivity\"?: String,\n\n // Usage Budget (optional)\n \"budget_remaining_pct\"?: Long,\n \"budget_exceeded\"?: Boolean,\n \"budget_cost_micros_this_turn\"?: Long,\n \"budget_model\"?: String,\n \"budget_tokens_pct_session\"?: Long,\n \"budget_tokens_pct_daily\"?: Long,\n \"budget_tokens_pct_monthly\"?: Long,\n \"budget_cost_pct_daily\"?: Long,\n \"budget_cost_pct_monthly\"?: Long,\n \"budget_exceeded_session\"?: Boolean,\n \"budget_exceeded_daily\"?: Boolean,\n \"budget_exceeded_monthly\"?: Boolean,\n\n // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n \"rpm_remaining_pct\"?: Long,\n \"rpm_exceeded\"?: Boolean,\n \"tpm_remaining_pct\"?: Long,\n \"tpm_exceeded\"?: Boolean,\n\n // Agent Identity (optional)\n \"agent_id\"?: String,\n \"agent_type\"?: String,\n \"agent_trust_level\"?: String,\n \"agent_framework\"?: String,\n \"agent_publisher\"?: String,\n\n };\n\n /// Context for connect_server action (MCP server connections)\n type ConnectServerContext = {\n // Identity (optional)\n \"role\"?: String,\n \"privilege_scope\"?: Set<String>,\n \"identity_type\"?: String,\n \"principal\"?: String,\n // Core metadata (required)\n \"request_id\": String,\n \"timestamp\": Long,\n\n // IDE / workspace context (optional)\n \"source\"?: String,\n \"event\"?: String,\n \"user_email\"?: String,\n \"cwd\"?: String,\n \"workspace_root\"?: String,\n\n // MCP context (optional)\n \"mcp_server\"?: String,\n \"mcp_server_verified\"?: Boolean,\n\n // Agentic - Agent Security (optional)\n \"tool_poisoning_detected\"?: Boolean,\n \"tool_poisoning_score\"?: Long,\n \"tool_poisoning_type\"?: String,\n\n // Agentic - MCP Risk (optional)\n \"mcp_config_risk\"?: Boolean,\n \"mcp_risk_type\"?: String,\n \"mcp_risk_score\"?: Long,\n\n // Security - Cross-Origin Escalation (optional)\n \"cross_origin_detected\"?: Boolean,\n \"cross_origin_type\"?: String,\n \"cross_origin_score\"?: Long,\n\n // Aggregated threat summary (optional)\n \"highest_severity\"?: String,\n \"threat_count\"?: Long,\n \"detected_threats\"?: Set<String>,\n\n // Session Detection History (optional)\n \"session_pii_detected\"?: Boolean,\n \"session_pii_types\"?: Set<String>,\n \"session_secrets_detected\"?: Boolean,\n \"session_secret_types\"?: Set<String>,\n \"session_injection_detected\"?: Boolean,\n \"session_command_injection\"?: Boolean,\n \"session_threat_turns\"?: Long,\n \"session_max_injection_score\"?: Long,\n \"session_max_jailbreak_score\"?: Long,\n \"session_max_command_injection_score\"?: Long,\n \"session_max_pii_score\"?: Long,\n \"session_max_secret_score\"?: Long,\n \"session_cumulative_risk_score\"?: Long,\n \"session_original_request\"?: String,\n \"session_max_sensitivity\"?: String,\n\n // Usage Budget (optional)\n \"budget_remaining_pct\"?: Long,\n \"budget_exceeded\"?: Boolean,\n \"budget_cost_micros_this_turn\"?: Long,\n \"budget_model\"?: String,\n \"budget_tokens_pct_session\"?: Long,\n \"budget_tokens_pct_daily\"?: Long,\n \"budget_tokens_pct_monthly\"?: Long,\n \"budget_cost_pct_daily\"?: Long,\n \"budget_cost_pct_monthly\"?: Long,\n \"budget_exceeded_session\"?: Boolean,\n \"budget_exceeded_daily\"?: Boolean,\n \"budget_exceeded_monthly\"?: Boolean,\n\n // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n \"rpm_remaining_pct\"?: Long,\n \"rpm_exceeded\"?: Boolean,\n \"tpm_remaining_pct\"?: Long,\n \"tpm_exceeded\"?: Boolean,\n\n // Agent Identity (optional)\n \"agent_id\"?: String,\n \"agent_type\"?: String,\n \"agent_trust_level\"?: String,\n \"agent_framework\"?: String,\n \"agent_publisher\"?: String,\n\n };\n}\n";
6
+ export declare const AGENT_OPS_SCHEMA = "// =============================================================================\n// AgentOps Cedar Schema\n// =============================================================================\n// Unified schema for all agent guardrail policies. Covers every request path\n// where an AI agent touches the Highflame platform:\n// - LLM prompt/response (Guardrails path)\n// - IDE tool calls and file access (Overwatch path)\n// - MCP server connections (AI Gateway path)\n//\n// The context types are a superset of Guardrails, Overwatch, and AI Gateway\n// schemas. All extra fields are optional \u2014 Shield projects only what is present\n// in the request, Cedar ignores absent optional attributes.\n//\n// Service: highflame-shield (agent_ops product)\n// Namespace: AgentOps\n// =============================================================================\n\nnamespace AgentOps {\n // =========================================================================\n // Entity Types \u2014 ReBAC Hierarchy\n // =========================================================================\n // Entity hierarchy enables Cedar's `in` operator for policy scoping:\n // Account (org root)\n // \u2514\u2500\u2500 Project in [Account]\n // \u251C\u2500\u2500 App in [Project]\n // \u2502 \u2514\u2500\u2500 Session in [App, Agent]\n // \u2514\u2500\u2500 Agent in [Project]\n // \u2514\u2500\u2500 Session in [App, Agent]\n //\n // Policy scoping examples:\n // resource in AgentOps::Project::\"<uuid>\" \u2192 project-wide (all agents)\n // resource in AgentOps::Agent::\"<external_id>\" \u2192 named agent + its sessions\n // resource == AgentOps::Agent::\"<external_id>\" \u2192 named agent only (exact match)\n // resource in AgentOps::Account::\"<uuid>\" \u2192 org-wide\n // =========================================================================\n\n /// Account represents an organization (top-level tenant)\n entity Account;\n\n /// Project represents a project within an account\n entity Project in [Account];\n\n /// User represents a principal (human or service) making requests\n entity User;\n\n /// Agent represents an AI agent (Claude, Cursor, Copilot, MCP client, etc.)\n /// Used as both principal (who is acting) and resource (policy scoping target).\n /// Agent + sessions: resource in AgentOps::Agent::\"<external_id>\" (hierarchy match)\n /// Agent only: resource == AgentOps::Agent::\"<external_id>\" (exact match)\n entity Agent in [Project];\n\n /// App represents a protected application (guardrails-enabled LLM app)\n entity App in [Project];\n\n /// Session represents an agentic conversation session with state tracking.\n /// Sessions can belong to either an App or an Agent.\n entity Session in [App, Agent];\n\n // =========================================================================\n // Actions\n // =========================================================================\n\n /// Process user prompts and AI responses for security threats and content violations\n action \"process_prompt\" appliesTo {\n principal: [User, Agent],\n resource: [App, Agent, Session],\n context: ProcessPromptContext\n };\n\n /// Execute tool calls (shell, file operations, MCP tools)\n action \"call_tool\" appliesTo {\n principal: [User, Agent],\n resource: [Agent, Session],\n context: CallToolContext\n };\n\n /// Read file operations\n action \"read_file\" appliesTo {\n principal: [User, Agent],\n resource: [Agent, Session],\n context: FileReadContext\n };\n\n /// Write file operations\n action \"write_file\" appliesTo {\n principal: [User, Agent],\n resource: [Agent, Session],\n context: FileWriteContext\n };\n\n /// Connect to an MCP server\n action \"connect_server\" appliesTo {\n principal: [User, Agent],\n resource: [Agent, Session],\n context: ConnectServerContext\n };\n\n /// Provision a sandbox for the acting identity (Forge OS-layer envelope).\n /// The MANDATORY authorization gate for sandbox creation (ADR 0019 D1):\n /// Forge evaluates this action's AgentOps bundle at create-time; no decision\n /// means no sandbox. Context carries the requested capability envelope\n /// (writable paths, egress, exec allowlist, curated mechanism toggles,\n /// isolation tier). Raw syscalls are NEVER expressed here \u2014 the enforcement\n /// generators own the mechanism\u2192syscall translation (ADR 0017 D1).\n action \"provision_sandbox\" appliesTo {\n principal: [User, Agent],\n resource: [Agent, Session],\n context: ProvisionSandboxContext\n };\n\n // =========================================================================\n // Context Types (Action-Specific)\n // =========================================================================\n\n /// Context for process_prompt action (user prompts & AI responses)\n type ProcessPromptContext = {\n // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n \"role\"?: String,\n \"privilege_scope\"?: Set<String>,\n \"identity_type\"?: String, // Principal identity class: \"human\" | \"agent\" | \"service\" | \"mcp_server\"\n \"principal\"?: String, // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)\n // Core metadata (required)\n \"request_id\": String,\n \"timestamp\": Long,\n \"direction\": String, // \"input\" | \"output\"\n \"content_type\": String, // \"prompt\" | \"response\" | \"tool_call\" | \"file\"\n \"detector_count\": Long,\n\n // IDE / workspace context (optional \u2014 present for Overwatch/code-agent traffic)\n \"source\"?: String, // Traffic origin: \"ide\" | \"cli\" | \"api\" | \"browser\"\n \"event\"?: String, // Event type: \"prompt\" | \"tool_call\" | \"file_read\" | ...\n \"user_email\"?: String, // Human operator email (IDE sessions)\n \"cwd\"?: String, // Current working directory\n \"workspace_root\"?: String, // IDE workspace root path\n\n // Model context (optional \u2014 present for AI Gateway traffic)\n \"model_name\"?: String, // LLM model name: \"claude-3-5-sonnet\", \"gpt-4o\", ...\n \"model_provider\"?: String, // Model provider: \"anthropic\" | \"openai\" | \"google\" | ...\n\n // Security - Injection & Jailbreak (optional)\n \"injection_score\"?: Long, // Combined injection confidence: MAX(pulse, deep_context)\n \"jailbreak_score\"?: Long, // Combined jailbreak confidence: MAX(pulse, deep_context)\n \"injection_pulse_score\"?: Long, // 0-100 Pulse single-turn classifier\n \"injection_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n \"jailbreak_pulse_score\"?: Long, // 0-100 Pulse single-turn classifier\n \"jailbreak_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n \"injection_type\"?: String, // \"prompt\" | \"sql\" | \"command\" | \"none\"\n \"indirect_injection_score\"?: Long, // Indirect injection via tool outputs (0-100)\n\n // Privacy - Secrets (optional)\n \"secrets_detected\"?: Boolean,\n \"secret_count\"?: Long,\n \"secret_types\"?: Set<String>, // [\"aws_access_key\", \"github_token\", ...]\n\n // Privacy - PII (optional)\n \"pii_detected\"?: Boolean,\n \"pii_count\"?: Long,\n \"pii_types\"?: Set<String>, // [\"email\", \"phone\", \"ssn\", \"credit_card\", ...]\n \"pii_score\"?: Long, // PII ML classifier confidence (0-100)\n\n // Aggregated threat summary (optional \u2014 populated by aggregation detectors)\n \"highest_severity\"?: String, // \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n \"threat_count\"?: Long,\n \"threat_categories\"?: Set<String>,\n \"detected_threats\"?: Set<String>,\n\n // Trust & Safety - Toxicity (optional)\n \"violence_score\"?: Long, // 0-100\n \"hate_speech_score\"?: Long, // 0-100\n \"sexual_score\"?: Long, // 0-100\n \"weapons_score\"?: Long, // 0-100\n \"crime_score\"?: Long, // 0-100\n \"profanity_score\"?: Long, // 0-100\n\n // Semantic - Topic Classification (optional)\n \"content_topics\"?: Set<String>, // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n \"topic_confidence\"?: Long, // 0-100\n\n // Security - Invisible Character Detection (optional)\n \"invisible_chars_detected\"?: Boolean,\n \"invisible_chars_score\"?: Long, // 0-100\n\n // Security - Pattern Detection (optional)\n \"command_injection_detected\"?: Boolean,\n \"command_injection_type\"?: String, // \"reverse_shell\" | \"privilege_escalation\" | ...\n \"command_injection_score\"?: Long, // 0-100\n \"path_traversal_detected\"?: Boolean,\n \"path_traversal_severity\"?: String, // \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n \"path_traversal_type\"?: String,\n \"sql_injection_detected\"?: Boolean,\n \"sql_injection_type\"?: String, // \"tautology\" | \"union_based\" | \"destructive\" | ...\n \"sql_injection_score\"?: Long, // 0-100\n\n // Security - Cross-Origin Escalation (optional)\n \"cross_origin_detected\"?: Boolean,\n \"cross_origin_type\"?: String, // \"cross_origin_tool\" | \"cross_origin_server\" | \"none\"\n \"cross_origin_score\"?: Long, // 0-100\n\n // Security - Encoded Injection (optional)\n \"encoded_content_detected\"?: Boolean,\n \"encoded_types\"?: Set<String>, // [\"base64\", \"hex\", \"unicode\", \"url\", ...]\n \"encoded_count\"?: Long,\n \"encoded_score\"?: Long, // 0-100\n\n // Language & Script Detection (optional)\n \"detected_language\"?: String, // ISO language code\n \"is_english\"?: Boolean,\n \"language_confidence\"?: Long, // 0-100\n \"detected_script\"?: String, // \"latin\" | \"cyrillic\" | \"arabic\" | \"unknown\" | ...\n \"is_latin_script\"?: Boolean,\n \"script_confidence\"?: Long, // 0-100\n\n // Content Analysis (optional)\n \"hallucination_score\"?: Long,\n \"factuality_score\"?: Long, // 0-100\n \"sentiment_score\"?: Long,\n \"contains_code\"?: Boolean,\n \"code_languages\"?: Set<String>,\n \"code_ratio\"?: Long, // 0-100\n \"keyword_matched\"?: Boolean,\n \"keyword_categories\"?: Set<String>,\n \"keyword_count\"?: Long,\n \"contains_non_ascii\"?: Boolean,\n \"phishing_detected\"?: Boolean,\n \"content_safety_score\"?: Long, // 0-100\n \"content_safety_blocked\"?: Boolean,\n\n // Agentic - Multi-Turn Context (optional)\n \"conversation_turn\"?: Long,\n \"multi_turn_detection\"?: Boolean,\n\n // Session Detection History \u2014 cross-turn sticky flags (optional)\n \"session_pii_detected\"?: Boolean,\n \"session_pii_types\"?: Set<String>,\n \"session_secrets_detected\"?: Boolean,\n \"session_secret_types\"?: Set<String>,\n \"session_injection_detected\"?: Boolean,\n \"session_command_injection\"?: Boolean,\n \"session_threat_turns\"?: Long,\n \"session_max_injection_score\"?: Long,\n \"session_max_jailbreak_score\"?: Long,\n \"session_max_command_injection_score\"?: Long,\n \"session_max_pii_score\"?: Long,\n \"session_max_secret_score\"?: Long,\n \"session_cumulative_risk_score\"?: Long,\n \"session_original_request\"?: String,\n \"session_max_sensitivity\"?: String,\n\n // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n // All optional: guard every access with `has` \u2014 an absent-attribute read is\n // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n \"flow_confidentiality\"?: String, // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n \"flow_integrity\"?: String, // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n \"flow_data_types\"?: Set<String>, // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n \"flow_compartments\"?: Set<String>, // \"tenant:*\" | \"customer:*\" | \"project:*\"\n \"flow_resolution_status\"?: String, // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n \"flow_origins\"?: Set<String>, // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n \"flow_sink\"?: String, // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n \"flow_sink_is_external\"?: Boolean,\n \"flow_sink_effects\"?: Set<String>, // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n \"principal_clearances\"?: Set<String>, // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n \"principal_compartments\"?: Set<String>, // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n // Usage Budget \u2014 multi-window token & cost enforcement (optional)\n \"budget_remaining_pct\"?: Long,\n \"budget_exceeded\"?: Boolean,\n \"budget_cost_micros_this_turn\"?: Long,\n \"budget_model\"?: String,\n \"budget_tokens_pct_session\"?: Long,\n \"budget_tokens_pct_daily\"?: Long,\n \"budget_tokens_pct_monthly\"?: Long,\n \"budget_cost_pct_daily\"?: Long,\n \"budget_cost_pct_monthly\"?: Long,\n \"budget_exceeded_session\"?: Boolean,\n \"budget_exceeded_daily\"?: Boolean,\n \"budget_exceeded_monthly\"?: Boolean,\n\n // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n \"rpm_remaining_pct\"?: Long,\n \"rpm_exceeded\"?: Boolean,\n \"tpm_remaining_pct\"?: Long,\n \"tpm_exceeded\"?: Boolean,\n\n // Agent Identity \u2014 authenticated agent principal metadata (optional)\n \"agent_id\"?: String,\n \"agent_type\"?: String, // \"orchestrator\" | \"autonomous\" | \"tool_agent\" | \"human_proxy\"\n \"agent_trust_level\"?: String, // \"first_party\" | \"verified_third_party\" | \"unverified\"\n \"agent_framework\"?: String,\n \"agent_publisher\"?: String,\n\n };\n\n /// Context for call_tool action (agentic tool execution)\n type CallToolContext = {\n // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n \"role\"?: String,\n \"privilege_scope\"?: Set<String>,\n \"identity_type\"?: String,\n \"principal\"?: String,\n // Core metadata (required)\n \"request_id\": String,\n \"timestamp\": Long,\n\n // IDE / workspace context (optional)\n \"source\"?: String,\n \"event\"?: String,\n \"user_email\"?: String,\n \"cwd\"?: String,\n \"workspace_root\"?: String,\n\n // Tool Risk (optional)\n \"tool_name\"?: String,\n \"tool_risk_score\"?: Long, // 0-100\n \"tool_is_sensitive\"?: Boolean,\n \"tool_category\"?: String, // \"safe\" | \"sensitive\" | \"dangerous\"\n \"tool_is_builtin\"?: Boolean,\n\n // AARM R3 (CAP-ENF-007) \u2014 Action Parameter Validation\n \"action_params\"?: {\n \"amount\"?: Long,\n \"count\"?: Long,\n \"command\"?: String,\n \"path\"?: String,\n \"url\"?: String,\n \"recipient\"?: String,\n \"target\"?: String,\n \"query\"?: String,\n },\n \"param_type_violation\"?: Boolean,\n \"param_type_violations\"?: Set<String>,\n\n // MCP context (optional)\n \"mcp_server\"?: String,\n \"mcp_tool\"?: String,\n \"mcp_server_verified\"?: Boolean,\n\n // Agentic - Behavioral Patterns (optional)\n \"suspicious_pattern\"?: Boolean,\n \"pattern_type\"?: String, // \"data_exfiltration\" | \"secret_exfiltration\" | ...\n \"sequence_risk\"?: Long, // 0-100\n\n // Agentic - Loop Detection (optional)\n \"loop_detected\"?: Boolean,\n \"loop_count\"?: Long,\n \"loop_tool\"?: String,\n\n // Security checks on tool arguments (optional)\n \"secrets_detected\"?: Boolean,\n \"secret_count\"?: Long,\n \"secret_types\"?: Set<String>,\n \"pii_detected\"?: Boolean,\n \"pii_types\"?: Set<String>,\n \"pii_count\"?: Long,\n \"pii_score\"?: Long,\n \"injection_score\"?: Long,\n \"injection_pulse_score\"?: Long,\n \"injection_deep_context_score\"?: Long,\n \"indirect_injection_score\"?: Long,\n \"indirect_injection_type\"?: String, // Type of indirect injection detected\n\n // Semantic - Topic Classification (optional)\n \"content_topics\"?: Set<String>, // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n \"topic_confidence\"?: Long, // 0-100\n\n // Security - Pattern Detection (optional)\n \"command_injection_detected\"?: Boolean,\n \"command_injection_type\"?: String,\n \"command_injection_score\"?: Long,\n \"path_traversal_detected\"?: Boolean,\n \"path_traversal_severity\"?: String,\n \"path_traversal_type\"?: String,\n \"sql_injection_detected\"?: Boolean,\n \"sql_injection_type\"?: String,\n \"sql_injection_score\"?: Long,\n\n // Security - Cross-Origin Escalation (optional)\n \"cross_origin_detected\"?: Boolean,\n \"cross_origin_type\"?: String,\n \"cross_origin_score\"?: Long,\n\n // Security - Invisible Character Detection (optional)\n \"invisible_chars_detected\"?: Boolean,\n \"invisible_chars_score\"?: Long,\n\n // Security - Encoded Injection (optional)\n \"encoded_content_detected\"?: Boolean,\n \"encoded_types\"?: Set<String>,\n \"encoded_count\"?: Long,\n \"encoded_score\"?: Long,\n\n // Agentic - Agent Security (optional)\n \"tool_poisoning_detected\"?: Boolean,\n \"tool_poisoning_score\"?: Long,\n \"tool_poisoning_type\"?: String,\n \"rug_pull_detected\"?: Boolean,\n \"rug_pull_score\"?: Long,\n \"rug_pull_type\"?: String,\n\n // Agentic - MCP Risk (optional)\n \"mcp_config_risk\"?: Boolean,\n \"mcp_risk_type\"?: String,\n \"mcp_risk_score\"?: Long,\n\n // Tool Operation Classifier (optional)\n \"tool_operation_classes\"?: Set<String>,\n\n // Agentic - Multi-Turn Context (optional)\n \"conversation_turn\"?: Long,\n \"multi_turn_detection\"?: Boolean,\n\n // Session Detection History \u2014 cross-turn sticky flags (optional)\n \"session_pii_detected\"?: Boolean,\n \"session_pii_types\"?: Set<String>,\n \"session_secrets_detected\"?: Boolean,\n \"session_secret_types\"?: Set<String>,\n \"session_injection_detected\"?: Boolean,\n \"session_command_injection\"?: Boolean,\n \"session_threat_turns\"?: Long,\n \"session_max_injection_score\"?: Long,\n \"session_max_jailbreak_score\"?: Long,\n \"session_max_command_injection_score\"?: Long,\n \"session_max_pii_score\"?: Long,\n \"session_max_secret_score\"?: Long,\n \"session_cumulative_risk_score\"?: Long,\n \"session_original_request\"?: String,\n \"session_max_sensitivity\"?: String,\n\n // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n // All optional: guard every access with `has` \u2014 an absent-attribute read is\n // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n \"flow_confidentiality\"?: String, // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n \"flow_integrity\"?: String, // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n \"flow_data_types\"?: Set<String>, // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n \"flow_compartments\"?: Set<String>, // \"tenant:*\" | \"customer:*\" | \"project:*\"\n \"flow_resolution_status\"?: String, // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n \"flow_origins\"?: Set<String>, // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n \"flow_sink\"?: String, // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n \"flow_sink_is_external\"?: Boolean,\n \"flow_sink_effects\"?: Set<String>, // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n \"principal_clearances\"?: Set<String>, // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n \"principal_compartments\"?: Set<String>, // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n // Usage Budget (optional)\n \"budget_remaining_pct\"?: Long,\n \"budget_exceeded\"?: Boolean,\n \"budget_cost_micros_this_turn\"?: Long,\n \"budget_model\"?: String,\n \"budget_tokens_pct_session\"?: Long,\n \"budget_tokens_pct_daily\"?: Long,\n \"budget_tokens_pct_monthly\"?: Long,\n \"budget_cost_pct_daily\"?: Long,\n \"budget_cost_pct_monthly\"?: Long,\n \"budget_exceeded_session\"?: Boolean,\n \"budget_exceeded_daily\"?: Boolean,\n \"budget_exceeded_monthly\"?: Boolean,\n\n // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n \"rpm_remaining_pct\"?: Long,\n \"rpm_exceeded\"?: Boolean,\n \"tpm_remaining_pct\"?: Long,\n \"tpm_exceeded\"?: Boolean,\n\n // Aggregated threat summary (optional)\n \"highest_severity\"?: String,\n \"threat_count\"?: Long,\n \"detected_threats\"?: Set<String>,\n\n // Agent Identity (optional)\n \"agent_id\"?: String,\n \"agent_type\"?: String,\n \"agent_trust_level\"?: String,\n \"agent_framework\"?: String,\n \"agent_publisher\"?: String,\n\n // File & Path (optional)\n \"path\"?: String,\n\n };\n\n /// Context for read_file action\n type FileReadContext = {\n // Identity (optional)\n \"role\"?: String,\n \"privilege_scope\"?: Set<String>,\n \"identity_type\"?: String,\n \"principal\"?: String,\n // Core metadata (required)\n \"request_id\": String,\n \"timestamp\": Long,\n\n // IDE / workspace context (optional)\n \"source\"?: String,\n \"event\"?: String,\n \"user_email\"?: String,\n \"cwd\"?: String,\n \"workspace_root\"?: String,\n\n // File path (optional)\n \"path\"?: String,\n\n // Security checks on file content (optional)\n \"secrets_detected\"?: Boolean,\n \"secret_count\"?: Long,\n \"secret_types\"?: Set<String>,\n \"pii_detected\"?: Boolean,\n \"pii_types\"?: Set<String>,\n\n // Security - Path Traversal (optional)\n \"path_traversal_detected\"?: Boolean,\n \"path_traversal_severity\"?: String,\n \"path_traversal_type\"?: String,\n\n // Aggregated threat summary (optional)\n \"highest_severity\"?: String,\n \"threat_count\"?: Long,\n \"detected_threats\"?: Set<String>,\n\n // Session Detection History (optional)\n \"session_pii_detected\"?: Boolean,\n \"session_pii_types\"?: Set<String>,\n \"session_secrets_detected\"?: Boolean,\n \"session_secret_types\"?: Set<String>,\n \"session_injection_detected\"?: Boolean,\n \"session_command_injection\"?: Boolean,\n \"session_threat_turns\"?: Long,\n \"session_max_injection_score\"?: Long,\n \"session_max_jailbreak_score\"?: Long,\n \"session_max_command_injection_score\"?: Long,\n \"session_max_pii_score\"?: Long,\n \"session_max_secret_score\"?: Long,\n \"session_cumulative_risk_score\"?: Long,\n \"session_original_request\"?: String,\n \"session_max_sensitivity\"?: String,\n\n // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n // All optional: guard every access with `has` \u2014 an absent-attribute read is\n // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n \"flow_confidentiality\"?: String, // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n \"flow_integrity\"?: String, // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n \"flow_data_types\"?: Set<String>, // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n \"flow_compartments\"?: Set<String>, // \"tenant:*\" | \"customer:*\" | \"project:*\"\n \"flow_resolution_status\"?: String, // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n \"flow_origins\"?: Set<String>, // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n \"flow_sink\"?: String, // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n \"flow_sink_is_external\"?: Boolean,\n \"flow_sink_effects\"?: Set<String>, // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n \"principal_clearances\"?: Set<String>, // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n \"principal_compartments\"?: Set<String>, // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n // Usage Budget (optional)\n \"budget_remaining_pct\"?: Long,\n \"budget_exceeded\"?: Boolean,\n \"budget_cost_micros_this_turn\"?: Long,\n \"budget_model\"?: String,\n \"budget_tokens_pct_session\"?: Long,\n \"budget_tokens_pct_daily\"?: Long,\n \"budget_tokens_pct_monthly\"?: Long,\n \"budget_cost_pct_daily\"?: Long,\n \"budget_cost_pct_monthly\"?: Long,\n \"budget_exceeded_session\"?: Boolean,\n \"budget_exceeded_daily\"?: Boolean,\n \"budget_exceeded_monthly\"?: Boolean,\n\n // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n \"rpm_remaining_pct\"?: Long,\n \"rpm_exceeded\"?: Boolean,\n \"tpm_remaining_pct\"?: Long,\n \"tpm_exceeded\"?: Boolean,\n\n // Agent Identity (optional)\n \"agent_id\"?: String,\n \"agent_type\"?: String,\n \"agent_trust_level\"?: String,\n \"agent_framework\"?: String,\n \"agent_publisher\"?: String,\n\n };\n\n /// Context for write_file action\n type FileWriteContext = {\n // Identity (optional)\n \"role\"?: String,\n \"privilege_scope\"?: Set<String>,\n \"identity_type\"?: String,\n \"principal\"?: String,\n // Core metadata (required)\n \"request_id\": String,\n \"timestamp\": Long,\n\n // IDE / workspace context (optional)\n \"source\"?: String,\n \"event\"?: String,\n \"user_email\"?: String,\n \"cwd\"?: String,\n \"workspace_root\"?: String,\n\n // File path (optional)\n \"path\"?: String,\n\n // Security - Invisible Character Detection in write content (optional)\n \"invisible_chars_detected\"?: Boolean,\n \"invisible_chars_score\"?: Long,\n\n // Security checks on content being written (optional)\n \"secrets_detected\"?: Boolean,\n \"secret_count\"?: Long,\n \"secret_types\"?: Set<String>,\n \"pii_detected\"?: Boolean,\n \"pii_types\"?: Set<String>,\n\n // Security - Path Traversal (optional)\n \"path_traversal_detected\"?: Boolean,\n \"path_traversal_severity\"?: String,\n \"path_traversal_type\"?: String,\n\n // Aggregated threat summary (optional)\n \"highest_severity\"?: String,\n \"threat_count\"?: Long,\n \"detected_threats\"?: Set<String>,\n\n // Session Detection History (optional)\n \"session_pii_detected\"?: Boolean,\n \"session_pii_types\"?: Set<String>,\n \"session_secrets_detected\"?: Boolean,\n \"session_secret_types\"?: Set<String>,\n \"session_injection_detected\"?: Boolean,\n \"session_command_injection\"?: Boolean,\n \"session_threat_turns\"?: Long,\n \"session_max_injection_score\"?: Long,\n \"session_max_jailbreak_score\"?: Long,\n \"session_max_command_injection_score\"?: Long,\n \"session_max_pii_score\"?: Long,\n \"session_max_secret_score\"?: Long,\n \"session_cumulative_risk_score\"?: Long,\n \"session_original_request\"?: String,\n \"session_max_sensitivity\"?: String,\n\n // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n // All optional: guard every access with `has` \u2014 an absent-attribute read is\n // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n \"flow_confidentiality\"?: String, // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n \"flow_integrity\"?: String, // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n \"flow_data_types\"?: Set<String>, // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n \"flow_compartments\"?: Set<String>, // \"tenant:*\" | \"customer:*\" | \"project:*\"\n \"flow_resolution_status\"?: String, // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n \"flow_origins\"?: Set<String>, // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n \"flow_sink\"?: String, // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n \"flow_sink_is_external\"?: Boolean,\n \"flow_sink_effects\"?: Set<String>, // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n \"principal_clearances\"?: Set<String>, // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n \"principal_compartments\"?: Set<String>, // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n // Usage Budget (optional)\n \"budget_remaining_pct\"?: Long,\n \"budget_exceeded\"?: Boolean,\n \"budget_cost_micros_this_turn\"?: Long,\n \"budget_model\"?: String,\n \"budget_tokens_pct_session\"?: Long,\n \"budget_tokens_pct_daily\"?: Long,\n \"budget_tokens_pct_monthly\"?: Long,\n \"budget_cost_pct_daily\"?: Long,\n \"budget_cost_pct_monthly\"?: Long,\n \"budget_exceeded_session\"?: Boolean,\n \"budget_exceeded_daily\"?: Boolean,\n \"budget_exceeded_monthly\"?: Boolean,\n\n // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n \"rpm_remaining_pct\"?: Long,\n \"rpm_exceeded\"?: Boolean,\n \"tpm_remaining_pct\"?: Long,\n \"tpm_exceeded\"?: Boolean,\n\n // Agent Identity (optional)\n \"agent_id\"?: String,\n \"agent_type\"?: String,\n \"agent_trust_level\"?: String,\n \"agent_framework\"?: String,\n \"agent_publisher\"?: String,\n\n };\n\n /// Context for connect_server action (MCP server connections)\n type ConnectServerContext = {\n // Identity (optional)\n \"role\"?: String,\n \"privilege_scope\"?: Set<String>,\n \"identity_type\"?: String,\n \"principal\"?: String,\n // Core metadata (required)\n \"request_id\": String,\n \"timestamp\": Long,\n\n // IDE / workspace context (optional)\n \"source\"?: String,\n \"event\"?: String,\n \"user_email\"?: String,\n \"cwd\"?: String,\n \"workspace_root\"?: String,\n\n // MCP context (optional)\n \"mcp_server\"?: String,\n \"mcp_server_verified\"?: Boolean,\n\n // Agentic - Agent Security (optional)\n \"tool_poisoning_detected\"?: Boolean,\n \"tool_poisoning_score\"?: Long,\n \"tool_poisoning_type\"?: String,\n\n // Agentic - MCP Risk (optional)\n \"mcp_config_risk\"?: Boolean,\n \"mcp_risk_type\"?: String,\n \"mcp_risk_score\"?: Long,\n\n // Security - Cross-Origin Escalation (optional)\n \"cross_origin_detected\"?: Boolean,\n \"cross_origin_type\"?: String,\n \"cross_origin_score\"?: Long,\n\n // Aggregated threat summary (optional)\n \"highest_severity\"?: String,\n \"threat_count\"?: Long,\n \"detected_threats\"?: Set<String>,\n\n // Session Detection History (optional)\n \"session_pii_detected\"?: Boolean,\n \"session_pii_types\"?: Set<String>,\n \"session_secrets_detected\"?: Boolean,\n \"session_secret_types\"?: Set<String>,\n \"session_injection_detected\"?: Boolean,\n \"session_command_injection\"?: Boolean,\n \"session_threat_turns\"?: Long,\n \"session_max_injection_score\"?: Long,\n \"session_max_jailbreak_score\"?: Long,\n \"session_max_command_injection_score\"?: Long,\n \"session_max_pii_score\"?: Long,\n \"session_max_secret_score\"?: Long,\n \"session_cumulative_risk_score\"?: Long,\n \"session_original_request\"?: String,\n \"session_max_sensitivity\"?: String,\n\n // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n // All optional: guard every access with `has` \u2014 an absent-attribute read is\n // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n \"flow_confidentiality\"?: String, // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n \"flow_integrity\"?: String, // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n \"flow_data_types\"?: Set<String>, // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n \"flow_compartments\"?: Set<String>, // \"tenant:*\" | \"customer:*\" | \"project:*\"\n \"flow_resolution_status\"?: String, // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n \"flow_origins\"?: Set<String>, // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n \"flow_sink\"?: String, // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n \"flow_sink_is_external\"?: Boolean,\n \"flow_sink_effects\"?: Set<String>, // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n \"principal_clearances\"?: Set<String>, // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n \"principal_compartments\"?: Set<String>, // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n // Usage Budget (optional)\n \"budget_remaining_pct\"?: Long,\n \"budget_exceeded\"?: Boolean,\n \"budget_cost_micros_this_turn\"?: Long,\n \"budget_model\"?: String,\n \"budget_tokens_pct_session\"?: Long,\n \"budget_tokens_pct_daily\"?: Long,\n \"budget_tokens_pct_monthly\"?: Long,\n \"budget_cost_pct_daily\"?: Long,\n \"budget_cost_pct_monthly\"?: Long,\n \"budget_exceeded_session\"?: Boolean,\n \"budget_exceeded_daily\"?: Boolean,\n \"budget_exceeded_monthly\"?: Boolean,\n\n // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n \"rpm_remaining_pct\"?: Long,\n \"rpm_exceeded\"?: Boolean,\n \"tpm_remaining_pct\"?: Long,\n \"tpm_exceeded\"?: Boolean,\n\n // Agent Identity (optional)\n \"agent_id\"?: String,\n \"agent_type\"?: String,\n \"agent_trust_level\"?: String,\n \"agent_framework\"?: String,\n \"agent_publisher\"?: String,\n\n };\n\n /// Context for provision_sandbox action (Forge sandbox-create envelope).\n ///\n /// Every capability field below is OPTIONAL and describes the envelope the\n /// sandbox is being asked to provision with \u2014 Forge synthesizes it from the\n /// create request attenuated by the token's scope ceiling (ADR 0019 D1),\n /// then asks Cedar whether this identity may provision it. Profile templates\n /// `permit` provision_sandbox only when the requested envelope stays within\n /// the profile ceiling, and `forbid` any escalation beyond it.\n ///\n /// FAIL-OPEN WARNING (ADR 0019 D3): because these attributes are optional,\n /// accessing an absent one is a Cedar *evaluation error*, and an errored\n /// `forbid` is silently skipped \u2014 which fails OPEN. Every rule touching a\n /// field here MUST guard it first with `has` (e.g.\n /// `context has mechanism_capabilities && context.mechanism_capabilities.contains(\"sys:ptrace\")`).\n type ProvisionSandboxContext = {\n // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n \"role\"?: String,\n \"privilege_scope\"?: Set<String>,\n \"identity_type\"?: String, // Principal identity class: \"human\" | \"agent\" | \"service\" | \"mcp_server\"\n \"principal\"?: String, // Stable principal identifier (ZeroID / WIMSE URI or user id)\n \"agent_trust_level\"?: String, // \"untrusted\" | \"low\" | \"verified\" | \"trusted\"\n\n // Core metadata (required)\n \"request_id\": String,\n \"timestamp\": Long,\n\n // Requested isolation tier (required) \u2014 the OS-isolation tier the\n // sandbox will run at, as the lowercased Forge IsolationTier name (ADR\n // 0016 D1). Ordinal, weakest\u2192strongest: \"none\" (trusted-local) < \"os\"\n // (bwrap/seatbelt) < \"kernel\" (gVisor) < \"hardware\" (micro-VM + TEE).\n // Templates assert a floor via set membership (e.g. a KERNEL floor =\n // {\"kernel\",\"hardware\"}); Forge owns the ordering.\n \"isolation_tier\": String,\n\n // Requested capability envelope (all optional \u2014 has-guard mandatory).\n \"writable_paths\"?: Set<String>, // Writable path prefixes, e.g. {\"/scratch\"}\n // Master egress switch. Forge MUST set this true whenever ANY egress is\n // requested (i.e. whenever egress_hosts is non-empty), so a \"no network\"\n // profile can gate on this single boolean. egress_hosts then narrows the\n // host allowlist for profiles that DO permit egress.\n \"network_egress\"?: Boolean,\n \"egress_hosts\"?: Set<String>, // Host allowlist for egress, e.g. {\"pypi.org\"}\n \"exec_allowlist\"?: Set<String>, // Executables the sandbox may run, e.g. {\"python\", \"python3\"}\n // Curated mechanism toggles (ADR 0017 D1.3) \u2014 authorization facts only;\n // NEVER raw syscalls. Allowed members: \"sys:ptrace\", \"sys:bpf\",\n // \"sys:raw_socket\", \"dev:gpu\", \"virt:nested\".\n \"mechanism_capabilities\"?: Set<String>,\n };\n}\n";
7
7
  /**
8
8
  * AiGateway Cedar schema
9
9
  *
package/dist/service-schemas.gen.js CHANGED
@@ -113,6 +113,19 @@ namespace AgentOps {
113
113
  context: ConnectServerContext
114
114
  };
115
115
 
116
+ /// Provision a sandbox for the acting identity (Forge OS-layer envelope).
117
+ /// The MANDATORY authorization gate for sandbox creation (ADR 0019 D1):
118
+ /// Forge evaluates this action's AgentOps bundle at create-time; no decision
119
+ /// means no sandbox. Context carries the requested capability envelope
120
+ /// (writable paths, egress, exec allowlist, curated mechanism toggles,
121
+ /// isolation tier). Raw syscalls are NEVER expressed here — the enforcement
122
+ /// generators own the mechanism→syscall translation (ADR 0017 D1).
123
+ action "provision_sandbox" appliesTo {
124
+ principal: [User, Agent],
125
+ resource: [Agent, Session],
126
+ context: ProvisionSandboxContext
127
+ };
128
+
116
129
  // =========================================================================
117
130
  // Context Types (Action-Specific)
118
131
  // =========================================================================
@@ -251,6 +264,21 @@ namespace AgentOps {
251
264
  "session_original_request"?: String,
252
265
  "session_max_sensitivity"?: String,
253
266
 
267
+ // Data-Flow Labels — per-value information-flow facts (ADR 0020, optional).
268
+ // All optional: guard every access with \`has\` — an absent-attribute read is
269
+ // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).
270
+ "flow_confidentiality"?: String, // "public" | "internal" | "confidential" | "restricted" | "unknown"
271
+ "flow_integrity"?: String, // "trusted" | "untrusted" | "mixed" | "unknown"
272
+ "flow_data_types"?: Set<String>, // "pii" | "secrets" | "source_code" | "financial" | "health" | ...
273
+ "flow_compartments"?: Set<String>, // "tenant:*" | "customer:*" | "project:*"
274
+ "flow_resolution_status"?: String, // "known" | "inferred" | "unknown" | "conflicted"
275
+ "flow_origins"?: Set<String>, // "mcp_tool_result" | "model" | "file" | "database" | "user"
276
+ "flow_sink"?: String, // "external_model" | "local_model" | "external_mcp" | "trusted_mcp" | "user_secure_output" | "public_network" | "file"
277
+ "flow_sink_is_external"?: Boolean,
278
+ "flow_sink_effects"?: Set<String>, // "network.send" | "financial.transfer" | "filesystem.write" | ...
279
+ "principal_clearances"?: Set<String>, // ADR 0020 D8 — clearances AuthN mints for the principal
280
+ "principal_compartments"?: Set<String>, // ADR 0020 D8 — compartments the principal is admitted to
281
+
254
282
  // Usage Budget — multi-window token & cost enforcement (optional)
255
283
  "budget_remaining_pct"?: Long,
256
284
  "budget_exceeded"?: Boolean,
@@ -415,6 +443,21 @@ namespace AgentOps {
415
443
  "session_original_request"?: String,
416
444
  "session_max_sensitivity"?: String,
417
445
 
446
+ // Data-Flow Labels — per-value information-flow facts (ADR 0020, optional).
447
+ // All optional: guard every access with \`has\` — an absent-attribute read is
448
+ // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).
449
+ "flow_confidentiality"?: String, // "public" | "internal" | "confidential" | "restricted" | "unknown"
450
+ "flow_integrity"?: String, // "trusted" | "untrusted" | "mixed" | "unknown"
451
+ "flow_data_types"?: Set<String>, // "pii" | "secrets" | "source_code" | "financial" | "health" | ...
452
+ "flow_compartments"?: Set<String>, // "tenant:*" | "customer:*" | "project:*"
453
+ "flow_resolution_status"?: String, // "known" | "inferred" | "unknown" | "conflicted"
454
+ "flow_origins"?: Set<String>, // "mcp_tool_result" | "model" | "file" | "database" | "user"
455
+ "flow_sink"?: String, // "external_model" | "local_model" | "external_mcp" | "trusted_mcp" | "user_secure_output" | "public_network" | "file"
456
+ "flow_sink_is_external"?: Boolean,
457
+ "flow_sink_effects"?: Set<String>, // "network.send" | "financial.transfer" | "filesystem.write" | ...
458
+ "principal_clearances"?: Set<String>, // ADR 0020 D8 — clearances AuthN mints for the principal
459
+ "principal_compartments"?: Set<String>, // ADR 0020 D8 — compartments the principal is admitted to
460
+
418
461
  // Usage Budget (optional)
419
462
  "budget_remaining_pct"?: Long,
420
463
  "budget_exceeded"?: Boolean,
@@ -507,6 +550,21 @@ namespace AgentOps {
507
550
  "session_original_request"?: String,
508
551
  "session_max_sensitivity"?: String,
509
552
 
553
+ // Data-Flow Labels — per-value information-flow facts (ADR 0020, optional).
554
+ // All optional: guard every access with \`has\` — an absent-attribute read is
555
+ // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).
556
+ "flow_confidentiality"?: String, // "public" | "internal" | "confidential" | "restricted" | "unknown"
557
+ "flow_integrity"?: String, // "trusted" | "untrusted" | "mixed" | "unknown"
558
+ "flow_data_types"?: Set<String>, // "pii" | "secrets" | "source_code" | "financial" | "health" | ...
559
+ "flow_compartments"?: Set<String>, // "tenant:*" | "customer:*" | "project:*"
560
+ "flow_resolution_status"?: String, // "known" | "inferred" | "unknown" | "conflicted"
561
+ "flow_origins"?: Set<String>, // "mcp_tool_result" | "model" | "file" | "database" | "user"
562
+ "flow_sink"?: String, // "external_model" | "local_model" | "external_mcp" | "trusted_mcp" | "user_secure_output" | "public_network" | "file"
563
+ "flow_sink_is_external"?: Boolean,
564
+ "flow_sink_effects"?: Set<String>, // "network.send" | "financial.transfer" | "filesystem.write" | ...
565
+ "principal_clearances"?: Set<String>, // ADR 0020 D8 — clearances AuthN mints for the principal
566
+ "principal_compartments"?: Set<String>, // ADR 0020 D8 — compartments the principal is admitted to
567
+
510
568
  // Usage Budget (optional)
511
569
  "budget_remaining_pct"?: Long,
512
570
  "budget_exceeded"?: Boolean,
@@ -595,6 +653,21 @@ namespace AgentOps {
595
653
  "session_original_request"?: String,
596
654
  "session_max_sensitivity"?: String,
597
655
 
656
+ // Data-Flow Labels — per-value information-flow facts (ADR 0020, optional).
657
+ // All optional: guard every access with \`has\` — an absent-attribute read is
658
+ // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).
659
+ "flow_confidentiality"?: String, // "public" | "internal" | "confidential" | "restricted" | "unknown"
660
+ "flow_integrity"?: String, // "trusted" | "untrusted" | "mixed" | "unknown"
661
+ "flow_data_types"?: Set<String>, // "pii" | "secrets" | "source_code" | "financial" | "health" | ...
662
+ "flow_compartments"?: Set<String>, // "tenant:*" | "customer:*" | "project:*"
663
+ "flow_resolution_status"?: String, // "known" | "inferred" | "unknown" | "conflicted"
664
+ "flow_origins"?: Set<String>, // "mcp_tool_result" | "model" | "file" | "database" | "user"
665
+ "flow_sink"?: String, // "external_model" | "local_model" | "external_mcp" | "trusted_mcp" | "user_secure_output" | "public_network" | "file"
666
+ "flow_sink_is_external"?: Boolean,
667
+ "flow_sink_effects"?: Set<String>, // "network.send" | "financial.transfer" | "filesystem.write" | ...
668
+ "principal_clearances"?: Set<String>, // ADR 0020 D8 — clearances AuthN mints for the principal
669
+ "principal_compartments"?: Set<String>, // ADR 0020 D8 — compartments the principal is admitted to
670
+
598
671
  // Usage Budget (optional)
599
672
  "budget_remaining_pct"?: Long,
600
673
  "budget_exceeded"?: Boolean,
@@ -683,6 +756,21 @@ namespace AgentOps {
683
756
  "session_original_request"?: String,
684
757
  "session_max_sensitivity"?: String,
685
758
 
759
+ // Data-Flow Labels — per-value information-flow facts (ADR 0020, optional).
760
+ // All optional: guard every access with \`has\` — an absent-attribute read is
761
+ // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).
762
+ "flow_confidentiality"?: String, // "public" | "internal" | "confidential" | "restricted" | "unknown"
763
+ "flow_integrity"?: String, // "trusted" | "untrusted" | "mixed" | "unknown"
764
+ "flow_data_types"?: Set<String>, // "pii" | "secrets" | "source_code" | "financial" | "health" | ...
765
+ "flow_compartments"?: Set<String>, // "tenant:*" | "customer:*" | "project:*"
766
+ "flow_resolution_status"?: String, // "known" | "inferred" | "unknown" | "conflicted"
767
+ "flow_origins"?: Set<String>, // "mcp_tool_result" | "model" | "file" | "database" | "user"
768
+ "flow_sink"?: String, // "external_model" | "local_model" | "external_mcp" | "trusted_mcp" | "user_secure_output" | "public_network" | "file"
769
+ "flow_sink_is_external"?: Boolean,
770
+ "flow_sink_effects"?: Set<String>, // "network.send" | "financial.transfer" | "filesystem.write" | ...
771
+ "principal_clearances"?: Set<String>, // ADR 0020 D8 — clearances AuthN mints for the principal
772
+ "principal_compartments"?: Set<String>, // ADR 0020 D8 — compartments the principal is admitted to
773
+
686
774
  // Usage Budget (optional)
687
775
  "budget_remaining_pct"?: Long,
688
776
  "budget_exceeded"?: Boolean,
@@ -711,6 +799,55 @@ namespace AgentOps {
711
799
  "agent_publisher"?: String,
712
800
 
713
801
  };
802
+
803
+ /// Context for provision_sandbox action (Forge sandbox-create envelope).
804
+ ///
805
+ /// Every capability field below is OPTIONAL and describes the envelope the
806
+ /// sandbox is being asked to provision with — Forge synthesizes it from the
807
+ /// create request attenuated by the token's scope ceiling (ADR 0019 D1),
808
+ /// then asks Cedar whether this identity may provision it. Profile templates
809
+ /// \`permit\` provision_sandbox only when the requested envelope stays within
810
+ /// the profile ceiling, and \`forbid\` any escalation beyond it.
811
+ ///
812
+ /// FAIL-OPEN WARNING (ADR 0019 D3): because these attributes are optional,
813
+ /// accessing an absent one is a Cedar *evaluation error*, and an errored
814
+ /// \`forbid\` is silently skipped — which fails OPEN. Every rule touching a
815
+ /// field here MUST guard it first with \`has\` (e.g.
816
+ /// \`context has mechanism_capabilities && context.mechanism_capabilities.contains("sys:ptrace")\`).
817
+ type ProvisionSandboxContext = {
818
+ // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
819
+ "role"?: String,
820
+ "privilege_scope"?: Set<String>,
821
+ "identity_type"?: String, // Principal identity class: "human" | "agent" | "service" | "mcp_server"
822
+ "principal"?: String, // Stable principal identifier (ZeroID / WIMSE URI or user id)
823
+ "agent_trust_level"?: String, // "untrusted" | "low" | "verified" | "trusted"
824
+
825
+ // Core metadata (required)
826
+ "request_id": String,
827
+ "timestamp": Long,
828
+
829
+ // Requested isolation tier (required) — the OS-isolation tier the
830
+ // sandbox will run at, as the lowercased Forge IsolationTier name (ADR
831
+ // 0016 D1). Ordinal, weakest→strongest: "none" (trusted-local) < "os"
832
+ // (bwrap/seatbelt) < "kernel" (gVisor) < "hardware" (micro-VM + TEE).
833
+ // Templates assert a floor via set membership (e.g. a KERNEL floor =
834
+ // {"kernel","hardware"}); Forge owns the ordering.
835
+ "isolation_tier": String,
836
+
837
+ // Requested capability envelope (all optional — has-guard mandatory).
838
+ "writable_paths"?: Set<String>, // Writable path prefixes, e.g. {"/scratch"}
839
+ // Master egress switch. Forge MUST set this true whenever ANY egress is
840
+ // requested (i.e. whenever egress_hosts is non-empty), so a "no network"
841
+ // profile can gate on this single boolean. egress_hosts then narrows the
842
+ // host allowlist for profiles that DO permit egress.
843
+ "network_egress"?: Boolean,
844
+ "egress_hosts"?: Set<String>, // Host allowlist for egress, e.g. {"pypi.org"}
845
+ "exec_allowlist"?: Set<String>, // Executables the sandbox may run, e.g. {"python", "python3"}
846
+ // Curated mechanism toggles (ADR 0017 D1.3) — authorization facts only;
847
+ // NEVER raw syscalls. Allowed members: "sys:ptrace", "sys:bpf",
848
+ // "sys:raw_socket", "dev:gpu", "virt:nested".
849
+ "mechanism_capabilities"?: Set<String>,
850
+ };
714
851
  }
715
852
  `;
716
853
  /**
@@ -2993,7 +3130,18 @@ export const AGENT_OPS_CONTEXT = {
2993
3130
  { "key": "agent_type", "type": "string", "required": false, "description": "Type of the authenticated agent: \'orchestrator\', \'autonomous\', \'tool_agent\', or \'human_proxy\'. Empty string for human users." },
2994
3131
  { "key": "agent_trust_level", "type": "string", "required": false, "description": "Trust level of the authenticated agent: \'first_party\', \'verified_third_party\', or \'unverified\'." },
2995
3132
  { "key": "agent_framework", "type": "string", "required": false, "description": "Framework or SDK the agent is built with (e.g., \'claude-code\', \'langchain\', \'crewai\', \'autogen\')." },
2996
- { "key": "agent_publisher", "type": "string", "required": false, "description": "Organization that published the agent (e.g., \'anthropic\', \'internal\', \'acme-corp\')." }
3133
+ { "key": "agent_publisher", "type": "string", "required": false, "description": "Organization that published the agent (e.g., \'anthropic\', \'internal\', \'acme-corp\')." },
3134
+ { "key": "flow_confidentiality", "type": "string", "required": false, "description": "Confidentiality tier of the data this action carries or targets (ADR 0020): \'public\', \'internal\', \'confidential\', \'restricted\', or \'unknown\'. Shares the ladder with session_max_sensitivity but is a per-value fact, not a session scalar. \'unknown\' MUST NOT be treated as \'public\' — guard with has and let policy DENY/STEP_UP/DEFER per flow_resolution_status." },
3135
+ { "key": "flow_integrity", "type": "string", "required": false, "description": "Integrity/influence tier of the data this action carries (ADR 0020): \'trusted\', \'untrusted\', \'mixed\', or \'unknown\'. Orthogonal to confidentiality: untrusted content may inform a pure analysis but MUST NOT authorize a side-effecting sink. Least-trusted contributor wins on join." },
3136
+ { "key": "flow_data_types", "type": "array", "required": false, "description": "Sensitive data categories present in the value (ADR 0020), e.g. \'pii\', \'secrets\', \'source_code\', \'financial\', \'health\'. Union of all contributing inputs. Set<String>." },
3137
+ { "key": "flow_compartments", "type": "array", "required": false, "description": "Compartments the value belongs to (ADR 0020), e.g. \'tenant:acme\', \'customer:123\', \'project:x\'. Union of all contributing inputs — cross-compartment composition is expressible by cardinality. Set<String>." },
3138
+ { "key": "flow_resolution_status", "type": "string", "required": false, "description": "How the flow label was resolved (ADR 0020): \'known\', \'inferred\', \'unknown\', or \'conflicted\'. Policy authors choose the posture for \'unknown\' per sink (DENY external, STEP_UP, DEFER while a classifier runs, or allow-and-record). Never silently resolves to public." },
3139
+ { "key": "flow_origins", "type": "array", "required": false, "description": "Origin kinds that produced or influenced the value (ADR 0020): \'mcp_tool_result\', \'model\', \'file\', \'database\', \'user\'. Provenance fact for lineage-aware policy. Set<String>." },
3140
+ { "key": "flow_sink", "type": "string", "required": false, "description": "Logical destination this action releases the value to (ADR 0020), e.g. \'external_model\', \'local_model\', \'external_mcp\', \'trusted_mcp\', \'user_secure_output\', \'public_network\', \'file\'. The \'where\' half of a flow decision — pair with flow_confidentiality/flow_integrity." },
3141
+ { "key": "flow_sink_is_external", "type": "boolean", "required": false, "description": "Whether the destination is outside the tenant trust boundary (ADR 0020). Lets a single policy express \'confidential data MUST NOT leave to any external sink\' without enumerating sink ids." },
3142
+ { "key": "flow_sink_effects", "type": "array", "required": false, "description": "Side effects the destination can exercise (ADR 0020), e.g. \'network.send\', \'financial.transfer\', \'filesystem.write\'. Enables \'untrusted content MUST NOT reach a financial.transfer sink\'. Set<String>." },
3143
+ { "key": "principal_clearances", "type": "array", "required": false, "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. \'restricted\', \'pii\'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>." },
3144
+ { "key": "principal_compartments", "type": "array", "required": false, "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. \'tenant:acme\', \'customer:123\'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>." }
2997
3145
  ]
2998
3146
  },
2999
3147
  {
@@ -3100,7 +3248,18 @@ export const AGENT_OPS_CONTEXT = {
3100
3248
  { "key": "agent_type", "type": "string", "required": false, "description": "Type of the authenticated agent: \'orchestrator\', \'autonomous\', \'tool_agent\', or \'human_proxy\'. Empty string for human users." },
3101
3249
  { "key": "agent_trust_level", "type": "string", "required": false, "description": "Trust level of the authenticated agent: \'first_party\', \'verified_third_party\', or \'unverified\'." },
3102
3250
  { "key": "agent_framework", "type": "string", "required": false, "description": "Framework or SDK the agent is built with (e.g., \'claude-code\', \'langchain\', \'crewai\', \'autogen\')." },
3103
- { "key": "agent_publisher", "type": "string", "required": false, "description": "Organization that published the agent (e.g., \'anthropic\', \'internal\', \'acme-corp\')." }
3251
+ { "key": "agent_publisher", "type": "string", "required": false, "description": "Organization that published the agent (e.g., \'anthropic\', \'internal\', \'acme-corp\')." },
3252
+ { "key": "flow_confidentiality", "type": "string", "required": false, "description": "Confidentiality tier of the data this action carries or targets (ADR 0020): \'public\', \'internal\', \'confidential\', \'restricted\', or \'unknown\'. Shares the ladder with session_max_sensitivity but is a per-value fact, not a session scalar. \'unknown\' MUST NOT be treated as \'public\' — guard with has and let policy DENY/STEP_UP/DEFER per flow_resolution_status." },
3253
+ { "key": "flow_integrity", "type": "string", "required": false, "description": "Integrity/influence tier of the data this action carries (ADR 0020): \'trusted\', \'untrusted\', \'mixed\', or \'unknown\'. Orthogonal to confidentiality: untrusted content may inform a pure analysis but MUST NOT authorize a side-effecting sink. Least-trusted contributor wins on join." },
3254
+ { "key": "flow_data_types", "type": "array", "required": false, "description": "Sensitive data categories present in the value (ADR 0020), e.g. \'pii\', \'secrets\', \'source_code\', \'financial\', \'health\'. Union of all contributing inputs. Set<String>." },
3255
+ { "key": "flow_compartments", "type": "array", "required": false, "description": "Compartments the value belongs to (ADR 0020), e.g. \'tenant:acme\', \'customer:123\', \'project:x\'. Union of all contributing inputs — cross-compartment composition is expressible by cardinality. Set<String>." },
3256
+ { "key": "flow_resolution_status", "type": "string", "required": false, "description": "How the flow label was resolved (ADR 0020): \'known\', \'inferred\', \'unknown\', or \'conflicted\'. Policy authors choose the posture for \'unknown\' per sink (DENY external, STEP_UP, DEFER while a classifier runs, or allow-and-record). Never silently resolves to public." },
3257
+ { "key": "flow_origins", "type": "array", "required": false, "description": "Origin kinds that produced or influenced the value (ADR 0020): \'mcp_tool_result\', \'model\', \'file\', \'database\', \'user\'. Provenance fact for lineage-aware policy. Set<String>." },
3258
+ { "key": "flow_sink", "type": "string", "required": false, "description": "Logical destination this action releases the value to (ADR 0020), e.g. \'external_model\', \'local_model\', \'external_mcp\', \'trusted_mcp\', \'user_secure_output\', \'public_network\', \'file\'. The \'where\' half of a flow decision — pair with flow_confidentiality/flow_integrity." },
3259
+ { "key": "flow_sink_is_external", "type": "boolean", "required": false, "description": "Whether the destination is outside the tenant trust boundary (ADR 0020). Lets a single policy express \'confidential data MUST NOT leave to any external sink\' without enumerating sink ids." },
3260
+ { "key": "flow_sink_effects", "type": "array", "required": false, "description": "Side effects the destination can exercise (ADR 0020), e.g. \'network.send\', \'financial.transfer\', \'filesystem.write\'. Enables \'untrusted content MUST NOT reach a financial.transfer sink\'. Set<String>." },
3261
+ { "key": "principal_clearances", "type": "array", "required": false, "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. \'restricted\', \'pii\'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>." },
3262
+ { "key": "principal_compartments", "type": "array", "required": false, "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. \'tenant:acme\', \'customer:123\'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>." }
3104
3263
  ]
3105
3264
  },
3106
3265
  {
@@ -3155,7 +3314,18 @@ export const AGENT_OPS_CONTEXT = {
3155
3314
  { "key": "agent_type", "type": "string", "required": false, "description": "Type of the authenticated agent: \'orchestrator\', \'autonomous\', \'tool_agent\', or \'human_proxy\'. Empty string for human users." },
3156
3315
  { "key": "agent_trust_level", "type": "string", "required": false, "description": "Trust level of the authenticated agent: \'first_party\', \'verified_third_party\', or \'unverified\'." },
3157
3316
  { "key": "agent_framework", "type": "string", "required": false, "description": "Framework or SDK the agent is built with (e.g., \'claude-code\', \'langchain\', \'crewai\', \'autogen\')." },
3158
- { "key": "agent_publisher", "type": "string", "required": false, "description": "Organization that published the agent (e.g., \'anthropic\', \'internal\', \'acme-corp\')." }
3317
+ { "key": "agent_publisher", "type": "string", "required": false, "description": "Organization that published the agent (e.g., \'anthropic\', \'internal\', \'acme-corp\')." },
3318
+ { "key": "flow_confidentiality", "type": "string", "required": false, "description": "Confidentiality tier of the data this action carries or targets (ADR 0020): \'public\', \'internal\', \'confidential\', \'restricted\', or \'unknown\'. Shares the ladder with session_max_sensitivity but is a per-value fact, not a session scalar. \'unknown\' MUST NOT be treated as \'public\' — guard with has and let policy DENY/STEP_UP/DEFER per flow_resolution_status." },
3319
+ { "key": "flow_integrity", "type": "string", "required": false, "description": "Integrity/influence tier of the data this action carries (ADR 0020): \'trusted\', \'untrusted\', \'mixed\', or \'unknown\'. Orthogonal to confidentiality: untrusted content may inform a pure analysis but MUST NOT authorize a side-effecting sink. Least-trusted contributor wins on join." },
3320
+ { "key": "flow_data_types", "type": "array", "required": false, "description": "Sensitive data categories present in the value (ADR 0020), e.g. \'pii\', \'secrets\', \'source_code\', \'financial\', \'health\'. Union of all contributing inputs. Set<String>." },
3321
+ { "key": "flow_compartments", "type": "array", "required": false, "description": "Compartments the value belongs to (ADR 0020), e.g. \'tenant:acme\', \'customer:123\', \'project:x\'. Union of all contributing inputs — cross-compartment composition is expressible by cardinality. Set<String>." },
3322
+ { "key": "flow_resolution_status", "type": "string", "required": false, "description": "How the flow label was resolved (ADR 0020): \'known\', \'inferred\', \'unknown\', or \'conflicted\'. Policy authors choose the posture for \'unknown\' per sink (DENY external, STEP_UP, DEFER while a classifier runs, or allow-and-record). Never silently resolves to public." },
3323
+ { "key": "flow_origins", "type": "array", "required": false, "description": "Origin kinds that produced or influenced the value (ADR 0020): \'mcp_tool_result\', \'model\', \'file\', \'database\', \'user\'. Provenance fact for lineage-aware policy. Set<String>." },
3324
+ { "key": "flow_sink", "type": "string", "required": false, "description": "Logical destination this action releases the value to (ADR 0020), e.g. \'external_model\', \'local_model\', \'external_mcp\', \'trusted_mcp\', \'user_secure_output\', \'public_network\', \'file\'. The \'where\' half of a flow decision — pair with flow_confidentiality/flow_integrity." },
3325
+ { "key": "flow_sink_is_external", "type": "boolean", "required": false, "description": "Whether the destination is outside the tenant trust boundary (ADR 0020). Lets a single policy express \'confidential data MUST NOT leave to any external sink\' without enumerating sink ids." },
3326
+ { "key": "flow_sink_effects", "type": "array", "required": false, "description": "Side effects the destination can exercise (ADR 0020), e.g. \'network.send\', \'financial.transfer\', \'filesystem.write\'. Enables \'untrusted content MUST NOT reach a financial.transfer sink\'. Set<String>." },
3327
+ { "key": "principal_clearances", "type": "array", "required": false, "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. \'restricted\', \'pii\'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>." },
3328
+ { "key": "principal_compartments", "type": "array", "required": false, "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. \'tenant:acme\', \'customer:123\'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>." }
3159
3329
  ]
3160
3330
  },
3161
3331
  {
@@ -3212,7 +3382,18 @@ export const AGENT_OPS_CONTEXT = {
3212
3382
  { "key": "agent_type", "type": "string", "required": false, "description": "Type of the authenticated agent: \'orchestrator\', \'autonomous\', \'tool_agent\', or \'human_proxy\'. Empty string for human users." },
3213
3383
  { "key": "agent_trust_level", "type": "string", "required": false, "description": "Trust level of the authenticated agent: \'first_party\', \'verified_third_party\', or \'unverified\'." },
3214
3384
  { "key": "agent_framework", "type": "string", "required": false, "description": "Framework or SDK the agent is built with (e.g., \'claude-code\', \'langchain\', \'crewai\', \'autogen\')." },
3215
- { "key": "agent_publisher", "type": "string", "required": false, "description": "Organization that published the agent (e.g., \'anthropic\', \'internal\', \'acme-corp\')." }
3385
+ { "key": "agent_publisher", "type": "string", "required": false, "description": "Organization that published the agent (e.g., \'anthropic\', \'internal\', \'acme-corp\')." },
3386
+ { "key": "flow_confidentiality", "type": "string", "required": false, "description": "Confidentiality tier of the data this action carries or targets (ADR 0020): \'public\', \'internal\', \'confidential\', \'restricted\', or \'unknown\'. Shares the ladder with session_max_sensitivity but is a per-value fact, not a session scalar. \'unknown\' MUST NOT be treated as \'public\' — guard with has and let policy DENY/STEP_UP/DEFER per flow_resolution_status." },
3387
+ { "key": "flow_integrity", "type": "string", "required": false, "description": "Integrity/influence tier of the data this action carries (ADR 0020): \'trusted\', \'untrusted\', \'mixed\', or \'unknown\'. Orthogonal to confidentiality: untrusted content may inform a pure analysis but MUST NOT authorize a side-effecting sink. Least-trusted contributor wins on join." },
3388
+ { "key": "flow_data_types", "type": "array", "required": false, "description": "Sensitive data categories present in the value (ADR 0020), e.g. \'pii\', \'secrets\', \'source_code\', \'financial\', \'health\'. Union of all contributing inputs. Set<String>." },
3389
+ { "key": "flow_compartments", "type": "array", "required": false, "description": "Compartments the value belongs to (ADR 0020), e.g. \'tenant:acme\', \'customer:123\', \'project:x\'. Union of all contributing inputs — cross-compartment composition is expressible by cardinality. Set<String>." },
3390
+ { "key": "flow_resolution_status", "type": "string", "required": false, "description": "How the flow label was resolved (ADR 0020): \'known\', \'inferred\', \'unknown\', or \'conflicted\'. Policy authors choose the posture for \'unknown\' per sink (DENY external, STEP_UP, DEFER while a classifier runs, or allow-and-record). Never silently resolves to public." },
3391
+ { "key": "flow_origins", "type": "array", "required": false, "description": "Origin kinds that produced or influenced the value (ADR 0020): \'mcp_tool_result\', \'model\', \'file\', \'database\', \'user\'. Provenance fact for lineage-aware policy. Set<String>." },
3392
+ { "key": "flow_sink", "type": "string", "required": false, "description": "Logical destination this action releases the value to (ADR 0020), e.g. \'external_model\', \'local_model\', \'external_mcp\', \'trusted_mcp\', \'user_secure_output\', \'public_network\', \'file\'. The \'where\' half of a flow decision — pair with flow_confidentiality/flow_integrity." },
3393
+ { "key": "flow_sink_is_external", "type": "boolean", "required": false, "description": "Whether the destination is outside the tenant trust boundary (ADR 0020). Lets a single policy express \'confidential data MUST NOT leave to any external sink\' without enumerating sink ids." },
3394
+ { "key": "flow_sink_effects", "type": "array", "required": false, "description": "Side effects the destination can exercise (ADR 0020), e.g. \'network.send\', \'financial.transfer\', \'filesystem.write\'. Enables \'untrusted content MUST NOT reach a financial.transfer sink\'. Set<String>." },
3395
+ { "key": "principal_clearances", "type": "array", "required": false, "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. \'restricted\', \'pii\'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>." },
3396
+ { "key": "principal_compartments", "type": "array", "required": false, "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. \'tenant:acme\', \'customer:123\'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>." }
3216
3397
  ]
3217
3398
  },
3218
3399
  {
@@ -3269,7 +3450,37 @@ export const AGENT_OPS_CONTEXT = {
3269
3450
  { "key": "agent_type", "type": "string", "required": false, "description": "Type of the authenticated agent: \'orchestrator\', \'autonomous\', \'tool_agent\', or \'human_proxy\'. Empty string for human users." },
3270
3451
  { "key": "agent_trust_level", "type": "string", "required": false, "description": "Trust level of the authenticated agent: \'first_party\', \'verified_third_party\', or \'unverified\'." },
3271
3452
  { "key": "agent_framework", "type": "string", "required": false, "description": "Framework or SDK the agent is built with (e.g., \'claude-code\', \'langchain\', \'crewai\', \'autogen\')." },
3272
- { "key": "agent_publisher", "type": "string", "required": false, "description": "Organization that published the agent (e.g., \'anthropic\', \'internal\', \'acme-corp\')." }
3453
+ { "key": "agent_publisher", "type": "string", "required": false, "description": "Organization that published the agent (e.g., \'anthropic\', \'internal\', \'acme-corp\')." },
3454
+ { "key": "flow_confidentiality", "type": "string", "required": false, "description": "Confidentiality tier of the data this action carries or targets (ADR 0020): \'public\', \'internal\', \'confidential\', \'restricted\', or \'unknown\'. Shares the ladder with session_max_sensitivity but is a per-value fact, not a session scalar. \'unknown\' MUST NOT be treated as \'public\' — guard with has and let policy DENY/STEP_UP/DEFER per flow_resolution_status." },
3455
+ { "key": "flow_integrity", "type": "string", "required": false, "description": "Integrity/influence tier of the data this action carries (ADR 0020): \'trusted\', \'untrusted\', \'mixed\', or \'unknown\'. Orthogonal to confidentiality: untrusted content may inform a pure analysis but MUST NOT authorize a side-effecting sink. Least-trusted contributor wins on join." },
3456
+ { "key": "flow_data_types", "type": "array", "required": false, "description": "Sensitive data categories present in the value (ADR 0020), e.g. \'pii\', \'secrets\', \'source_code\', \'financial\', \'health\'. Union of all contributing inputs. Set<String>." },
3457
+ { "key": "flow_compartments", "type": "array", "required": false, "description": "Compartments the value belongs to (ADR 0020), e.g. \'tenant:acme\', \'customer:123\', \'project:x\'. Union of all contributing inputs — cross-compartment composition is expressible by cardinality. Set<String>." },
3458
+ { "key": "flow_resolution_status", "type": "string", "required": false, "description": "How the flow label was resolved (ADR 0020): \'known\', \'inferred\', \'unknown\', or \'conflicted\'. Policy authors choose the posture for \'unknown\' per sink (DENY external, STEP_UP, DEFER while a classifier runs, or allow-and-record). Never silently resolves to public." },
3459
+ { "key": "flow_origins", "type": "array", "required": false, "description": "Origin kinds that produced or influenced the value (ADR 0020): \'mcp_tool_result\', \'model\', \'file\', \'database\', \'user\'. Provenance fact for lineage-aware policy. Set<String>." },
3460
+ { "key": "flow_sink", "type": "string", "required": false, "description": "Logical destination this action releases the value to (ADR 0020), e.g. \'external_model\', \'local_model\', \'external_mcp\', \'trusted_mcp\', \'user_secure_output\', \'public_network\', \'file\'. The \'where\' half of a flow decision — pair with flow_confidentiality/flow_integrity." },
3461
+ { "key": "flow_sink_is_external", "type": "boolean", "required": false, "description": "Whether the destination is outside the tenant trust boundary (ADR 0020). Lets a single policy express \'confidential data MUST NOT leave to any external sink\' without enumerating sink ids." },
3462
+ { "key": "flow_sink_effects", "type": "array", "required": false, "description": "Side effects the destination can exercise (ADR 0020), e.g. \'network.send\', \'financial.transfer\', \'filesystem.write\'. Enables \'untrusted content MUST NOT reach a financial.transfer sink\'. Set<String>." },
3463
+ { "key": "principal_clearances", "type": "array", "required": false, "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. \'restricted\', \'pii\'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>." },
3464
+ { "key": "principal_compartments", "type": "array", "required": false, "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. \'tenant:acme\', \'customer:123\'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>." }
3465
+ ]
3466
+ },
3467
+ {
3468
+ "name": "provision_sandbox",
3469
+ "description": "Provision a sandbox for the acting identity (Forge OS-layer envelope). Mandatory authorization gate for sandbox creation (ADR 0019). Every capability attribute is optional and describes the requested envelope; rules MUST guard each with `has` before access (an absent-attribute access errors, silently voiding a forbid — fail-open).",
3470
+ "context_attributes": [
3471
+ { "key": "role", "type": "string", "required": false, "description": "Caller\'s RBAC role projected from the principal\'s token" },
3472
+ { "key": "privilege_scope", "type": "array", "required": false, "description": "Privilege-scope strings granted to the caller" },
3473
+ { "key": "identity_type", "type": "string", "required": false, "description": "Principal identity class: \'human\', \'agent\', \'service\', or \'mcp_server\'" },
3474
+ { "key": "principal", "type": "string", "required": false, "description": "Stable principal identifier (ZeroID / WIMSE URI or user id)" },
3475
+ { "key": "agent_trust_level", "type": "string", "required": false, "description": "Agent trust tier: \'untrusted\' | \'low\' | \'verified\' | \'trusted\'" },
3476
+ { "key": "request_id", "type": "string", "required": true, "description": "Unique identifier for this request" },
3477
+ { "key": "timestamp", "type": "number", "required": true, "description": "Unix timestamp in milliseconds" },
3478
+ { "key": "isolation_tier", "type": "string", "required": true, "description": "Requested OS-isolation tier as the lowercased Forge IsolationTier name (ADR 0016 D1). Ordinal, weakest→strongest: \'none\' < \'os\' < \'kernel\' (gVisor) < \'hardware\' (micro-VM + TEE). Templates assert a floor via set membership; Forge owns the ordering." },
3479
+ { "key": "writable_paths", "type": "array", "required": false, "description": "Writable path prefixes the sandbox is requesting, e.g. [\'/scratch\']" },
3480
+ { "key": "network_egress", "type": "boolean", "required": false, "description": "Whether any outbound network egress is requested" },
3481
+ { "key": "egress_hosts", "type": "array", "required": false, "description": "Host allowlist for egress, e.g. [\'pypi.org\', \'files.pythonhosted.org\']" },
3482
+ { "key": "exec_allowlist", "type": "array", "required": false, "description": "Executables the sandbox may run, e.g. [\'python\', \'python3\']" },
3483
+ { "key": "mechanism_capabilities", "type": "array", "required": false, "description": "Curated mechanism toggles (ADR 0017 D1.3) — authorization facts only, never raw syscalls. Allowed members: \'sys:ptrace\', \'sys:bpf\', \'sys:raw_socket\', \'dev:gpu\', \'virt:nested\'." }
3273
3484
  ]
3274
3485
  }
3275
3486
  ]
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@highflame/policy",
3
- "version": "2.2.27",
3
+ "version": "2.2.28",
4
4
  "engines": {
5
5
  "node": ">=18"
6
6
  },