@highflame/policy 2.2.28 → 2.2.29

package/_schemas/agent_ops/context.json

@@ -199,6 +199,14 @@
         "required": false,
         "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. 'tenant:acme', 'customer:123'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>."
       }
+    ],
+    "surface_keys": [
+      {
+        "key": "surface",
+        "type": "string",
+        "required": true,
+        "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: 'guardrails', 'overwatch', 'ai_gateway' ('sentry' joins at D17 phase 2). The 'Applies to' narrowing target: test with an ordinary condition (context.surface == 'ai_gateway'); no 'has' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later."
+      }
     ]
   },
   "actions": [
@@ -772,7 +780,8 @@
         },
         { "$ref": "session_keys" },
         { "$ref": "agent_identity_keys" },
-        { "$ref": "flow_label_keys" }
+        { "$ref": "flow_label_keys" },
+        { "$ref": "surface_keys" }
       ]
     },
     {
@@ -1286,7 +1295,8 @@
         },
         { "$ref": "session_keys" },
         { "$ref": "agent_identity_keys" },
-        { "$ref": "flow_label_keys" }
+        { "$ref": "flow_label_keys" },
+        { "$ref": "surface_keys" }
       ]
     },
     {
@@ -1472,7 +1482,8 @@
         },
         { "$ref": "session_keys" },
         { "$ref": "agent_identity_keys" },
-        { "$ref": "flow_label_keys" }
+        { "$ref": "flow_label_keys" },
+        { "$ref": "surface_keys" }
       ]
     },
     {
@@ -1671,7 +1682,8 @@
         },
         { "$ref": "session_keys" },
         { "$ref": "agent_identity_keys" },
-        { "$ref": "flow_label_keys" }
+        { "$ref": "flow_label_keys" },
+        { "$ref": "surface_keys" }
       ]
     },
     {
@@ -1872,7 +1884,8 @@
         },
         { "$ref": "session_keys" },
         { "$ref": "agent_identity_keys" },
-        { "$ref": "flow_label_keys" }
+        { "$ref": "flow_label_keys" },
+        { "$ref": "surface_keys" }
       ]
     },
     {

package/_schemas/agent_ops/schema.cedarschema

@@ -246,6 +246,15 @@ namespace AgentOps {
         "session_original_request"?: String,
         "session_max_sensitivity"?: String,
 
+        // Origin Surface — REQUIRED (ADR 0012 D14.2). Projected by Shield from the
+        // ingress product; never user-supplied. The "Applies to" narrowing target:
+        // policies test it with an ordinary condition (context.surface == "ai_gateway")
+        // — no `has` guard needed precisely because it is required. Values are the
+        // product identifiers: "guardrails" | "overwatch" | "ai_gateway" ("sentry"
+        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies
+        // to every surface, including ones added later (inclusive default).
+        "surface": String,
+
         // Data-Flow Labels — per-value information-flow facts (ADR 0020, optional).
         // All optional: guard every access with `has` — an absent-attribute read is
         // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).
@@ -425,6 +434,15 @@ namespace AgentOps {
         "session_original_request"?: String,
         "session_max_sensitivity"?: String,
 
+        // Origin Surface — REQUIRED (ADR 0012 D14.2). Projected by Shield from the
+        // ingress product; never user-supplied. The "Applies to" narrowing target:
+        // policies test it with an ordinary condition (context.surface == "ai_gateway")
+        // — no `has` guard needed precisely because it is required. Values are the
+        // product identifiers: "guardrails" | "overwatch" | "ai_gateway" ("sentry"
+        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies
+        // to every surface, including ones added later (inclusive default).
+        "surface": String,
+
         // Data-Flow Labels — per-value information-flow facts (ADR 0020, optional).
         // All optional: guard every access with `has` — an absent-attribute read is
         // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).
@@ -532,6 +550,15 @@ namespace AgentOps {
         "session_original_request"?: String,
         "session_max_sensitivity"?: String,
 
+        // Origin Surface — REQUIRED (ADR 0012 D14.2). Projected by Shield from the
+        // ingress product; never user-supplied. The "Applies to" narrowing target:
+        // policies test it with an ordinary condition (context.surface == "ai_gateway")
+        // — no `has` guard needed precisely because it is required. Values are the
+        // product identifiers: "guardrails" | "overwatch" | "ai_gateway" ("sentry"
+        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies
+        // to every surface, including ones added later (inclusive default).
+        "surface": String,
+
         // Data-Flow Labels — per-value information-flow facts (ADR 0020, optional).
         // All optional: guard every access with `has` — an absent-attribute read is
         // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).
@@ -635,6 +662,15 @@ namespace AgentOps {
         "session_original_request"?: String,
         "session_max_sensitivity"?: String,
 
+        // Origin Surface — REQUIRED (ADR 0012 D14.2). Projected by Shield from the
+        // ingress product; never user-supplied. The "Applies to" narrowing target:
+        // policies test it with an ordinary condition (context.surface == "ai_gateway")
+        // — no `has` guard needed precisely because it is required. Values are the
+        // product identifiers: "guardrails" | "overwatch" | "ai_gateway" ("sentry"
+        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies
+        // to every surface, including ones added later (inclusive default).
+        "surface": String,
+
         // Data-Flow Labels — per-value information-flow facts (ADR 0020, optional).
         // All optional: guard every access with `has` — an absent-attribute read is
         // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).
@@ -738,6 +774,15 @@ namespace AgentOps {
         "session_original_request"?: String,
         "session_max_sensitivity"?: String,
 
+        // Origin Surface — REQUIRED (ADR 0012 D14.2). Projected by Shield from the
+        // ingress product; never user-supplied. The "Applies to" narrowing target:
+        // policies test it with an ordinary condition (context.surface == "ai_gateway")
+        // — no `has` guard needed precisely because it is required. Values are the
+        // product identifiers: "guardrails" | "overwatch" | "ai_gateway" ("sentry"
+        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies
+        // to every surface, including ones added later (inclusive default).
+        "surface": String,
+
         // Data-Flow Labels — per-value information-flow facts (ADR 0020, optional).
         // All optional: guard every access with `has` — an absent-attribute read is
         // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).

package/dist/agent_ops-context.gen.d.ts

@@ -137,6 +137,7 @@ export declare const AgentOpsContextKey: {
     readonly SqlInjectionDetected: "sql_injection_detected";
     readonly SqlInjectionScore: "sql_injection_score";
     readonly SqlInjectionType: "sql_injection_type";
+    readonly Surface: "surface";
     readonly SuspiciousPattern: "suspicious_pattern";
     readonly ThreatCategories: "threat_categories";
     readonly ThreatCount: "threat_count";
@@ -164,4 +165,4 @@ export type AgentOpsContextKey = (typeof AgentOpsContextKey)[keyof typeof AgentO
  * The full set of authorable context attribute keys for AgentOps.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const AgentOpsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "cwd", "detected_language", "detected_script", "detected_threats", "detector_count", "direction", "egress_hosts", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "event", "exec_allowlist", "factuality_score", "flow_compartments", "flow_confidentiality", "flow_data_types", "flow_integrity", "flow_origins", "flow_resolution_status", "flow_sink", "flow_sink_effects", "flow_sink_is_external", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "isolation_tier", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "mcp_config_risk", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "mechanism_capabilities", "model_name", "model_provider", "multi_turn_detection", "network_egress", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "principal_clearances", "principal_compartments", "privilege_scope", "profanity_score", "request_id", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "suspicious_pattern", "threat_categories", "threat_count", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "user_email", "violence_score", "weapons_score", "workspace_root", "writable_paths"];
+export declare const AgentOpsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "cwd", "detected_language", "detected_script", "detected_threats", "detector_count", "direction", "egress_hosts", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "event", "exec_allowlist", "factuality_score", "flow_compartments", "flow_confidentiality", "flow_data_types", "flow_integrity", "flow_origins", "flow_resolution_status", "flow_sink", "flow_sink_effects", "flow_sink_is_external", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "isolation_tier", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "mcp_config_risk", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "mechanism_capabilities", "model_name", "model_provider", "multi_turn_detection", "network_egress", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "principal_clearances", "principal_compartments", "privilege_scope", "profanity_score", "request_id", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "surface", "suspicious_pattern", "threat_categories", "threat_count", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "user_email", "violence_score", "weapons_score", "workspace_root", "writable_paths"];

package/dist/agent_ops-context.gen.js

@@ -139,6 +139,7 @@ export const AgentOpsContextKey = {
     SqlInjectionDetected: 'sql_injection_detected',
     SqlInjectionScore: 'sql_injection_score',
     SqlInjectionType: 'sql_injection_type',
+    Surface: 'surface',
     SuspiciousPattern: 'suspicious_pattern',
     ThreatCategories: 'threat_categories',
     ThreatCount: 'threat_count',
@@ -298,6 +299,7 @@ export const AgentOpsContextKeys = [
     AgentOpsContextKey.SqlInjectionDetected,
     AgentOpsContextKey.SqlInjectionScore,
     AgentOpsContextKey.SqlInjectionType,
+    AgentOpsContextKey.Surface,
     AgentOpsContextKey.SuspiciousPattern,
     AgentOpsContextKey.ThreatCategories,
     AgentOpsContextKey.ThreatCount,

package/dist/privilege-catalog.gen.d.ts

@@ -1,4 +1,4 @@
-export declare const PRIVILEGE_CATALOG_VERSION = "2026-06-08";
+export declare const PRIVILEGE_CATALOG_VERSION = "2026-07-14";
 /** Every role in the catalog, in declaration order. */
 export declare const PRIVILEGE_CATALOG_ROLES: readonly string[];
 /** Every product the catalog applies to, in declaration order. */
@@ -15,3 +15,32 @@ export declare function privilegeScopeForProduct(role: string, product: string):
 * role (least privilege). The returned array is a copy.
 */
 export declare function privilegeScopeForRole(role: string): string[];
+/**
+* Coding-agent scope vocabulary, in declaration order (see
+* products/code-agents-identity-design.md section 8). The canonical
+* namespaced scope strings minted into code-agent tokens.
+*/
+export declare const CODING_AGENT_SCOPES: readonly string[];
+/**
+* Reports whether `scope` is a declared vocabulary scope.
+*/
+export declare function isCodingAgentScope(scope: string): boolean;
+/**
+* Human-readable description of a vocabulary scope, or `''` for an
+* unknown scope.
+*/
+export declare function scopeDescription(scope: string): string;
+/**
+* Pre-Cedar hard ceiling for one action: the canonical scope a token's
+* `scopes` claim must carry. A `null` requiredScope means the action
+* deliberately has no ceiling.
+*/
+export interface ActionScopeRequirement {
+    readonly requiredScope: string | null;
+}
+/**
+* The ceiling for (product, action), or `undefined` when the catalog
+* defines none. `undefined` — or a defined entry with a `null`
+* requiredScope — means the action has no scope requirement.
+*/
+export declare function actionScopeRequirement(product: string, action: string): ActionScopeRequirement | undefined;

package/dist/privilege-catalog.gen.js

@@ -7,7 +7,7 @@
 // checked by role-conditioned Cedar policies. Grants are validated
 // against each product's Cedar action schema at codegen time.
 // See adrs/0006-privilege-scope-catalog.md.
-export const PRIVILEGE_CATALOG_VERSION = '2026-06-08';
+export const PRIVILEGE_CATALOG_VERSION = '2026-07-14';
 /** Every role in the catalog, in declaration order. */
 export const PRIVILEGE_CATALOG_ROLES = [
     'auditor',
@@ -95,3 +95,56 @@ export function privilegeScopeForRole(role) {
     const caps = PRIVILEGE_SCOPE_BY_ROLE[role];
     return caps ? [...caps] : [];
 }
+/**
+* Coding-agent scope vocabulary, in declaration order (see
+* products/code-agents-identity-design.md section 8). The canonical
+* namespaced scope strings minted into code-agent tokens.
+*/
+export const CODING_AGENT_SCOPES = [
+    'tools:read',
+    'tools:write',
+    'tools:execute',
+    'tools:network',
+    'tools:agent',
+    'tools:vcs',
+];
+// Scope -> human-readable description. Read via scopeDescription.
+const SCOPE_DESCRIPTIONS = {
+    'tools:read': 'Read-side agent operations: read workspace files and feed prompts/context to the model.',
+    'tools:write': 'Mutate the workspace: create, modify, or delete files.',
+    'tools:execute': 'Execute behavior: MCP tool invocations, native IDE tools, and shell commands.',
+    'tools:network': 'Reach the network beyond the model provider: outbound HTTP and connections to remote MCP servers.',
+    'tools:agent': 'Spawn or delegate to subagents (delegation edges in the mission graph).',
+    'tools:vcs': 'Version-control operations: commit, branch, push, open pull requests.',
+};
+/**
+* Reports whether `scope` is a declared vocabulary scope.
+*/
+export function isCodingAgentScope(scope) {
+    return CODING_AGENT_SCOPES.includes(scope);
+}
+/**
+* Human-readable description of a vocabulary scope, or `''` for an
+* unknown scope.
+*/
+export function scopeDescription(scope) {
+    return SCOPE_DESCRIPTIONS[scope] ?? '';
+}
+// Product -> bare action -> ceiling. Read via actionScopeRequirement.
+const ACTION_SCOPES_BY_PRODUCT = {
+    'overwatch': {
+        'process_prompt': { requiredScope: 'tools:read' },
+        'read_file': { requiredScope: 'tools:read' },
+        'call_tool': { requiredScope: 'tools:execute' },
+        'write_file': { requiredScope: 'tools:write' },
+        'connect_server': { requiredScope: null },
+    },
+};
+/**
+* The ceiling for (product, action), or `undefined` when the catalog
+* defines none. `undefined` — or a defined entry with a `null`
+* requiredScope — means the action has no scope requirement.
+*/
+export function actionScopeRequirement(product, action) {
+    return ACTION_SCOPES_BY_PRODUCT[product]?.[action];
+}

package/dist/service-schemas.gen.d.ts

@@ -3,7 +3,7 @@
  *
  * Full Cedar schema for agent_ops, embedded at codegen time.
  */
-export declare const AGENT_OPS_SCHEMA = "// =============================================================================\n// AgentOps Cedar Schema\n// =============================================================================\n// Unified schema for all agent guardrail policies. Covers every request path\n// where an AI agent touches the Highflame platform:\n//   - LLM prompt/response (Guardrails path)\n//   - IDE tool calls and file access (Overwatch path)\n//   - MCP server connections (AI Gateway path)\n//\n// The context types are a superset of Guardrails, Overwatch, and AI Gateway\n// schemas. All extra fields are optional \u2014 Shield projects only what is present\n// in the request, Cedar ignores absent optional attributes.\n//\n// Service: highflame-shield (agent_ops product)\n// Namespace: AgentOps\n// =============================================================================\n\nnamespace AgentOps {\n    // =========================================================================\n    // Entity Types \u2014 ReBAC Hierarchy\n    // =========================================================================\n    // Entity hierarchy enables Cedar's `in` operator for policy scoping:\n    //   Account (org root)\n    //     \u2514\u2500\u2500 Project in [Account]\n    //           \u251C\u2500\u2500 App in [Project]\n    //           \u2502     \u2514\u2500\u2500 Session in [App, Agent]\n    //           \u2514\u2500\u2500 Agent in [Project]\n    //                 \u2514\u2500\u2500 Session in [App, Agent]\n    //\n    // Policy scoping examples:\n    //   resource in AgentOps::Project::\"<uuid>\"          \u2192 project-wide (all agents)\n    //   resource in AgentOps::Agent::\"<external_id>\"     \u2192 named agent + its sessions\n    //   resource == AgentOps::Agent::\"<external_id>\"     \u2192 named agent only (exact match)\n    //   resource in AgentOps::Account::\"<uuid>\"          \u2192 org-wide\n    // =========================================================================\n\n    /// Account represents an organization (top-level tenant)\n    entity Account;\n\n    /// Project represents a project within an account\n    entity Project in [Account];\n\n    /// User represents a principal (human or service) making requests\n    entity User;\n\n    /// Agent represents an AI agent (Claude, Cursor, Copilot, MCP client, etc.)\n    /// Used as both principal (who is acting) and resource (policy scoping target).\n    /// Agent + sessions: resource in AgentOps::Agent::\"<external_id>\" (hierarchy match)\n    /// Agent only:       resource == AgentOps::Agent::\"<external_id>\" (exact match)\n    entity Agent in [Project];\n\n    /// App represents a protected application (guardrails-enabled LLM app)\n    entity App in [Project];\n\n    /// Session represents an agentic conversation session with state tracking.\n    /// Sessions can belong to either an App or an Agent.\n    entity Session in [App, Agent];\n\n    // =========================================================================\n    // Actions\n    // =========================================================================\n\n    /// Process user prompts and AI responses for security threats and content violations\n    action \"process_prompt\" appliesTo {\n        principal: [User, Agent],\n        resource: [App, Agent, Session],\n        context: ProcessPromptContext\n    };\n\n    /// Execute tool calls (shell, file operations, MCP tools)\n    action \"call_tool\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: CallToolContext\n    };\n\n    /// Read file operations\n    action \"read_file\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: FileReadContext\n    };\n\n    /// Write file operations\n    action \"write_file\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: FileWriteContext\n    };\n\n    /// Connect to an MCP server\n    action \"connect_server\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: ConnectServerContext\n    };\n\n    /// Provision a sandbox for the acting identity (Forge OS-layer envelope).\n    /// The MANDATORY authorization gate for sandbox creation (ADR 0019 D1):\n    /// Forge evaluates this action's AgentOps bundle at create-time; no decision\n    /// means no sandbox. Context carries the requested capability envelope\n    /// (writable paths, egress, exec allowlist, curated mechanism toggles,\n    /// isolation tier). Raw syscalls are NEVER expressed here \u2014 the enforcement\n    /// generators own the mechanism\u2192syscall translation (ADR 0017 D1).\n    action \"provision_sandbox\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: ProvisionSandboxContext\n    };\n\n    // =========================================================================\n    // Context Types (Action-Specific)\n    // =========================================================================\n\n    /// Context for process_prompt action (user prompts & AI responses)\n    type ProcessPromptContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,        // Principal identity class: \"human\" | \"agent\" | \"service\" | \"mcp_server\"\n        \"principal\"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n        \"direction\": String,        // \"input\" | \"output\"\n        \"content_type\": String,     // \"prompt\" | \"response\" | \"tool_call\" | \"file\"\n        \"detector_count\": Long,\n\n        // IDE / workspace context (optional \u2014 present for Overwatch/code-agent traffic)\n        \"source\"?: String,           // Traffic origin: \"ide\" | \"cli\" | \"api\" | \"browser\"\n        \"event\"?: String,            // Event type: \"prompt\" | \"tool_call\" | \"file_read\" | ...\n        \"user_email\"?: String,       // Human operator email (IDE sessions)\n        \"cwd\"?: String,              // Current working directory\n        \"workspace_root\"?: String,   // IDE workspace root path\n\n        // Model context (optional \u2014 present for AI Gateway traffic)\n        \"model_name\"?: String,       // LLM model name: \"claude-3-5-sonnet\", \"gpt-4o\", ...\n        \"model_provider\"?: String,   // Model provider: \"anthropic\" | \"openai\" | \"google\" | ...\n\n        // Security - Injection & Jailbreak (optional)\n        \"injection_score\"?: Long,  // Combined injection confidence: MAX(pulse, deep_context)\n        \"jailbreak_score\"?: Long,  // Combined jailbreak confidence: MAX(pulse, deep_context)\n        \"injection_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"injection_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n        \"jailbreak_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"jailbreak_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n        \"injection_type\"?: String,       // \"prompt\" | \"sql\" | \"command\" | \"none\"\n        \"indirect_injection_score\"?: Long, // Indirect injection via tool outputs (0-100)\n\n        // Privacy - Secrets (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,    // [\"aws_access_key\", \"github_token\", ...]\n\n        // Privacy - PII (optional)\n        \"pii_detected\"?: Boolean,\n        \"pii_count\"?: Long,\n        \"pii_types\"?: Set<String>,       // [\"email\", \"phone\", \"ssn\", \"credit_card\", ...]\n        \"pii_score\"?: Long,         // PII ML classifier confidence (0-100)\n\n        // Aggregated threat summary (optional \u2014 populated by aggregation detectors)\n        \"highest_severity\"?: String,     // \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n        \"threat_count\"?: Long,\n        \"threat_categories\"?: Set<String>,\n        \"detected_threats\"?: Set<String>,\n\n        // Trust & Safety - Toxicity (optional)\n        \"violence_score\"?: Long,         // 0-100\n        \"hate_speech_score\"?: Long,      // 0-100\n        \"sexual_score\"?: Long,           // 0-100\n        \"weapons_score\"?: Long,          // 0-100\n        \"crime_score\"?: Long,            // 0-100\n        \"profanity_score\"?: Long,        // 0-100\n\n        // Semantic - Topic Classification (optional)\n        \"content_topics\"?: Set<String>,      // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n        \"topic_confidence\"?: Long,           // 0-100\n\n        // Security - Invisible Character Detection (optional)\n        \"invisible_chars_detected\"?: Boolean,\n        \"invisible_chars_score\"?: Long,      // 0-100\n\n        // Security - Pattern Detection (optional)\n        \"command_injection_detected\"?: Boolean,\n        \"command_injection_type\"?: String,       // \"reverse_shell\" | \"privilege_escalation\" | ...\n        \"command_injection_score\"?: Long,        // 0-100\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,      // \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n        \"path_traversal_type\"?: String,\n        \"sql_injection_detected\"?: Boolean,\n        \"sql_injection_type\"?: String,           // \"tautology\" | \"union_based\" | \"destructive\" | ...\n        \"sql_injection_score\"?: Long,            // 0-100\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Boolean,\n        \"cross_origin_type\"?: String,            // \"cross_origin_tool\" | \"cross_origin_server\" | \"none\"\n        \"cross_origin_score\"?: Long,             // 0-100\n\n        // Security - Encoded Injection (optional)\n        \"encoded_content_detected\"?: Boolean,\n        \"encoded_types\"?: Set<String>,           // [\"base64\", \"hex\", \"unicode\", \"url\", ...]\n        \"encoded_count\"?: Long,\n        \"encoded_score\"?: Long,                  // 0-100\n\n        // Language & Script Detection (optional)\n        \"detected_language\"?: String,            // ISO language code\n        \"is_english\"?: Boolean,\n        \"language_confidence\"?: Long,            // 0-100\n        \"detected_script\"?: String,              // \"latin\" | \"cyrillic\" | \"arabic\" | \"unknown\" | ...\n        \"is_latin_script\"?: Boolean,\n        \"script_confidence\"?: Long,              // 0-100\n\n        // Content Analysis (optional)\n        \"hallucination_score\"?: Long,\n        \"factuality_score\"?: Long,               // 0-100\n        \"sentiment_score\"?: Long,\n        \"contains_code\"?: Boolean,\n        \"code_languages\"?: Set<String>,\n        \"code_ratio\"?: Long,                     // 0-100\n        \"keyword_matched\"?: Boolean,\n        \"keyword_categories\"?: Set<String>,\n        \"keyword_count\"?: Long,\n        \"contains_non_ascii\"?: Boolean,\n        \"phishing_detected\"?: Boolean,\n        \"content_safety_score\"?: Long,           // 0-100\n        \"content_safety_blocked\"?: Boolean,\n\n        // Agentic - Multi-Turn Context (optional)\n        \"conversation_turn\"?: Long,\n        \"multi_turn_detection\"?: Boolean,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget \u2014 multi-window token & cost enforcement (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,           // \"orchestrator\" | \"autonomous\" | \"tool_agent\" | \"human_proxy\"\n        \"agent_trust_level\"?: String,    // \"first_party\" | \"verified_third_party\" | \"unverified\"\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for call_tool action (agentic tool execution)\n    type CallToolContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // Tool Risk (optional)\n        \"tool_name\"?: String,\n        \"tool_risk_score\"?: Long,        // 0-100\n        \"tool_is_sensitive\"?: Boolean,\n        \"tool_category\"?: String,        // \"safe\" | \"sensitive\" | \"dangerous\"\n        \"tool_is_builtin\"?: Boolean,\n\n        // AARM R3 (CAP-ENF-007) \u2014 Action Parameter Validation\n        \"action_params\"?: {\n            \"amount\"?: Long,\n            \"count\"?: Long,\n            \"command\"?: String,\n            \"path\"?: String,\n            \"url\"?: String,\n            \"recipient\"?: String,\n            \"target\"?: String,\n            \"query\"?: String,\n        },\n        \"param_type_violation\"?: Boolean,\n        \"param_type_violations\"?: Set<String>,\n\n        // MCP context (optional)\n        \"mcp_server\"?: String,\n        \"mcp_tool\"?: String,\n        \"mcp_server_verified\"?: Boolean,\n\n        // Agentic - Behavioral Patterns (optional)\n        \"suspicious_pattern\"?: Boolean,\n        \"pattern_type\"?: String,         // \"data_exfiltration\" | \"secret_exfiltration\" | ...\n        \"sequence_risk\"?: Long,          // 0-100\n\n        // Agentic - Loop Detection (optional)\n        \"loop_detected\"?: Boolean,\n        \"loop_count\"?: Long,\n        \"loop_tool\"?: String,\n\n        // Security checks on tool arguments (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Boolean,\n        \"pii_types\"?: Set<String>,\n        \"pii_count\"?: Long,\n        \"pii_score\"?: Long,\n        \"injection_score\"?: Long,\n        \"injection_pulse_score\"?: Long,\n        \"injection_deep_context_score\"?: Long,\n        \"indirect_injection_score\"?: Long,\n        \"indirect_injection_type\"?: String,      // Type of indirect injection detected\n\n        // Semantic - Topic Classification (optional)\n        \"content_topics\"?: Set<String>,      // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n        \"topic_confidence\"?: Long,           // 0-100\n\n        // Security - Pattern Detection (optional)\n        \"command_injection_detected\"?: Boolean,\n        \"command_injection_type\"?: String,\n        \"command_injection_score\"?: Long,\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n        \"sql_injection_detected\"?: Boolean,\n        \"sql_injection_type\"?: String,\n        \"sql_injection_score\"?: Long,\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Boolean,\n        \"cross_origin_type\"?: String,\n        \"cross_origin_score\"?: Long,\n\n        // Security - Invisible Character Detection (optional)\n        \"invisible_chars_detected\"?: Boolean,\n        \"invisible_chars_score\"?: Long,\n\n        // Security - Encoded Injection (optional)\n        \"encoded_content_detected\"?: Boolean,\n        \"encoded_types\"?: Set<String>,\n        \"encoded_count\"?: Long,\n        \"encoded_score\"?: Long,\n\n        // Agentic - Agent Security (optional)\n        \"tool_poisoning_detected\"?: Boolean,\n        \"tool_poisoning_score\"?: Long,\n        \"tool_poisoning_type\"?: String,\n        \"rug_pull_detected\"?: Boolean,\n        \"rug_pull_score\"?: Long,\n        \"rug_pull_type\"?: String,\n\n        // Agentic - MCP Risk (optional)\n        \"mcp_config_risk\"?: Boolean,\n        \"mcp_risk_type\"?: String,\n        \"mcp_risk_score\"?: Long,\n\n        // Tool Operation Classifier (optional)\n        \"tool_operation_classes\"?: Set<String>,\n\n        // Agentic - Multi-Turn Context (optional)\n        \"conversation_turn\"?: Long,\n        \"multi_turn_detection\"?: Boolean,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n        // File & Path (optional)\n        \"path\"?: String,\n\n    };\n\n    /// Context for read_file action\n    type FileReadContext = {\n        // Identity (optional)\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // File path (optional)\n        \"path\"?: String,\n\n        // Security checks on file content (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Boolean,\n        \"pii_types\"?: Set<String>,\n\n        // Security - Path Traversal (optional)\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Session Detection History (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for write_file action\n    type FileWriteContext = {\n        // Identity (optional)\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // File path (optional)\n        \"path\"?: String,\n\n        // Security - Invisible Character Detection in write content (optional)\n        \"invisible_chars_detected\"?: Boolean,\n        \"invisible_chars_score\"?: Long,\n\n        // Security checks on content being written (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Boolean,\n        \"pii_types\"?: Set<String>,\n\n        // Security - Path Traversal (optional)\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Session Detection History (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for connect_server action (MCP server connections)\n    type ConnectServerContext = {\n        // Identity (optional)\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // MCP context (optional)\n        \"mcp_server\"?: String,\n        \"mcp_server_verified\"?: Boolean,\n\n        // Agentic - Agent Security (optional)\n        \"tool_poisoning_detected\"?: Boolean,\n        \"tool_poisoning_score\"?: Long,\n        \"tool_poisoning_type\"?: String,\n\n        // Agentic - MCP Risk (optional)\n        \"mcp_config_risk\"?: Boolean,\n        \"mcp_risk_type\"?: String,\n        \"mcp_risk_score\"?: Long,\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Boolean,\n        \"cross_origin_type\"?: String,\n        \"cross_origin_score\"?: Long,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Session Detection History (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for provision_sandbox action (Forge sandbox-create envelope).\n    ///\n    /// Every capability field below is OPTIONAL and describes the envelope the\n    /// sandbox is being asked to provision with \u2014 Forge synthesizes it from the\n    /// create request attenuated by the token's scope ceiling (ADR 0019 D1),\n    /// then asks Cedar whether this identity may provision it. Profile templates\n    /// `permit` provision_sandbox only when the requested envelope stays within\n    /// the profile ceiling, and `forbid` any escalation beyond it.\n    ///\n    /// FAIL-OPEN WARNING (ADR 0019 D3): because these attributes are optional,\n    /// accessing an absent one is a Cedar *evaluation error*, and an errored\n    /// `forbid` is silently skipped \u2014 which fails OPEN. Every rule touching a\n    /// field here MUST guard it first with `has` (e.g.\n    /// `context has mechanism_capabilities && context.mechanism_capabilities.contains(\"sys:ptrace\")`).\n    type ProvisionSandboxContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,        // Principal identity class: \"human\" | \"agent\" | \"service\" | \"mcp_server\"\n        \"principal\"?: String,            // Stable principal identifier (ZeroID / WIMSE URI or user id)\n        \"agent_trust_level\"?: String,    // \"untrusted\" | \"low\" | \"verified\" | \"trusted\"\n\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // Requested isolation tier (required) \u2014 the OS-isolation tier the\n        // sandbox will run at, as the lowercased Forge IsolationTier name (ADR\n        // 0016 D1). Ordinal, weakest\u2192strongest: \"none\" (trusted-local) < \"os\"\n        // (bwrap/seatbelt) < \"kernel\" (gVisor) < \"hardware\" (micro-VM + TEE).\n        // Templates assert a floor via set membership (e.g. a KERNEL floor =\n        // {\"kernel\",\"hardware\"}); Forge owns the ordering.\n        \"isolation_tier\": String,\n\n        // Requested capability envelope (all optional \u2014 has-guard mandatory).\n        \"writable_paths\"?: Set<String>,        // Writable path prefixes, e.g. {\"/scratch\"}\n        // Master egress switch. Forge MUST set this true whenever ANY egress is\n        // requested (i.e. whenever egress_hosts is non-empty), so a \"no network\"\n        // profile can gate on this single boolean. egress_hosts then narrows the\n        // host allowlist for profiles that DO permit egress.\n        \"network_egress\"?: Boolean,\n        \"egress_hosts\"?: Set<String>,          // Host allowlist for egress, e.g. {\"pypi.org\"}\n        \"exec_allowlist\"?: Set<String>,        // Executables the sandbox may run, e.g. {\"python\", \"python3\"}\n        // Curated mechanism toggles (ADR 0017 D1.3) \u2014 authorization facts only;\n        // NEVER raw syscalls. Allowed members: \"sys:ptrace\", \"sys:bpf\",\n        // \"sys:raw_socket\", \"dev:gpu\", \"virt:nested\".\n        \"mechanism_capabilities\"?: Set<String>,\n    };\n}\n";
+export declare const AGENT_OPS_SCHEMA = "// =============================================================================\n// AgentOps Cedar Schema\n// =============================================================================\n// Unified schema for all agent guardrail policies. Covers every request path\n// where an AI agent touches the Highflame platform:\n//   - LLM prompt/response (Guardrails path)\n//   - IDE tool calls and file access (Overwatch path)\n//   - MCP server connections (AI Gateway path)\n//\n// The context types are a superset of Guardrails, Overwatch, and AI Gateway\n// schemas. All extra fields are optional \u2014 Shield projects only what is present\n// in the request, Cedar ignores absent optional attributes.\n//\n// Service: highflame-shield (agent_ops product)\n// Namespace: AgentOps\n// =============================================================================\n\nnamespace AgentOps {\n    // =========================================================================\n    // Entity Types \u2014 ReBAC Hierarchy\n    // =========================================================================\n    // Entity hierarchy enables Cedar's `in` operator for policy scoping:\n    //   Account (org root)\n    //     \u2514\u2500\u2500 Project in [Account]\n    //           \u251C\u2500\u2500 App in [Project]\n    //           \u2502     \u2514\u2500\u2500 Session in [App, Agent]\n    //           \u2514\u2500\u2500 Agent in [Project]\n    //                 \u2514\u2500\u2500 Session in [App, Agent]\n    //\n    // Policy scoping examples:\n    //   resource in AgentOps::Project::\"<uuid>\"          \u2192 project-wide (all agents)\n    //   resource in AgentOps::Agent::\"<external_id>\"     \u2192 named agent + its sessions\n    //   resource == AgentOps::Agent::\"<external_id>\"     \u2192 named agent only (exact match)\n    //   resource in AgentOps::Account::\"<uuid>\"          \u2192 org-wide\n    // =========================================================================\n\n    /// Account represents an organization (top-level tenant)\n    entity Account;\n\n    /// Project represents a project within an account\n    entity Project in [Account];\n\n    /// User represents a principal (human or service) making requests\n    entity User;\n\n    /// Agent represents an AI agent (Claude, Cursor, Copilot, MCP client, etc.)\n    /// Used as both principal (who is acting) and resource (policy scoping target).\n    /// Agent + sessions: resource in AgentOps::Agent::\"<external_id>\" (hierarchy match)\n    /// Agent only:       resource == AgentOps::Agent::\"<external_id>\" (exact match)\n    entity Agent in [Project];\n\n    /// App represents a protected application (guardrails-enabled LLM app)\n    entity App in [Project];\n\n    /// Session represents an agentic conversation session with state tracking.\n    /// Sessions can belong to either an App or an Agent.\n    entity Session in [App, Agent];\n\n    // =========================================================================\n    // Actions\n    // =========================================================================\n\n    /// Process user prompts and AI responses for security threats and content violations\n    action \"process_prompt\" appliesTo {\n        principal: [User, Agent],\n        resource: [App, Agent, Session],\n        context: ProcessPromptContext\n    };\n\n    /// Execute tool calls (shell, file operations, MCP tools)\n    action \"call_tool\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: CallToolContext\n    };\n\n    /// Read file operations\n    action \"read_file\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: FileReadContext\n    };\n\n    /// Write file operations\n    action \"write_file\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: FileWriteContext\n    };\n\n    /// Connect to an MCP server\n    action \"connect_server\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: ConnectServerContext\n    };\n\n    /// Provision a sandbox for the acting identity (Forge OS-layer envelope).\n    /// The MANDATORY authorization gate for sandbox creation (ADR 0019 D1):\n    /// Forge evaluates this action's AgentOps bundle at create-time; no decision\n    /// means no sandbox. Context carries the requested capability envelope\n    /// (writable paths, egress, exec allowlist, curated mechanism toggles,\n    /// isolation tier). Raw syscalls are NEVER expressed here \u2014 the enforcement\n    /// generators own the mechanism\u2192syscall translation (ADR 0017 D1).\n    action \"provision_sandbox\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: ProvisionSandboxContext\n    };\n\n    // =========================================================================\n    // Context Types (Action-Specific)\n    // =========================================================================\n\n    /// Context for process_prompt action (user prompts & AI responses)\n    type ProcessPromptContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,        // Principal identity class: \"human\" | \"agent\" | \"service\" | \"mcp_server\"\n        \"principal\"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n        \"direction\": String,        // \"input\" | \"output\"\n        \"content_type\": String,     // \"prompt\" | \"response\" | \"tool_call\" | \"file\"\n        \"detector_count\": Long,\n\n        // IDE / workspace context (optional \u2014 present for Overwatch/code-agent traffic)\n        \"source\"?: String,           // Traffic origin: \"ide\" | \"cli\" | \"api\" | \"browser\"\n        \"event\"?: String,            // Event type: \"prompt\" | \"tool_call\" | \"file_read\" | ...\n        \"user_email\"?: String,       // Human operator email (IDE sessions)\n        \"cwd\"?: String,              // Current working directory\n        \"workspace_root\"?: String,   // IDE workspace root path\n\n        // Model context (optional \u2014 present for AI Gateway traffic)\n        \"model_name\"?: String,       // LLM model name: \"claude-3-5-sonnet\", \"gpt-4o\", ...\n        \"model_provider\"?: String,   // Model provider: \"anthropic\" | \"openai\" | \"google\" | ...\n\n        // Security - Injection & Jailbreak (optional)\n        \"injection_score\"?: Long,  // Combined injection confidence: MAX(pulse, deep_context)\n        \"jailbreak_score\"?: Long,  // Combined jailbreak confidence: MAX(pulse, deep_context)\n        \"injection_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"injection_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n        \"jailbreak_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"jailbreak_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n        \"injection_type\"?: String,       // \"prompt\" | \"sql\" | \"command\" | \"none\"\n        \"indirect_injection_score\"?: Long, // Indirect injection via tool outputs (0-100)\n\n        // Privacy - Secrets (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,    // [\"aws_access_key\", \"github_token\", ...]\n\n        // Privacy - PII (optional)\n        \"pii_detected\"?: Boolean,\n        \"pii_count\"?: Long,\n        \"pii_types\"?: Set<String>,       // [\"email\", \"phone\", \"ssn\", \"credit_card\", ...]\n        \"pii_score\"?: Long,         // PII ML classifier confidence (0-100)\n\n        // Aggregated threat summary (optional \u2014 populated by aggregation detectors)\n        \"highest_severity\"?: String,     // \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n        \"threat_count\"?: Long,\n        \"threat_categories\"?: Set<String>,\n        \"detected_threats\"?: Set<String>,\n\n        // Trust & Safety - Toxicity (optional)\n        \"violence_score\"?: Long,         // 0-100\n        \"hate_speech_score\"?: Long,      // 0-100\n        \"sexual_score\"?: Long,           // 0-100\n        \"weapons_score\"?: Long,          // 0-100\n        \"crime_score\"?: Long,            // 0-100\n        \"profanity_score\"?: Long,        // 0-100\n\n        // Semantic - Topic Classification (optional)\n        \"content_topics\"?: Set<String>,      // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n        \"topic_confidence\"?: Long,           // 0-100\n\n        // Security - Invisible Character Detection (optional)\n        \"invisible_chars_detected\"?: Boolean,\n        \"invisible_chars_score\"?: Long,      // 0-100\n\n        // Security - Pattern Detection (optional)\n        \"command_injection_detected\"?: Boolean,\n        \"command_injection_type\"?: String,       // \"reverse_shell\" | \"privilege_escalation\" | ...\n        \"command_injection_score\"?: Long,        // 0-100\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,      // \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n        \"path_traversal_type\"?: String,\n        \"sql_injection_detected\"?: Boolean,\n        \"sql_injection_type\"?: String,           // \"tautology\" | \"union_based\" | \"destructive\" | ...\n        \"sql_injection_score\"?: Long,            // 0-100\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Boolean,\n        \"cross_origin_type\"?: String,            // \"cross_origin_tool\" | \"cross_origin_server\" | \"none\"\n        \"cross_origin_score\"?: Long,             // 0-100\n\n        // Security - Encoded Injection (optional)\n        \"encoded_content_detected\"?: Boolean,\n        \"encoded_types\"?: Set<String>,           // [\"base64\", \"hex\", \"unicode\", \"url\", ...]\n        \"encoded_count\"?: Long,\n        \"encoded_score\"?: Long,                  // 0-100\n\n        // Language & Script Detection (optional)\n        \"detected_language\"?: String,            // ISO language code\n        \"is_english\"?: Boolean,\n        \"language_confidence\"?: Long,            // 0-100\n        \"detected_script\"?: String,              // \"latin\" | \"cyrillic\" | \"arabic\" | \"unknown\" | ...\n        \"is_latin_script\"?: Boolean,\n        \"script_confidence\"?: Long,              // 0-100\n\n        // Content Analysis (optional)\n        \"hallucination_score\"?: Long,\n        \"factuality_score\"?: Long,               // 0-100\n        \"sentiment_score\"?: Long,\n        \"contains_code\"?: Boolean,\n        \"code_languages\"?: Set<String>,\n        \"code_ratio\"?: Long,                     // 0-100\n        \"keyword_matched\"?: Boolean,\n        \"keyword_categories\"?: Set<String>,\n        \"keyword_count\"?: Long,\n        \"contains_non_ascii\"?: Boolean,\n        \"phishing_detected\"?: Boolean,\n        \"content_safety_score\"?: Long,           // 0-100\n        \"content_safety_blocked\"?: Boolean,\n\n        // Agentic - Multi-Turn Context (optional)\n        \"conversation_turn\"?: Long,\n        \"multi_turn_detection\"?: Boolean,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Origin Surface \u2014 REQUIRED (ADR 0012 D14.2). Projected by Shield from the\n        // ingress product; never user-supplied. The \"Applies to\" narrowing target:\n        // policies test it with an ordinary condition (context.surface == \"ai_gateway\")\n        // \u2014 no `has` guard needed precisely because it is required. Values are the\n        // product identifiers: \"guardrails\" | \"overwatch\" | \"ai_gateway\" (\"sentry\"\n        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies\n        // to every surface, including ones added later (inclusive default).\n        \"surface\": String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget \u2014 multi-window token & cost enforcement (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,           // \"orchestrator\" | \"autonomous\" | \"tool_agent\" | \"human_proxy\"\n        \"agent_trust_level\"?: String,    // \"first_party\" | \"verified_third_party\" | \"unverified\"\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for call_tool action (agentic tool execution)\n    type CallToolContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // Tool Risk (optional)\n        \"tool_name\"?: String,\n        \"tool_risk_score\"?: Long,        // 0-100\n        \"tool_is_sensitive\"?: Boolean,\n        \"tool_category\"?: String,        // \"safe\" | \"sensitive\" | \"dangerous\"\n        \"tool_is_builtin\"?: Boolean,\n\n        // AARM R3 (CAP-ENF-007) \u2014 Action Parameter Validation\n        \"action_params\"?: {\n            \"amount\"?: Long,\n            \"count\"?: Long,\n            \"command\"?: String,\n            \"path\"?: String,\n            \"url\"?: String,\n            \"recipient\"?: String,\n            \"target\"?: String,\n            \"query\"?: String,\n        },\n        \"param_type_violation\"?: Boolean,\n        \"param_type_violations\"?: Set<String>,\n\n        // MCP context (optional)\n        \"mcp_server\"?: String,\n        \"mcp_tool\"?: String,\n        \"mcp_server_verified\"?: Boolean,\n\n        // Agentic - Behavioral Patterns (optional)\n        \"suspicious_pattern\"?: Boolean,\n        \"pattern_type\"?: String,         // \"data_exfiltration\" | \"secret_exfiltration\" | ...\n        \"sequence_risk\"?: Long,          // 0-100\n\n        // Agentic - Loop Detection (optional)\n        \"loop_detected\"?: Boolean,\n        \"loop_count\"?: Long,\n        \"loop_tool\"?: String,\n\n        // Security checks on tool arguments (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Boolean,\n        \"pii_types\"?: Set<String>,\n        \"pii_count\"?: Long,\n        \"pii_score\"?: Long,\n        \"injection_score\"?: Long,\n        \"injection_pulse_score\"?: Long,\n        \"injection_deep_context_score\"?: Long,\n        \"indirect_injection_score\"?: Long,\n        \"indirect_injection_type\"?: String,      // Type of indirect injection detected\n\n        // Semantic - Topic Classification (optional)\n        \"content_topics\"?: Set<String>,      // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n        \"topic_confidence\"?: Long,           // 0-100\n\n        // Security - Pattern Detection (optional)\n        \"command_injection_detected\"?: Boolean,\n        \"command_injection_type\"?: String,\n        \"command_injection_score\"?: Long,\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n        \"sql_injection_detected\"?: Boolean,\n        \"sql_injection_type\"?: String,\n        \"sql_injection_score\"?: Long,\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Boolean,\n        \"cross_origin_type\"?: String,\n        \"cross_origin_score\"?: Long,\n\n        // Security - Invisible Character Detection (optional)\n        \"invisible_chars_detected\"?: Boolean,\n        \"invisible_chars_score\"?: Long,\n\n        // Security - Encoded Injection (optional)\n        \"encoded_content_detected\"?: Boolean,\n        \"encoded_types\"?: Set<String>,\n        \"encoded_count\"?: Long,\n        \"encoded_score\"?: Long,\n\n        // Agentic - Agent Security (optional)\n        \"tool_poisoning_detected\"?: Boolean,\n        \"tool_poisoning_score\"?: Long,\n        \"tool_poisoning_type\"?: String,\n        \"rug_pull_detected\"?: Boolean,\n        \"rug_pull_score\"?: Long,\n        \"rug_pull_type\"?: String,\n\n        // Agentic - MCP Risk (optional)\n        \"mcp_config_risk\"?: Boolean,\n        \"mcp_risk_type\"?: String,\n        \"mcp_risk_score\"?: Long,\n\n        // Tool Operation Classifier (optional)\n        \"tool_operation_classes\"?: Set<String>,\n\n        // Agentic - Multi-Turn Context (optional)\n        \"conversation_turn\"?: Long,\n        \"multi_turn_detection\"?: Boolean,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Origin Surface \u2014 REQUIRED (ADR 0012 D14.2). Projected by Shield from the\n        // ingress product; never user-supplied. The \"Applies to\" narrowing target:\n        // policies test it with an ordinary condition (context.surface == \"ai_gateway\")\n        // \u2014 no `has` guard needed precisely because it is required. Values are the\n        // product identifiers: \"guardrails\" | \"overwatch\" | \"ai_gateway\" (\"sentry\"\n        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies\n        // to every surface, including ones added later (inclusive default).\n        \"surface\": String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n        // File & Path (optional)\n        \"path\"?: String,\n\n    };\n\n    /// Context for read_file action\n    type FileReadContext = {\n        // Identity (optional)\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // File path (optional)\n        \"path\"?: String,\n\n        // Security checks on file content (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Boolean,\n        \"pii_types\"?: Set<String>,\n\n        // Security - Path Traversal (optional)\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Session Detection History (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Origin Surface \u2014 REQUIRED (ADR 0012 D14.2). Projected by Shield from the\n        // ingress product; never user-supplied. The \"Applies to\" narrowing target:\n        // policies test it with an ordinary condition (context.surface == \"ai_gateway\")\n        // \u2014 no `has` guard needed precisely because it is required. Values are the\n        // product identifiers: \"guardrails\" | \"overwatch\" | \"ai_gateway\" (\"sentry\"\n        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies\n        // to every surface, including ones added later (inclusive default).\n        \"surface\": String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for write_file action\n    type FileWriteContext = {\n        // Identity (optional)\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // File path (optional)\n        \"path\"?: String,\n\n        // Security - Invisible Character Detection in write content (optional)\n        \"invisible_chars_detected\"?: Boolean,\n        \"invisible_chars_score\"?: Long,\n\n        // Security checks on content being written (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Boolean,\n        \"pii_types\"?: Set<String>,\n\n        // Security - Path Traversal (optional)\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Session Detection History (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Origin Surface \u2014 REQUIRED (ADR 0012 D14.2). Projected by Shield from the\n        // ingress product; never user-supplied. The \"Applies to\" narrowing target:\n        // policies test it with an ordinary condition (context.surface == \"ai_gateway\")\n        // \u2014 no `has` guard needed precisely because it is required. Values are the\n        // product identifiers: \"guardrails\" | \"overwatch\" | \"ai_gateway\" (\"sentry\"\n        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies\n        // to every surface, including ones added later (inclusive default).\n        \"surface\": String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for connect_server action (MCP server connections)\n    type ConnectServerContext = {\n        // Identity (optional)\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // MCP context (optional)\n        \"mcp_server\"?: String,\n        \"mcp_server_verified\"?: Boolean,\n\n        // Agentic - Agent Security (optional)\n        \"tool_poisoning_detected\"?: Boolean,\n        \"tool_poisoning_score\"?: Long,\n        \"tool_poisoning_type\"?: String,\n\n        // Agentic - MCP Risk (optional)\n        \"mcp_config_risk\"?: Boolean,\n        \"mcp_risk_type\"?: String,\n        \"mcp_risk_score\"?: Long,\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Boolean,\n        \"cross_origin_type\"?: String,\n        \"cross_origin_score\"?: Long,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Session Detection History (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Origin Surface \u2014 REQUIRED (ADR 0012 D14.2). Projected by Shield from the\n        // ingress product; never user-supplied. The \"Applies to\" narrowing target:\n        // policies test it with an ordinary condition (context.surface == \"ai_gateway\")\n        // \u2014 no `has` guard needed precisely because it is required. Values are the\n        // product identifiers: \"guardrails\" | \"overwatch\" | \"ai_gateway\" (\"sentry\"\n        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies\n        // to every surface, including ones added later (inclusive default).\n        \"surface\": String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for provision_sandbox action (Forge sandbox-create envelope).\n    ///\n    /// Every capability field below is OPTIONAL and describes the envelope the\n    /// sandbox is being asked to provision with \u2014 Forge synthesizes it from the\n    /// create request attenuated by the token's scope ceiling (ADR 0019 D1),\n    /// then asks Cedar whether this identity may provision it. Profile templates\n    /// `permit` provision_sandbox only when the requested envelope stays within\n    /// the profile ceiling, and `forbid` any escalation beyond it.\n    ///\n    /// FAIL-OPEN WARNING (ADR 0019 D3): because these attributes are optional,\n    /// accessing an absent one is a Cedar *evaluation error*, and an errored\n    /// `forbid` is silently skipped \u2014 which fails OPEN. Every rule touching a\n    /// field here MUST guard it first with `has` (e.g.\n    /// `context has mechanism_capabilities && context.mechanism_capabilities.contains(\"sys:ptrace\")`).\n    type ProvisionSandboxContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,        // Principal identity class: \"human\" | \"agent\" | \"service\" | \"mcp_server\"\n        \"principal\"?: String,            // Stable principal identifier (ZeroID / WIMSE URI or user id)\n        \"agent_trust_level\"?: String,    // \"untrusted\" | \"low\" | \"verified\" | \"trusted\"\n\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // Requested isolation tier (required) \u2014 the OS-isolation tier the\n        // sandbox will run at, as the lowercased Forge IsolationTier name (ADR\n        // 0016 D1). Ordinal, weakest\u2192strongest: \"none\" (trusted-local) < \"os\"\n        // (bwrap/seatbelt) < \"kernel\" (gVisor) < \"hardware\" (micro-VM + TEE).\n        // Templates assert a floor via set membership (e.g. a KERNEL floor =\n        // {\"kernel\",\"hardware\"}); Forge owns the ordering.\n        \"isolation_tier\": String,\n\n        // Requested capability envelope (all optional \u2014 has-guard mandatory).\n        \"writable_paths\"?: Set<String>,        // Writable path prefixes, e.g. {\"/scratch\"}\n        // Master egress switch. Forge MUST set this true whenever ANY egress is\n        // requested (i.e. whenever egress_hosts is non-empty), so a \"no network\"\n        // profile can gate on this single boolean. egress_hosts then narrows the\n        // host allowlist for profiles that DO permit egress.\n        \"network_egress\"?: Boolean,\n        \"egress_hosts\"?: Set<String>,          // Host allowlist for egress, e.g. {\"pypi.org\"}\n        \"exec_allowlist\"?: Set<String>,        // Executables the sandbox may run, e.g. {\"python\", \"python3\"}\n        // Curated mechanism toggles (ADR 0017 D1.3) \u2014 authorization facts only;\n        // NEVER raw syscalls. Allowed members: \"sys:ptrace\", \"sys:bpf\",\n        // \"sys:raw_socket\", \"dev:gpu\", \"virt:nested\".\n        \"mechanism_capabilities\"?: Set<String>,\n    };\n}\n";
 /**
  * AiGateway Cedar schema
  *

package/dist/service-schemas.gen.js

@@ -264,6 +264,15 @@ namespace AgentOps {
         "session_original_request"?: String,
         "session_max_sensitivity"?: String,
 
+        // Origin Surface — REQUIRED (ADR 0012 D14.2). Projected by Shield from the
+        // ingress product; never user-supplied. The "Applies to" narrowing target:
+        // policies test it with an ordinary condition (context.surface == "ai_gateway")
+        // — no \`has\` guard needed precisely because it is required. Values are the
+        // product identifiers: "guardrails" | "overwatch" | "ai_gateway" ("sentry"
+        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies
+        // to every surface, including ones added later (inclusive default).
+        "surface": String,
+
         // Data-Flow Labels — per-value information-flow facts (ADR 0020, optional).
         // All optional: guard every access with \`has\` — an absent-attribute read is
         // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).
@@ -443,6 +452,15 @@ namespace AgentOps {
         "session_original_request"?: String,
         "session_max_sensitivity"?: String,
 
+        // Origin Surface — REQUIRED (ADR 0012 D14.2). Projected by Shield from the
+        // ingress product; never user-supplied. The "Applies to" narrowing target:
+        // policies test it with an ordinary condition (context.surface == "ai_gateway")
+        // — no \`has\` guard needed precisely because it is required. Values are the
+        // product identifiers: "guardrails" | "overwatch" | "ai_gateway" ("sentry"
+        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies
+        // to every surface, including ones added later (inclusive default).
+        "surface": String,
+
         // Data-Flow Labels — per-value information-flow facts (ADR 0020, optional).
         // All optional: guard every access with \`has\` — an absent-attribute read is
         // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).
@@ -550,6 +568,15 @@ namespace AgentOps {
         "session_original_request"?: String,
         "session_max_sensitivity"?: String,
 
+        // Origin Surface — REQUIRED (ADR 0012 D14.2). Projected by Shield from the
+        // ingress product; never user-supplied. The "Applies to" narrowing target:
+        // policies test it with an ordinary condition (context.surface == "ai_gateway")
+        // — no \`has\` guard needed precisely because it is required. Values are the
+        // product identifiers: "guardrails" | "overwatch" | "ai_gateway" ("sentry"
+        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies
+        // to every surface, including ones added later (inclusive default).
+        "surface": String,
+
         // Data-Flow Labels — per-value information-flow facts (ADR 0020, optional).
         // All optional: guard every access with \`has\` — an absent-attribute read is
         // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).
@@ -653,6 +680,15 @@ namespace AgentOps {
         "session_original_request"?: String,
         "session_max_sensitivity"?: String,
 
+        // Origin Surface — REQUIRED (ADR 0012 D14.2). Projected by Shield from the
+        // ingress product; never user-supplied. The "Applies to" narrowing target:
+        // policies test it with an ordinary condition (context.surface == "ai_gateway")
+        // — no \`has\` guard needed precisely because it is required. Values are the
+        // product identifiers: "guardrails" | "overwatch" | "ai_gateway" ("sentry"
+        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies
+        // to every surface, including ones added later (inclusive default).
+        "surface": String,
+
         // Data-Flow Labels — per-value information-flow facts (ADR 0020, optional).
         // All optional: guard every access with \`has\` — an absent-attribute read is
         // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).
@@ -756,6 +792,15 @@ namespace AgentOps {
         "session_original_request"?: String,
         "session_max_sensitivity"?: String,
 
+        // Origin Surface — REQUIRED (ADR 0012 D14.2). Projected by Shield from the
+        // ingress product; never user-supplied. The "Applies to" narrowing target:
+        // policies test it with an ordinary condition (context.surface == "ai_gateway")
+        // — no \`has\` guard needed precisely because it is required. Values are the
+        // product identifiers: "guardrails" | "overwatch" | "ai_gateway" ("sentry"
+        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies
+        // to every surface, including ones added later (inclusive default).
+        "surface": String,
+
         // Data-Flow Labels — per-value information-flow facts (ADR 0020, optional).
         // All optional: guard every access with \`has\` — an absent-attribute read is
         // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).
@@ -3141,7 +3186,8 @@ export const AGENT_OPS_CONTEXT = {
                 { "key": "flow_sink_is_external", "type": "boolean", "required": false, "description": "Whether the destination is outside the tenant trust boundary (ADR 0020). Lets a single policy express \'confidential data MUST NOT leave to any external sink\' without enumerating sink ids." },
                 { "key": "flow_sink_effects", "type": "array", "required": false, "description": "Side effects the destination can exercise (ADR 0020), e.g. \'network.send\', \'financial.transfer\', \'filesystem.write\'. Enables \'untrusted content MUST NOT reach a financial.transfer sink\'. Set<String>." },
                 { "key": "principal_clearances", "type": "array", "required": false, "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. \'restricted\', \'pii\'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>." },
-                { "key": "principal_compartments", "type": "array", "required": false, "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. \'tenant:acme\', \'customer:123\'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>." }
+                { "key": "principal_compartments", "type": "array", "required": false, "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. \'tenant:acme\', \'customer:123\'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>." },
+                { "key": "surface", "type": "string", "required": true, "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: \'guardrails\', \'overwatch\', \'ai_gateway\' (\'sentry\' joins at D17 phase 2). The \'Applies to\' narrowing target: test with an ordinary condition (context.surface == \'ai_gateway\'); no \'has\' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later." }
             ]
         },
         {
@@ -3259,7 +3305,8 @@ export const AGENT_OPS_CONTEXT = {
                 { "key": "flow_sink_is_external", "type": "boolean", "required": false, "description": "Whether the destination is outside the tenant trust boundary (ADR 0020). Lets a single policy express \'confidential data MUST NOT leave to any external sink\' without enumerating sink ids." },
                 { "key": "flow_sink_effects", "type": "array", "required": false, "description": "Side effects the destination can exercise (ADR 0020), e.g. \'network.send\', \'financial.transfer\', \'filesystem.write\'. Enables \'untrusted content MUST NOT reach a financial.transfer sink\'. Set<String>." },
                 { "key": "principal_clearances", "type": "array", "required": false, "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. \'restricted\', \'pii\'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>." },
-                { "key": "principal_compartments", "type": "array", "required": false, "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. \'tenant:acme\', \'customer:123\'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>." }
+                { "key": "principal_compartments", "type": "array", "required": false, "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. \'tenant:acme\', \'customer:123\'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>." },
+                { "key": "surface", "type": "string", "required": true, "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: \'guardrails\', \'overwatch\', \'ai_gateway\' (\'sentry\' joins at D17 phase 2). The \'Applies to\' narrowing target: test with an ordinary condition (context.surface == \'ai_gateway\'); no \'has\' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later." }
             ]
         },
         {
@@ -3325,7 +3372,8 @@ export const AGENT_OPS_CONTEXT = {
                 { "key": "flow_sink_is_external", "type": "boolean", "required": false, "description": "Whether the destination is outside the tenant trust boundary (ADR 0020). Lets a single policy express \'confidential data MUST NOT leave to any external sink\' without enumerating sink ids." },
                 { "key": "flow_sink_effects", "type": "array", "required": false, "description": "Side effects the destination can exercise (ADR 0020), e.g. \'network.send\', \'financial.transfer\', \'filesystem.write\'. Enables \'untrusted content MUST NOT reach a financial.transfer sink\'. Set<String>." },
                 { "key": "principal_clearances", "type": "array", "required": false, "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. \'restricted\', \'pii\'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>." },
-                { "key": "principal_compartments", "type": "array", "required": false, "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. \'tenant:acme\', \'customer:123\'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>." }
+                { "key": "principal_compartments", "type": "array", "required": false, "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. \'tenant:acme\', \'customer:123\'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>." },
+                { "key": "surface", "type": "string", "required": true, "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: \'guardrails\', \'overwatch\', \'ai_gateway\' (\'sentry\' joins at D17 phase 2). The \'Applies to\' narrowing target: test with an ordinary condition (context.surface == \'ai_gateway\'); no \'has\' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later." }
             ]
         },
         {
@@ -3393,7 +3441,8 @@ export const AGENT_OPS_CONTEXT = {
                 { "key": "flow_sink_is_external", "type": "boolean", "required": false, "description": "Whether the destination is outside the tenant trust boundary (ADR 0020). Lets a single policy express \'confidential data MUST NOT leave to any external sink\' without enumerating sink ids." },
                 { "key": "flow_sink_effects", "type": "array", "required": false, "description": "Side effects the destination can exercise (ADR 0020), e.g. \'network.send\', \'financial.transfer\', \'filesystem.write\'. Enables \'untrusted content MUST NOT reach a financial.transfer sink\'. Set<String>." },
                 { "key": "principal_clearances", "type": "array", "required": false, "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. \'restricted\', \'pii\'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>." },
-                { "key": "principal_compartments", "type": "array", "required": false, "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. \'tenant:acme\', \'customer:123\'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>." }
+                { "key": "principal_compartments", "type": "array", "required": false, "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. \'tenant:acme\', \'customer:123\'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>." },
+                { "key": "surface", "type": "string", "required": true, "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: \'guardrails\', \'overwatch\', \'ai_gateway\' (\'sentry\' joins at D17 phase 2). The \'Applies to\' narrowing target: test with an ordinary condition (context.surface == \'ai_gateway\'); no \'has\' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later." }
             ]
         },
         {
@@ -3461,7 +3510,8 @@ export const AGENT_OPS_CONTEXT = {
                 { "key": "flow_sink_is_external", "type": "boolean", "required": false, "description": "Whether the destination is outside the tenant trust boundary (ADR 0020). Lets a single policy express \'confidential data MUST NOT leave to any external sink\' without enumerating sink ids." },
                 { "key": "flow_sink_effects", "type": "array", "required": false, "description": "Side effects the destination can exercise (ADR 0020), e.g. \'network.send\', \'financial.transfer\', \'filesystem.write\'. Enables \'untrusted content MUST NOT reach a financial.transfer sink\'. Set<String>." },
                 { "key": "principal_clearances", "type": "array", "required": false, "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. \'restricted\', \'pii\'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>." },
-                { "key": "principal_compartments", "type": "array", "required": false, "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. \'tenant:acme\', \'customer:123\'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>." }
+                { "key": "principal_compartments", "type": "array", "required": false, "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. \'tenant:acme\', \'customer:123\'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>." },
+                { "key": "surface", "type": "string", "required": true, "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: \'guardrails\', \'overwatch\', \'ai_gateway\' (\'sentry\' joins at D17 phase 2). The \'Applies to\' narrowing target: test with an ordinary condition (context.surface == \'ai_gateway\'); no \'has\' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later." }
             ]
         },
         {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.2.28",
+  "version": "2.2.29",
   "engines": {
     "node": ">=18"
   },