@highflame/policy 2.2.29 → 2.2.32

package/_schemas/agent_ops/context.json

@@ -2,213 +2,6 @@
   "service": "agent_ops",
   "version": "1.0.0",
   "description": "AgentOps unified agent guardrail policy enforcement — superset of Guardrails, Overwatch, and AI Gateway",
-  "shared": {
-    "session_keys": [
-      {
-        "key": "session_pii_detected",
-        "type": "boolean",
-        "required": false,
-        "description": "Whether PII was detected in any previous turn of the session"
-      },
-      {
-        "key": "session_pii_types",
-        "type": "array",
-        "required": false,
-        "description": "PII types detected across the session (accumulated)"
-      },
-      {
-        "key": "session_secrets_detected",
-        "type": "boolean",
-        "required": false,
-        "description": "Whether secrets were detected in any previous turn of the session"
-      },
-      {
-        "key": "session_secret_types",
-        "type": "array",
-        "required": false,
-        "description": "Secret types detected across the session (accumulated)"
-      },
-      {
-        "key": "session_injection_detected",
-        "type": "boolean",
-        "required": false,
-        "description": "Whether prompt injection was detected in any previous turn of the session"
-      },
-      {
-        "key": "session_command_injection",
-        "type": "boolean",
-        "required": false,
-        "description": "Whether command injection was detected in any previous turn of the session"
-      },
-      {
-        "key": "session_threat_turns",
-        "type": "number",
-        "required": false,
-        "description": "Number of turns in the session where threats were detected"
-      },
-      {
-        "key": "session_max_injection_score",
-        "type": "number",
-        "required": false,
-        "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions",
-        "range": "0-100"
-      },
-      {
-        "key": "session_max_jailbreak_score",
-        "type": "number",
-        "required": false,
-        "description": "Highest jailbreak detection score seen in any turn of the session (0-100)",
-        "range": "0-100"
-      },
-      {
-        "key": "session_max_command_injection_score",
-        "type": "number",
-        "required": false,
-        "description": "Highest command injection score seen in any turn of the session (0-100)",
-        "range": "0-100"
-      },
-      {
-        "key": "session_max_pii_score",
-        "type": "number",
-        "required": false,
-        "description": "Highest PII risk score seen in any turn of the session (0-100)",
-        "range": "0-100"
-      },
-      {
-        "key": "session_max_secret_score",
-        "type": "number",
-        "required": false,
-        "description": "Highest secret detection score seen in any turn of the session (0-100)",
-        "range": "0-100"
-      },
-      {
-        "key": "session_cumulative_risk_score",
-        "type": "number",
-        "required": false,
-        "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
-      },
-      {
-        "key": "session_max_sensitivity",
-        "type": "string",
-        "required": false,
-        "description": "Highest data-sensitivity tier observed across the session (e.g. 'public', 'internal', 'confidential', 'restricted')"
-      },
-      {
-        "key": "session_original_request",
-        "type": "string",
-        "required": false,
-        "description": "The session's first user request, retained for drift / goal-hijack policies that compare later turns against the original intent"
-      }
-    ],
-    "agent_identity_keys": [
-      {
-        "key": "agent_id",
-        "type": "string",
-        "required": false,
-        "description": "Unique identifier of the authenticated AI agent making this request. Empty string for human user requests."
-      },
-      {
-        "key": "agent_type",
-        "type": "string",
-        "required": false,
-        "description": "Type of the authenticated agent: 'orchestrator', 'autonomous', 'tool_agent', or 'human_proxy'. Empty string for human users."
-      },
-      {
-        "key": "agent_trust_level",
-        "type": "string",
-        "required": false,
-        "description": "Trust level of the authenticated agent: 'first_party', 'verified_third_party', or 'unverified'."
-      },
-      {
-        "key": "agent_framework",
-        "type": "string",
-        "required": false,
-        "description": "Framework or SDK the agent is built with (e.g., 'claude-code', 'langchain', 'crewai', 'autogen')."
-      },
-      {
-        "key": "agent_publisher",
-        "type": "string",
-        "required": false,
-        "description": "Organization that published the agent (e.g., 'anthropic', 'internal', 'acme-corp')."
-      }
-    ],
-    "flow_label_keys": [
-      {
-        "key": "flow_confidentiality",
-        "type": "string",
-        "required": false,
-        "description": "Confidentiality tier of the data this action carries or targets (ADR 0020): 'public', 'internal', 'confidential', 'restricted', or 'unknown'. Shares the ladder with session_max_sensitivity but is a per-value fact, not a session scalar. 'unknown' MUST NOT be treated as 'public' — guard with has and let policy DENY/STEP_UP/DEFER per flow_resolution_status."
-      },
-      {
-        "key": "flow_integrity",
-        "type": "string",
-        "required": false,
-        "description": "Integrity/influence tier of the data this action carries (ADR 0020): 'trusted', 'untrusted', 'mixed', or 'unknown'. Orthogonal to confidentiality: untrusted content may inform a pure analysis but MUST NOT authorize a side-effecting sink. Least-trusted contributor wins on join."
-      },
-      {
-        "key": "flow_data_types",
-        "type": "array",
-        "required": false,
-        "description": "Sensitive data categories present in the value (ADR 0020), e.g. 'pii', 'secrets', 'source_code', 'financial', 'health'. Union of all contributing inputs. Set<String>."
-      },
-      {
-        "key": "flow_compartments",
-        "type": "array",
-        "required": false,
-        "description": "Compartments the value belongs to (ADR 0020), e.g. 'tenant:acme', 'customer:123', 'project:x'. Union of all contributing inputs — cross-compartment composition is expressible by cardinality. Set<String>."
-      },
-      {
-        "key": "flow_resolution_status",
-        "type": "string",
-        "required": false,
-        "description": "How the flow label was resolved (ADR 0020): 'known', 'inferred', 'unknown', or 'conflicted'. Policy authors choose the posture for 'unknown' per sink (DENY external, STEP_UP, DEFER while a classifier runs, or allow-and-record). Never silently resolves to public."
-      },
-      {
-        "key": "flow_origins",
-        "type": "array",
-        "required": false,
-        "description": "Origin kinds that produced or influenced the value (ADR 0020): 'mcp_tool_result', 'model', 'file', 'database', 'user'. Provenance fact for lineage-aware policy. Set<String>."
-      },
-      {
-        "key": "flow_sink",
-        "type": "string",
-        "required": false,
-        "description": "Logical destination this action releases the value to (ADR 0020), e.g. 'external_model', 'local_model', 'external_mcp', 'trusted_mcp', 'user_secure_output', 'public_network', 'file'. The 'where' half of a flow decision — pair with flow_confidentiality/flow_integrity."
-      },
-      {
-        "key": "flow_sink_is_external",
-        "type": "boolean",
-        "required": false,
-        "description": "Whether the destination is outside the tenant trust boundary (ADR 0020). Lets a single policy express 'confidential data MUST NOT leave to any external sink' without enumerating sink ids."
-      },
-      {
-        "key": "flow_sink_effects",
-        "type": "array",
-        "required": false,
-        "description": "Side effects the destination can exercise (ADR 0020), e.g. 'network.send', 'financial.transfer', 'filesystem.write'. Enables 'untrusted content MUST NOT reach a financial.transfer sink'. Set<String>."
-      },
-      {
-        "key": "principal_clearances",
-        "type": "array",
-        "required": false,
-        "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. 'restricted', 'pii'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>."
-      },
-      {
-        "key": "principal_compartments",
-        "type": "array",
-        "required": false,
-        "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. 'tenant:acme', 'customer:123'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>."
-      }
-    ],
-    "surface_keys": [
-      {
-        "key": "surface",
-        "type": "string",
-        "required": true,
-        "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: 'guardrails', 'overwatch', 'ai_gateway' ('sentry' joins at D17 phase 2). The 'Applies to' narrowing target: test with an ordinary condition (context.surface == 'ai_gateway'); no 'has' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later."
-      }
-    ]
-  },
   "actions": [
     {
       "name": "process_prompt",
@@ -778,10 +571,228 @@
           "required": false,
           "description": "Whether the TPM limit has been exceeded"
         },
-        { "$ref": "session_keys" },
-        { "$ref": "agent_identity_keys" },
-        { "$ref": "flow_label_keys" },
-        { "$ref": "surface_keys" }
+        {
+          "key": "session_pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether PII was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_pii_types",
+          "type": "array",
+          "required": false,
+          "description": "PII types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether secrets were detected in any previous turn of the session"
+        },
+        {
+          "key": "session_secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Secret types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether prompt injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_command_injection",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether command injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_threat_turns",
+          "type": "number",
+          "required": false,
+          "description": "Number of turns in the session where threats were detected"
+        },
+        {
+          "key": "session_max_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_command_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest command injection score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_pii_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest PII risk score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_secret_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest secret detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_cumulative_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
+        },
+        {
+          "key": "session_max_sensitivity",
+          "type": "string",
+          "required": false,
+          "description": "Highest data-sensitivity tier observed across the session (e.g. 'public', 'internal', 'confidential', 'restricted')"
+        },
+        {
+          "key": "session_original_request",
+          "type": "string",
+          "required": false,
+          "description": "The session's first user request, retained for drift / goal-hijack policies that compare later turns against the original intent"
+        },
+        {
+          "key": "agent_id",
+          "type": "string",
+          "required": false,
+          "description": "Unique identifier of the authenticated AI agent making this request. Empty string for human user requests."
+        },
+        {
+          "key": "agent_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of the authenticated agent: 'orchestrator', 'autonomous', 'tool_agent', or 'human_proxy'. Empty string for human users."
+        },
+        {
+          "key": "agent_trust_level",
+          "type": "string",
+          "required": false,
+          "description": "Trust level of the authenticated agent: 'first_party', 'verified_third_party', or 'unverified'."
+        },
+        {
+          "key": "agent_framework",
+          "type": "string",
+          "required": false,
+          "description": "Framework or SDK the agent is built with (e.g., 'claude-code', 'langchain', 'crewai', 'autogen')."
+        },
+        {
+          "key": "agent_publisher",
+          "type": "string",
+          "required": false,
+          "description": "Organization that published the agent (e.g., 'anthropic', 'internal', 'acme-corp')."
+        },
+        {
+          "key": "flow_confidentiality",
+          "type": "string",
+          "required": false,
+          "description": "Confidentiality tier of the data this action carries or targets (ADR 0020): 'public', 'internal', 'confidential', 'restricted', or 'unknown'. Shares the ladder with session_max_sensitivity but is a per-value fact, not a session scalar. 'unknown' MUST NOT be treated as 'public' — guard with has and let policy DENY/STEP_UP/DEFER per flow_resolution_status."
+        },
+        {
+          "key": "flow_integrity",
+          "type": "string",
+          "required": false,
+          "description": "Integrity/influence tier of the data this action carries (ADR 0020): 'trusted', 'untrusted', 'mixed', or 'unknown'. Orthogonal to confidentiality: untrusted content may inform a pure analysis but MUST NOT authorize a side-effecting sink. Least-trusted contributor wins on join."
+        },
+        {
+          "key": "flow_data_types",
+          "type": "array",
+          "required": false,
+          "description": "Sensitive data categories present in the value (ADR 0020), e.g. 'pii', 'secrets', 'source_code', 'financial', 'health'. Union of all contributing inputs. Set<String>."
+        },
+        {
+          "key": "flow_compartments",
+          "type": "array",
+          "required": false,
+          "description": "Compartments the value belongs to (ADR 0020), e.g. 'tenant:acme', 'customer:123', 'project:x'. Union of all contributing inputs — cross-compartment composition is expressible by cardinality. Set<String>."
+        },
+        {
+          "key": "flow_resolution_status",
+          "type": "string",
+          "required": false,
+          "description": "How the flow label was resolved (ADR 0020): 'known', 'inferred', 'unknown', or 'conflicted'. Policy authors choose the posture for 'unknown' per sink (DENY external, STEP_UP, DEFER while a classifier runs, or allow-and-record). Never silently resolves to public."
+        },
+        {
+          "key": "flow_origins",
+          "type": "array",
+          "required": false,
+          "description": "Origin kinds that produced or influenced the value (ADR 0020): 'mcp_tool_result', 'model', 'file', 'database', 'user'. Provenance fact for lineage-aware policy. Set<String>."
+        },
+        {
+          "key": "flow_sink",
+          "type": "string",
+          "required": false,
+          "description": "Logical destination this action releases the value to (ADR 0020), e.g. 'external_model', 'local_model', 'external_mcp', 'trusted_mcp', 'user_secure_output', 'public_network', 'file'. The 'where' half of a flow decision — pair with flow_confidentiality/flow_integrity."
+        },
+        {
+          "key": "flow_sink_is_external",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the destination is outside the tenant trust boundary (ADR 0020). Lets a single policy express 'confidential data MUST NOT leave to any external sink' without enumerating sink ids."
+        },
+        {
+          "key": "flow_sink_effects",
+          "type": "array",
+          "required": false,
+          "description": "Side effects the destination can exercise (ADR 0020), e.g. 'network.send', 'financial.transfer', 'filesystem.write'. Enables 'untrusted content MUST NOT reach a financial.transfer sink'. Set<String>."
+        },
+        {
+          "key": "principal_clearances",
+          "type": "array",
+          "required": false,
+          "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. 'restricted', 'pii'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>."
+        },
+        {
+          "key": "principal_compartments",
+          "type": "array",
+          "required": false,
+          "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. 'tenant:acme', 'customer:123'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>."
+        },
+        {
+          "key": "surface",
+          "type": "string",
+          "required": true,
+          "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: 'guardrails', 'overwatch', 'ai_gateway' ('sentry' joins at D17 phase 2). The 'Applies to' narrowing target: test with an ordinary condition (context.surface == 'ai_gateway'); no 'has' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later."
+        },
+        {
+          "key": "malicious_package_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether a referenced package carries a known-malicious osv.dev (MAL-) advisory."
+        },
+        {
+          "key": "package_install_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the request installs or downloads a package (pip/npm/cargo/etc.)."
+        },
+        {
+          "key": "package_check_status",
+          "type": "string",
+          "required": false,
+          "description": "Malicious-package lookup status: empty (ok) or degraded (OSV unavailable, fail-open)."
+        },
+        {
+          "key": "max_threat_severity",
+          "type": "number",
+          "required": false,
+          "description": "Aggregate max threat severity across detectors (0=none,1=low,2=medium,3=high,4=critical).",
+          "range": "0-4"
+        }
       ]
     },
     {
@@ -1293,202 +1304,233 @@
           "required": false,
           "description": "Array of specific threat names detected"
         },
-        { "$ref": "session_keys" },
-        { "$ref": "agent_identity_keys" },
-        { "$ref": "flow_label_keys" },
-        { "$ref": "surface_keys" }
-      ]
-    },
-    {
-      "name": "read_file",
-      "description": "Read file operations for analyzing file content before allowing access",
-      "context_attributes": [
         {
-          "key": "role",
-          "type": "string",
+          "key": "session_pii_detected",
+          "type": "boolean",
           "required": false,
-          "description": "Caller's RBAC role projected from the principal's token"
+          "description": "Whether PII was detected in any previous turn of the session"
         },
         {
-          "key": "privilege_scope",
+          "key": "session_pii_types",
           "type": "array",
           "required": false,
-          "description": "Privilege-scope strings granted to the caller"
+          "description": "PII types detected across the session (accumulated)"
         },
         {
-          "key": "identity_type",
-          "type": "string",
+          "key": "session_secrets_detected",
+          "type": "boolean",
           "required": false,
-          "description": "Principal identity class: 'human', 'agent', 'service', or 'mcp_server'"
+          "description": "Whether secrets were detected in any previous turn of the session"
         },
         {
-          "key": "principal",
-          "type": "string",
+          "key": "session_secret_types",
+          "type": "array",
           "required": false,
-          "description": "Stable principal identifier"
+          "description": "Secret types detected across the session (accumulated)"
         },
         {
-          "key": "request_id",
-          "type": "string",
-          "required": true,
-          "description": "Unique identifier for this request"
+          "key": "session_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether prompt injection was detected in any previous turn of the session"
         },
         {
-          "key": "timestamp",
-          "type": "number",
-          "required": true,
-          "description": "Unix timestamp in milliseconds"
+          "key": "session_command_injection",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether command injection was detected in any previous turn of the session"
         },
         {
-          "key": "source",
-          "type": "string",
+          "key": "session_threat_turns",
+          "type": "number",
           "required": false,
-          "description": "Traffic origin: 'ide' | 'cli' | 'api' | 'browser'"
+          "description": "Number of turns in the session where threats were detected"
         },
         {
-          "key": "event",
-          "type": "string",
+          "key": "session_max_injection_score",
+          "type": "number",
           "required": false,
-          "description": "Event type: 'file_read'"
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions",
+          "range": "0-100"
         },
         {
-          "key": "user_email",
-          "type": "string",
+          "key": "session_max_jailbreak_score",
+          "type": "number",
           "required": false,
-          "description": "Human operator email (IDE sessions)"
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
-          "key": "cwd",
-          "type": "string",
+          "key": "session_max_command_injection_score",
+          "type": "number",
           "required": false,
-          "description": "Current working directory"
+          "description": "Highest command injection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
-          "key": "workspace_root",
-          "type": "string",
+          "key": "session_max_pii_score",
+          "type": "number",
           "required": false,
-          "description": "IDE workspace root path"
+          "description": "Highest PII risk score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
-          "key": "path",
-          "type": "string",
+          "key": "session_max_secret_score",
+          "type": "number",
           "required": false,
-          "description": "File path being read. Use for path-based access control policies."
+          "description": "Highest secret detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
-          "key": "secrets_detected",
-          "type": "boolean",
+          "key": "session_cumulative_risk_score",
+          "type": "number",
           "required": false,
-          "description": "Whether secrets were detected in the file content being read"
+          "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
         },
         {
-          "key": "secret_count",
-          "type": "number",
+          "key": "session_max_sensitivity",
+          "type": "string",
           "required": false,
-          "description": "Total number of secret matches found in file content"
+          "description": "Highest data-sensitivity tier observed across the session (e.g. 'public', 'internal', 'confidential', 'restricted')"
         },
         {
-          "key": "secret_types",
-          "type": "array",
+          "key": "session_original_request",
+          "type": "string",
           "required": false,
-          "description": "Array of secret types found in file content"
+          "description": "The session's first user request, retained for drift / goal-hijack policies that compare later turns against the original intent"
         },
         {
-          "key": "pii_detected",
-          "type": "boolean",
+          "key": "agent_id",
+          "type": "string",
           "required": false,
-          "description": "Whether PII was detected in the file content"
+          "description": "Unique identifier of the authenticated AI agent making this request. Empty string for human user requests."
         },
         {
-          "key": "pii_types",
-          "type": "array",
+          "key": "agent_type",
+          "type": "string",
           "required": false,
-          "description": "Array of PII types found in file content"
+          "description": "Type of the authenticated agent: 'orchestrator', 'autonomous', 'tool_agent', or 'human_proxy'. Empty string for human users."
         },
         {
-          "key": "path_traversal_detected",
-          "type": "boolean",
+          "key": "agent_trust_level",
+          "type": "string",
           "required": false,
-          "description": "Whether path traversal patterns were detected in the file path"
+          "description": "Trust level of the authenticated agent: 'first_party', 'verified_third_party', or 'unverified'."
         },
         {
-          "key": "path_traversal_severity",
+          "key": "agent_framework",
           "type": "string",
           "required": false,
-          "description": "Severity of path traversal in the file path"
+          "description": "Framework or SDK the agent is built with (e.g., 'claude-code', 'langchain', 'crewai', 'autogen')."
         },
         {
-          "key": "path_traversal_type",
+          "key": "agent_publisher",
           "type": "string",
           "required": false,
-          "description": "Type of path traversal detected"
+          "description": "Organization that published the agent (e.g., 'anthropic', 'internal', 'acme-corp')."
         },
         {
-          "key": "highest_severity",
+          "key": "flow_confidentiality",
           "type": "string",
           "required": false,
-          "description": "Highest severity level across all detection engines"
+          "description": "Confidentiality tier of the data this action carries or targets (ADR 0020): 'public', 'internal', 'confidential', 'restricted', or 'unknown'. Shares the ladder with session_max_sensitivity but is a per-value fact, not a session scalar. 'unknown' MUST NOT be treated as 'public' — guard with has and let policy DENY/STEP_UP/DEFER per flow_resolution_status."
         },
         {
-          "key": "threat_count",
-          "type": "number",
+          "key": "flow_integrity",
+          "type": "string",
           "required": false,
-          "description": "Total number of threats detected"
+          "description": "Integrity/influence tier of the data this action carries (ADR 0020): 'trusted', 'untrusted', 'mixed', or 'unknown'. Orthogonal to confidentiality: untrusted content may inform a pure analysis but MUST NOT authorize a side-effecting sink. Least-trusted contributor wins on join."
         },
         {
-          "key": "detected_threats",
+          "key": "flow_data_types",
           "type": "array",
           "required": false,
-          "description": "Array of specific threat names detected"
+          "description": "Sensitive data categories present in the value (ADR 0020), e.g. 'pii', 'secrets', 'source_code', 'financial', 'health'. Union of all contributing inputs. Set<String>."
         },
         {
-          "key": "budget_remaining_pct",
-          "type": "number",
+          "key": "flow_compartments",
+          "type": "array",
           "required": false,
-          "description": "Remaining token budget as percentage (0-100).",
-          "range": "0-100"
+          "description": "Compartments the value belongs to (ADR 0020), e.g. 'tenant:acme', 'customer:123', 'project:x'. Union of all contributing inputs — cross-compartment composition is expressible by cardinality. Set<String>."
         },
         {
-          "key": "budget_exceeded",
-          "type": "boolean",
+          "key": "flow_resolution_status",
+          "type": "string",
           "required": false,
-          "description": "Whether the token budget has been exceeded"
+          "description": "How the flow label was resolved (ADR 0020): 'known', 'inferred', 'unknown', or 'conflicted'. Policy authors choose the posture for 'unknown' per sink (DENY external, STEP_UP, DEFER while a classifier runs, or allow-and-record). Never silently resolves to public."
         },
         {
-          "key": "rpm_remaining_pct",
-          "type": "number",
+          "key": "flow_origins",
+          "type": "array",
           "required": false,
-          "description": "Remaining RPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014).",
-          "range": "0-100"
+          "description": "Origin kinds that produced or influenced the value (ADR 0020): 'mcp_tool_result', 'model', 'file', 'database', 'user'. Provenance fact for lineage-aware policy. Set<String>."
         },
         {
-          "key": "rpm_exceeded",
+          "key": "flow_sink",
+          "type": "string",
+          "required": false,
+          "description": "Logical destination this action releases the value to (ADR 0020), e.g. 'external_model', 'local_model', 'external_mcp', 'trusted_mcp', 'user_secure_output', 'public_network', 'file'. The 'where' half of a flow decision — pair with flow_confidentiality/flow_integrity."
+        },
+        {
+          "key": "flow_sink_is_external",
           "type": "boolean",
           "required": false,
-          "description": "Whether the RPM limit has been exceeded"
+          "description": "Whether the destination is outside the tenant trust boundary (ADR 0020). Lets a single policy express 'confidential data MUST NOT leave to any external sink' without enumerating sink ids."
         },
         {
-          "key": "tpm_remaining_pct",
-          "type": "number",
+          "key": "flow_sink_effects",
+          "type": "array",
           "required": false,
-          "description": "Remaining TPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014).",
-          "range": "0-100"
+          "description": "Side effects the destination can exercise (ADR 0020), e.g. 'network.send', 'financial.transfer', 'filesystem.write'. Enables 'untrusted content MUST NOT reach a financial.transfer sink'. Set<String>."
         },
         {
-          "key": "tpm_exceeded",
+          "key": "principal_clearances",
+          "type": "array",
+          "required": false,
+          "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. 'restricted', 'pii'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>."
+        },
+        {
+          "key": "principal_compartments",
+          "type": "array",
+          "required": false,
+          "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. 'tenant:acme', 'customer:123'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>."
+        },
+        {
+          "key": "surface",
+          "type": "string",
+          "required": true,
+          "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: 'guardrails', 'overwatch', 'ai_gateway' ('sentry' joins at D17 phase 2). The 'Applies to' narrowing target: test with an ordinary condition (context.surface == 'ai_gateway'); no 'has' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later."
+        },
+        {
+          "key": "malicious_package_detected",
           "type": "boolean",
           "required": false,
-          "description": "Whether the TPM limit has been exceeded"
+          "description": "Whether a referenced package carries a known-malicious osv.dev (MAL-) advisory."
+        },
+        {
+          "key": "package_install_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the request installs or downloads a package (pip/npm/cargo/etc.)."
+        },
+        {
+          "key": "package_check_status",
+          "type": "string",
+          "required": false,
+          "description": "Malicious-package lookup status: empty (ok) or degraded (OSV unavailable, fail-open)."
         },
-        { "$ref": "session_keys" },
-        { "$ref": "agent_identity_keys" },
-        { "$ref": "flow_label_keys" },
-        { "$ref": "surface_keys" }
+        {
+          "key": "max_threat_severity",
+          "type": "number",
+          "required": false,
+          "description": "Aggregate max threat severity across detectors (0=none,1=low,2=medium,3=high,4=critical).",
+          "range": "0-4"
+        }
       ]
     },
     {
-      "name": "write_file",
-      "description": "Write file operations for preventing writes of sensitive content",
+      "name": "read_file",
+      "description": "Read file operations for analyzing file content before allowing access",
       "context_attributes": [
         {
           "key": "role",
@@ -1536,7 +1578,7 @@
           "key": "event",
           "type": "string",
           "required": false,
-          "description": "Event type: 'file_write'"
+          "description": "Event type: 'file_read'"
         },
         {
           "key": "user_email",
@@ -1560,50 +1602,37 @@
           "key": "path",
           "type": "string",
           "required": false,
-          "description": "File path being written. Use for path-based blocking policies."
-        },
-        {
-          "key": "invisible_chars_detected",
-          "type": "boolean",
-          "required": false,
-          "description": "Whether invisible Unicode characters were detected in the content being written"
-        },
-        {
-          "key": "invisible_chars_score",
-          "type": "number",
-          "required": false,
-          "description": "Invisible character attack severity score in write content (0-100).",
-          "range": "0-100"
+          "description": "File path being read. Use for path-based access control policies."
         },
         {
           "key": "secrets_detected",
           "type": "boolean",
           "required": false,
-          "description": "Whether secrets were detected in the content being written"
+          "description": "Whether secrets were detected in the file content being read"
         },
         {
           "key": "secret_count",
           "type": "number",
           "required": false,
-          "description": "Total number of secret matches found in write content"
+          "description": "Total number of secret matches found in file content"
         },
         {
           "key": "secret_types",
           "type": "array",
           "required": false,
-          "description": "Array of secret types found in write content"
+          "description": "Array of secret types found in file content"
         },
         {
           "key": "pii_detected",
           "type": "boolean",
           "required": false,
-          "description": "Whether PII was detected in the content being written"
+          "description": "Whether PII was detected in the file content"
         },
         {
           "key": "pii_types",
           "type": "array",
           "required": false,
-          "description": "Array of PII types found in write content"
+          "description": "Array of PII types found in file content"
         },
         {
           "key": "path_traversal_detected",
@@ -1615,7 +1644,7 @@
           "key": "path_traversal_severity",
           "type": "string",
           "required": false,
-          "description": "Severity of path traversal in the file write path"
+          "description": "Severity of path traversal in the file path"
         },
         {
           "key": "path_traversal_type",
@@ -1680,212 +1709,1016 @@
           "required": false,
           "description": "Whether the TPM limit has been exceeded"
         },
-        { "$ref": "session_keys" },
-        { "$ref": "agent_identity_keys" },
-        { "$ref": "flow_label_keys" },
-        { "$ref": "surface_keys" }
-      ]
-    },
-    {
-      "name": "connect_server",
-      "description": "Connect to an MCP server, used to control which MCP servers are allowed",
-      "context_attributes": [
         {
-          "key": "role",
-          "type": "string",
+          "key": "session_pii_detected",
+          "type": "boolean",
           "required": false,
-          "description": "Caller's RBAC role projected from the principal's token"
+          "description": "Whether PII was detected in any previous turn of the session"
         },
         {
-          "key": "privilege_scope",
+          "key": "session_pii_types",
           "type": "array",
           "required": false,
-          "description": "Privilege-scope strings granted to the caller"
+          "description": "PII types detected across the session (accumulated)"
         },
         {
-          "key": "identity_type",
-          "type": "string",
+          "key": "session_secrets_detected",
+          "type": "boolean",
           "required": false,
-          "description": "Principal identity class: 'human', 'agent', 'service', or 'mcp_server'"
+          "description": "Whether secrets were detected in any previous turn of the session"
         },
         {
-          "key": "principal",
-          "type": "string",
+          "key": "session_secret_types",
+          "type": "array",
           "required": false,
-          "description": "Stable principal identifier"
+          "description": "Secret types detected across the session (accumulated)"
         },
         {
-          "key": "request_id",
-          "type": "string",
-          "required": true,
-          "description": "Unique identifier for this request"
+          "key": "session_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether prompt injection was detected in any previous turn of the session"
         },
         {
-          "key": "timestamp",
+          "key": "session_command_injection",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether command injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_threat_turns",
           "type": "number",
-          "required": true,
-          "description": "Unix timestamp in milliseconds"
+          "required": false,
+          "description": "Number of turns in the session where threats were detected"
         },
         {
-          "key": "source",
-          "type": "string",
+          "key": "session_max_injection_score",
+          "type": "number",
           "required": false,
-          "description": "Traffic origin: 'ide' | 'cli' | 'api' | 'browser'"
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions",
+          "range": "0-100"
         },
         {
-          "key": "event",
-          "type": "string",
+          "key": "session_max_jailbreak_score",
+          "type": "number",
           "required": false,
-          "description": "Event type: 'connect_server'"
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
-          "key": "user_email",
-          "type": "string",
+          "key": "session_max_command_injection_score",
+          "type": "number",
           "required": false,
-          "description": "Human operator email (IDE sessions)"
+          "description": "Highest command injection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
-          "key": "cwd",
+          "key": "session_max_pii_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest PII risk score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_secret_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest secret detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_cumulative_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
+        },
+        {
+          "key": "session_max_sensitivity",
           "type": "string",
           "required": false,
-          "description": "Current working directory"
+          "description": "Highest data-sensitivity tier observed across the session (e.g. 'public', 'internal', 'confidential', 'restricted')"
         },
         {
-          "key": "workspace_root",
+          "key": "session_original_request",
           "type": "string",
           "required": false,
-          "description": "IDE workspace root path"
+          "description": "The session's first user request, retained for drift / goal-hijack policies that compare later turns against the original intent"
         },
         {
-          "key": "mcp_server",
+          "key": "agent_id",
           "type": "string",
           "required": false,
-          "description": "Name of the MCP server being connected to"
+          "description": "Unique identifier of the authenticated AI agent making this request. Empty string for human user requests."
         },
         {
-          "key": "mcp_server_verified",
-          "type": "boolean",
+          "key": "agent_type",
+          "type": "string",
           "required": false,
-          "description": "Whether the MCP server is from a verified/trusted registry"
+          "description": "Type of the authenticated agent: 'orchestrator', 'autonomous', 'tool_agent', or 'human_proxy'. Empty string for human users."
         },
         {
-          "key": "tool_poisoning_detected",
-          "type": "boolean",
+          "key": "agent_trust_level",
+          "type": "string",
           "required": false,
-          "description": "Whether tool poisoning was detected in the MCP server's tool descriptions"
+          "description": "Trust level of the authenticated agent: 'first_party', 'verified_third_party', or 'unverified'."
         },
         {
-          "key": "tool_poisoning_score",
-          "type": "number",
+          "key": "agent_framework",
+          "type": "string",
           "required": false,
-          "description": "Confidence score for tool poisoning in MCP server tools (0-100).",
-          "range": "0-100"
+          "description": "Framework or SDK the agent is built with (e.g., 'claude-code', 'langchain', 'crewai', 'autogen')."
         },
         {
-          "key": "tool_poisoning_type",
+          "key": "agent_publisher",
           "type": "string",
           "required": false,
-          "description": "Type of tool poisoning detected: 'hidden_instructions', 'system_prompt_injection', or 'authority_hijack'"
+          "description": "Organization that published the agent (e.g., 'anthropic', 'internal', 'acme-corp')."
         },
         {
-          "key": "mcp_config_risk",
-          "type": "boolean",
+          "key": "flow_confidentiality",
+          "type": "string",
           "required": false,
-          "description": "Whether MCP configuration risk was detected"
+          "description": "Confidentiality tier of the data this action carries or targets (ADR 0020): 'public', 'internal', 'confidential', 'restricted', or 'unknown'. Shares the ladder with session_max_sensitivity but is a per-value fact, not a session scalar. 'unknown' MUST NOT be treated as 'public' — guard with has and let policy DENY/STEP_UP/DEFER per flow_resolution_status."
         },
         {
-          "key": "mcp_risk_type",
+          "key": "flow_integrity",
           "type": "string",
           "required": false,
-          "description": "Type of MCP configuration risk: 'inline_execution', 'suspicious_url', or 'cross_origin'"
+          "description": "Integrity/influence tier of the data this action carries (ADR 0020): 'trusted', 'untrusted', 'mixed', or 'unknown'. Orthogonal to confidentiality: untrusted content may inform a pure analysis but MUST NOT authorize a side-effecting sink. Least-trusted contributor wins on join."
         },
         {
-          "key": "mcp_risk_score",
-          "type": "number",
+          "key": "flow_data_types",
+          "type": "array",
           "required": false,
-          "description": "Risk score for MCP configuration issues (0-100).",
-          "range": "0-100"
+          "description": "Sensitive data categories present in the value (ADR 0020), e.g. 'pii', 'secrets', 'source_code', 'financial', 'health'. Union of all contributing inputs. Set<String>."
         },
         {
-          "key": "cross_origin_detected",
-          "type": "boolean",
+          "key": "flow_compartments",
+          "type": "array",
           "required": false,
-          "description": "Whether cross-origin escalation patterns were detected"
+          "description": "Compartments the value belongs to (ADR 0020), e.g. 'tenant:acme', 'customer:123', 'project:x'. Union of all contributing inputs — cross-compartment composition is expressible by cardinality. Set<String>."
         },
         {
-          "key": "cross_origin_type",
+          "key": "flow_resolution_status",
           "type": "string",
           "required": false,
-          "description": "Type of cross-origin escalation detected"
+          "description": "How the flow label was resolved (ADR 0020): 'known', 'inferred', 'unknown', or 'conflicted'. Policy authors choose the posture for 'unknown' per sink (DENY external, STEP_UP, DEFER while a classifier runs, or allow-and-record). Never silently resolves to public."
         },
         {
-          "key": "cross_origin_score",
-          "type": "number",
+          "key": "flow_origins",
+          "type": "array",
           "required": false,
-          "description": "Risk score for cross-origin escalation (0-100).",
-          "range": "0-100"
+          "description": "Origin kinds that produced or influenced the value (ADR 0020): 'mcp_tool_result', 'model', 'file', 'database', 'user'. Provenance fact for lineage-aware policy. Set<String>."
         },
         {
-          "key": "highest_severity",
+          "key": "flow_sink",
           "type": "string",
           "required": false,
-          "description": "Highest severity level across all detection engines"
+          "description": "Logical destination this action releases the value to (ADR 0020), e.g. 'external_model', 'local_model', 'external_mcp', 'trusted_mcp', 'user_secure_output', 'public_network', 'file'. The 'where' half of a flow decision — pair with flow_confidentiality/flow_integrity."
         },
         {
-          "key": "threat_count",
-          "type": "number",
+          "key": "flow_sink_is_external",
+          "type": "boolean",
           "required": false,
-          "description": "Total number of threats detected"
+          "description": "Whether the destination is outside the tenant trust boundary (ADR 0020). Lets a single policy express 'confidential data MUST NOT leave to any external sink' without enumerating sink ids."
         },
         {
-          "key": "detected_threats",
+          "key": "flow_sink_effects",
           "type": "array",
           "required": false,
-          "description": "Array of specific threat names detected"
+          "description": "Side effects the destination can exercise (ADR 0020), e.g. 'network.send', 'financial.transfer', 'filesystem.write'. Enables 'untrusted content MUST NOT reach a financial.transfer sink'. Set<String>."
         },
         {
-          "key": "budget_remaining_pct",
-          "type": "number",
+          "key": "principal_clearances",
+          "type": "array",
           "required": false,
-          "description": "Remaining token budget as percentage (0-100).",
-          "range": "0-100"
+          "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. 'restricted', 'pii'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>."
         },
         {
-          "key": "budget_exceeded",
-          "type": "boolean",
+          "key": "principal_compartments",
+          "type": "array",
           "required": false,
-          "description": "Whether the token budget has been exceeded"
+          "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. 'tenant:acme', 'customer:123'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>."
         },
         {
-          "key": "rpm_remaining_pct",
-          "type": "number",
+          "key": "surface",
+          "type": "string",
+          "required": true,
+          "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: 'guardrails', 'overwatch', 'ai_gateway' ('sentry' joins at D17 phase 2). The 'Applies to' narrowing target: test with an ordinary condition (context.surface == 'ai_gateway'); no 'has' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later."
+        }
+      ]
+    },
+    {
+      "name": "write_file",
+      "description": "Write file operations for preventing writes of sensitive content",
+      "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
           "required": false,
-          "description": "Remaining RPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014).",
-          "range": "0-100"
+          "description": "Caller's RBAC role projected from the principal's token"
         },
         {
-          "key": "rpm_exceeded",
-          "type": "boolean",
+          "key": "privilege_scope",
+          "type": "array",
           "required": false,
-          "description": "Whether the RPM limit has been exceeded"
+          "description": "Privilege-scope strings granted to the caller"
         },
         {
-          "key": "tpm_remaining_pct",
-          "type": "number",
+          "key": "identity_type",
+          "type": "string",
           "required": false,
-          "description": "Remaining TPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014).",
-          "range": "0-100"
+          "description": "Principal identity class: 'human', 'agent', 'service', or 'mcp_server'"
         },
         {
-          "key": "tpm_exceeded",
-          "type": "boolean",
+          "key": "principal",
+          "type": "string",
           "required": false,
-          "description": "Whether the TPM limit has been exceeded"
+          "description": "Stable principal identifier"
+        },
+        {
+          "key": "request_id",
+          "type": "string",
+          "required": true,
+          "description": "Unique identifier for this request"
+        },
+        {
+          "key": "timestamp",
+          "type": "number",
+          "required": true,
+          "description": "Unix timestamp in milliseconds"
         },
-        { "$ref": "session_keys" },
-        { "$ref": "agent_identity_keys" },
-        { "$ref": "flow_label_keys" },
-        { "$ref": "surface_keys" }
+        {
+          "key": "source",
+          "type": "string",
+          "required": false,
+          "description": "Traffic origin: 'ide' | 'cli' | 'api' | 'browser'"
+        },
+        {
+          "key": "event",
+          "type": "string",
+          "required": false,
+          "description": "Event type: 'file_write'"
+        },
+        {
+          "key": "user_email",
+          "type": "string",
+          "required": false,
+          "description": "Human operator email (IDE sessions)"
+        },
+        {
+          "key": "cwd",
+          "type": "string",
+          "required": false,
+          "description": "Current working directory"
+        },
+        {
+          "key": "workspace_root",
+          "type": "string",
+          "required": false,
+          "description": "IDE workspace root path"
+        },
+        {
+          "key": "path",
+          "type": "string",
+          "required": false,
+          "description": "File path being written. Use for path-based blocking policies."
+        },
+        {
+          "key": "invisible_chars_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether invisible Unicode characters were detected in the content being written"
+        },
+        {
+          "key": "invisible_chars_score",
+          "type": "number",
+          "required": false,
+          "description": "Invisible character attack severity score in write content (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether secrets were detected in the content being written"
+        },
+        {
+          "key": "secret_count",
+          "type": "number",
+          "required": false,
+          "description": "Total number of secret matches found in write content"
+        },
+        {
+          "key": "secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Array of secret types found in write content"
+        },
+        {
+          "key": "pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether PII was detected in the content being written"
+        },
+        {
+          "key": "pii_types",
+          "type": "array",
+          "required": false,
+          "description": "Array of PII types found in write content"
+        },
+        {
+          "key": "path_traversal_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether path traversal patterns were detected in the file path"
+        },
+        {
+          "key": "path_traversal_severity",
+          "type": "string",
+          "required": false,
+          "description": "Severity of path traversal in the file write path"
+        },
+        {
+          "key": "path_traversal_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of path traversal detected"
+        },
+        {
+          "key": "highest_severity",
+          "type": "string",
+          "required": false,
+          "description": "Highest severity level across all detection engines"
+        },
+        {
+          "key": "threat_count",
+          "type": "number",
+          "required": false,
+          "description": "Total number of threats detected"
+        },
+        {
+          "key": "detected_threats",
+          "type": "array",
+          "required": false,
+          "description": "Array of specific threat names detected"
+        },
+        {
+          "key": "budget_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining token budget as percentage (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "budget_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the token budget has been exceeded"
+        },
+        {
+          "key": "rpm_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining RPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014).",
+          "range": "0-100"
+        },
+        {
+          "key": "rpm_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the RPM limit has been exceeded"
+        },
+        {
+          "key": "tpm_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining TPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014).",
+          "range": "0-100"
+        },
+        {
+          "key": "tpm_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the TPM limit has been exceeded"
+        },
+        {
+          "key": "session_pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether PII was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_pii_types",
+          "type": "array",
+          "required": false,
+          "description": "PII types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether secrets were detected in any previous turn of the session"
+        },
+        {
+          "key": "session_secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Secret types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether prompt injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_command_injection",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether command injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_threat_turns",
+          "type": "number",
+          "required": false,
+          "description": "Number of turns in the session where threats were detected"
+        },
+        {
+          "key": "session_max_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_command_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest command injection score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_pii_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest PII risk score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_secret_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest secret detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_cumulative_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
+        },
+        {
+          "key": "session_max_sensitivity",
+          "type": "string",
+          "required": false,
+          "description": "Highest data-sensitivity tier observed across the session (e.g. 'public', 'internal', 'confidential', 'restricted')"
+        },
+        {
+          "key": "session_original_request",
+          "type": "string",
+          "required": false,
+          "description": "The session's first user request, retained for drift / goal-hijack policies that compare later turns against the original intent"
+        },
+        {
+          "key": "agent_id",
+          "type": "string",
+          "required": false,
+          "description": "Unique identifier of the authenticated AI agent making this request. Empty string for human user requests."
+        },
+        {
+          "key": "agent_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of the authenticated agent: 'orchestrator', 'autonomous', 'tool_agent', or 'human_proxy'. Empty string for human users."
+        },
+        {
+          "key": "agent_trust_level",
+          "type": "string",
+          "required": false,
+          "description": "Trust level of the authenticated agent: 'first_party', 'verified_third_party', or 'unverified'."
+        },
+        {
+          "key": "agent_framework",
+          "type": "string",
+          "required": false,
+          "description": "Framework or SDK the agent is built with (e.g., 'claude-code', 'langchain', 'crewai', 'autogen')."
+        },
+        {
+          "key": "agent_publisher",
+          "type": "string",
+          "required": false,
+          "description": "Organization that published the agent (e.g., 'anthropic', 'internal', 'acme-corp')."
+        },
+        {
+          "key": "flow_confidentiality",
+          "type": "string",
+          "required": false,
+          "description": "Confidentiality tier of the data this action carries or targets (ADR 0020): 'public', 'internal', 'confidential', 'restricted', or 'unknown'. Shares the ladder with session_max_sensitivity but is a per-value fact, not a session scalar. 'unknown' MUST NOT be treated as 'public' — guard with has and let policy DENY/STEP_UP/DEFER per flow_resolution_status."
+        },
+        {
+          "key": "flow_integrity",
+          "type": "string",
+          "required": false,
+          "description": "Integrity/influence tier of the data this action carries (ADR 0020): 'trusted', 'untrusted', 'mixed', or 'unknown'. Orthogonal to confidentiality: untrusted content may inform a pure analysis but MUST NOT authorize a side-effecting sink. Least-trusted contributor wins on join."
+        },
+        {
+          "key": "flow_data_types",
+          "type": "array",
+          "required": false,
+          "description": "Sensitive data categories present in the value (ADR 0020), e.g. 'pii', 'secrets', 'source_code', 'financial', 'health'. Union of all contributing inputs. Set<String>."
+        },
+        {
+          "key": "flow_compartments",
+          "type": "array",
+          "required": false,
+          "description": "Compartments the value belongs to (ADR 0020), e.g. 'tenant:acme', 'customer:123', 'project:x'. Union of all contributing inputs — cross-compartment composition is expressible by cardinality. Set<String>."
+        },
+        {
+          "key": "flow_resolution_status",
+          "type": "string",
+          "required": false,
+          "description": "How the flow label was resolved (ADR 0020): 'known', 'inferred', 'unknown', or 'conflicted'. Policy authors choose the posture for 'unknown' per sink (DENY external, STEP_UP, DEFER while a classifier runs, or allow-and-record). Never silently resolves to public."
+        },
+        {
+          "key": "flow_origins",
+          "type": "array",
+          "required": false,
+          "description": "Origin kinds that produced or influenced the value (ADR 0020): 'mcp_tool_result', 'model', 'file', 'database', 'user'. Provenance fact for lineage-aware policy. Set<String>."
+        },
+        {
+          "key": "flow_sink",
+          "type": "string",
+          "required": false,
+          "description": "Logical destination this action releases the value to (ADR 0020), e.g. 'external_model', 'local_model', 'external_mcp', 'trusted_mcp', 'user_secure_output', 'public_network', 'file'. The 'where' half of a flow decision — pair with flow_confidentiality/flow_integrity."
+        },
+        {
+          "key": "flow_sink_is_external",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the destination is outside the tenant trust boundary (ADR 0020). Lets a single policy express 'confidential data MUST NOT leave to any external sink' without enumerating sink ids."
+        },
+        {
+          "key": "flow_sink_effects",
+          "type": "array",
+          "required": false,
+          "description": "Side effects the destination can exercise (ADR 0020), e.g. 'network.send', 'financial.transfer', 'filesystem.write'. Enables 'untrusted content MUST NOT reach a financial.transfer sink'. Set<String>."
+        },
+        {
+          "key": "principal_clearances",
+          "type": "array",
+          "required": false,
+          "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. 'restricted', 'pii'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>."
+        },
+        {
+          "key": "principal_compartments",
+          "type": "array",
+          "required": false,
+          "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. 'tenant:acme', 'customer:123'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>."
+        },
+        {
+          "key": "surface",
+          "type": "string",
+          "required": true,
+          "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: 'guardrails', 'overwatch', 'ai_gateway' ('sentry' joins at D17 phase 2). The 'Applies to' narrowing target: test with an ordinary condition (context.surface == 'ai_gateway'); no 'has' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later."
+        }
+      ]
+    },
+    {
+      "name": "connect_server",
+      "description": "Connect to an MCP server, used to control which MCP servers are allowed",
+      "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token"
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller"
+        },
+        {
+          "key": "identity_type",
+          "type": "string",
+          "required": false,
+          "description": "Principal identity class: 'human', 'agent', 'service', or 'mcp_server'"
+        },
+        {
+          "key": "principal",
+          "type": "string",
+          "required": false,
+          "description": "Stable principal identifier"
+        },
+        {
+          "key": "request_id",
+          "type": "string",
+          "required": true,
+          "description": "Unique identifier for this request"
+        },
+        {
+          "key": "timestamp",
+          "type": "number",
+          "required": true,
+          "description": "Unix timestamp in milliseconds"
+        },
+        {
+          "key": "source",
+          "type": "string",
+          "required": false,
+          "description": "Traffic origin: 'ide' | 'cli' | 'api' | 'browser'"
+        },
+        {
+          "key": "event",
+          "type": "string",
+          "required": false,
+          "description": "Event type: 'connect_server'"
+        },
+        {
+          "key": "user_email",
+          "type": "string",
+          "required": false,
+          "description": "Human operator email (IDE sessions)"
+        },
+        {
+          "key": "cwd",
+          "type": "string",
+          "required": false,
+          "description": "Current working directory"
+        },
+        {
+          "key": "workspace_root",
+          "type": "string",
+          "required": false,
+          "description": "IDE workspace root path"
+        },
+        {
+          "key": "mcp_server",
+          "type": "string",
+          "required": false,
+          "description": "Name of the MCP server being connected to"
+        },
+        {
+          "key": "mcp_server_verified",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the MCP server is from a verified/trusted registry"
+        },
+        {
+          "key": "tool_poisoning_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether tool poisoning was detected in the MCP server's tool descriptions"
+        },
+        {
+          "key": "tool_poisoning_score",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score for tool poisoning in MCP server tools (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "tool_poisoning_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of tool poisoning detected: 'hidden_instructions', 'system_prompt_injection', or 'authority_hijack'"
+        },
+        {
+          "key": "mcp_config_risk",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether MCP configuration risk was detected"
+        },
+        {
+          "key": "mcp_risk_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of MCP configuration risk: 'inline_execution', 'suspicious_url', or 'cross_origin'"
+        },
+        {
+          "key": "mcp_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Risk score for MCP configuration issues (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "cross_origin_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether cross-origin escalation patterns were detected"
+        },
+        {
+          "key": "cross_origin_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of cross-origin escalation detected"
+        },
+        {
+          "key": "cross_origin_score",
+          "type": "number",
+          "required": false,
+          "description": "Risk score for cross-origin escalation (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "highest_severity",
+          "type": "string",
+          "required": false,
+          "description": "Highest severity level across all detection engines"
+        },
+        {
+          "key": "threat_count",
+          "type": "number",
+          "required": false,
+          "description": "Total number of threats detected"
+        },
+        {
+          "key": "detected_threats",
+          "type": "array",
+          "required": false,
+          "description": "Array of specific threat names detected"
+        },
+        {
+          "key": "budget_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining token budget as percentage (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "budget_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the token budget has been exceeded"
+        },
+        {
+          "key": "rpm_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining RPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014).",
+          "range": "0-100"
+        },
+        {
+          "key": "rpm_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the RPM limit has been exceeded"
+        },
+        {
+          "key": "tpm_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining TPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014).",
+          "range": "0-100"
+        },
+        {
+          "key": "tpm_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the TPM limit has been exceeded"
+        },
+        {
+          "key": "session_pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether PII was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_pii_types",
+          "type": "array",
+          "required": false,
+          "description": "PII types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether secrets were detected in any previous turn of the session"
+        },
+        {
+          "key": "session_secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Secret types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether prompt injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_command_injection",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether command injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_threat_turns",
+          "type": "number",
+          "required": false,
+          "description": "Number of turns in the session where threats were detected"
+        },
+        {
+          "key": "session_max_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_command_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest command injection score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_pii_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest PII risk score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_secret_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest secret detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_cumulative_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
+        },
+        {
+          "key": "session_max_sensitivity",
+          "type": "string",
+          "required": false,
+          "description": "Highest data-sensitivity tier observed across the session (e.g. 'public', 'internal', 'confidential', 'restricted')"
+        },
+        {
+          "key": "session_original_request",
+          "type": "string",
+          "required": false,
+          "description": "The session's first user request, retained for drift / goal-hijack policies that compare later turns against the original intent"
+        },
+        {
+          "key": "agent_id",
+          "type": "string",
+          "required": false,
+          "description": "Unique identifier of the authenticated AI agent making this request. Empty string for human user requests."
+        },
+        {
+          "key": "agent_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of the authenticated agent: 'orchestrator', 'autonomous', 'tool_agent', or 'human_proxy'. Empty string for human users."
+        },
+        {
+          "key": "agent_trust_level",
+          "type": "string",
+          "required": false,
+          "description": "Trust level of the authenticated agent: 'first_party', 'verified_third_party', or 'unverified'."
+        },
+        {
+          "key": "agent_framework",
+          "type": "string",
+          "required": false,
+          "description": "Framework or SDK the agent is built with (e.g., 'claude-code', 'langchain', 'crewai', 'autogen')."
+        },
+        {
+          "key": "agent_publisher",
+          "type": "string",
+          "required": false,
+          "description": "Organization that published the agent (e.g., 'anthropic', 'internal', 'acme-corp')."
+        },
+        {
+          "key": "flow_confidentiality",
+          "type": "string",
+          "required": false,
+          "description": "Confidentiality tier of the data this action carries or targets (ADR 0020): 'public', 'internal', 'confidential', 'restricted', or 'unknown'. Shares the ladder with session_max_sensitivity but is a per-value fact, not a session scalar. 'unknown' MUST NOT be treated as 'public' — guard with has and let policy DENY/STEP_UP/DEFER per flow_resolution_status."
+        },
+        {
+          "key": "flow_integrity",
+          "type": "string",
+          "required": false,
+          "description": "Integrity/influence tier of the data this action carries (ADR 0020): 'trusted', 'untrusted', 'mixed', or 'unknown'. Orthogonal to confidentiality: untrusted content may inform a pure analysis but MUST NOT authorize a side-effecting sink. Least-trusted contributor wins on join."
+        },
+        {
+          "key": "flow_data_types",
+          "type": "array",
+          "required": false,
+          "description": "Sensitive data categories present in the value (ADR 0020), e.g. 'pii', 'secrets', 'source_code', 'financial', 'health'. Union of all contributing inputs. Set<String>."
+        },
+        {
+          "key": "flow_compartments",
+          "type": "array",
+          "required": false,
+          "description": "Compartments the value belongs to (ADR 0020), e.g. 'tenant:acme', 'customer:123', 'project:x'. Union of all contributing inputs — cross-compartment composition is expressible by cardinality. Set<String>."
+        },
+        {
+          "key": "flow_resolution_status",
+          "type": "string",
+          "required": false,
+          "description": "How the flow label was resolved (ADR 0020): 'known', 'inferred', 'unknown', or 'conflicted'. Policy authors choose the posture for 'unknown' per sink (DENY external, STEP_UP, DEFER while a classifier runs, or allow-and-record). Never silently resolves to public."
+        },
+        {
+          "key": "flow_origins",
+          "type": "array",
+          "required": false,
+          "description": "Origin kinds that produced or influenced the value (ADR 0020): 'mcp_tool_result', 'model', 'file', 'database', 'user'. Provenance fact for lineage-aware policy. Set<String>."
+        },
+        {
+          "key": "flow_sink",
+          "type": "string",
+          "required": false,
+          "description": "Logical destination this action releases the value to (ADR 0020), e.g. 'external_model', 'local_model', 'external_mcp', 'trusted_mcp', 'user_secure_output', 'public_network', 'file'. The 'where' half of a flow decision — pair with flow_confidentiality/flow_integrity."
+        },
+        {
+          "key": "flow_sink_is_external",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the destination is outside the tenant trust boundary (ADR 0020). Lets a single policy express 'confidential data MUST NOT leave to any external sink' without enumerating sink ids."
+        },
+        {
+          "key": "flow_sink_effects",
+          "type": "array",
+          "required": false,
+          "description": "Side effects the destination can exercise (ADR 0020), e.g. 'network.send', 'financial.transfer', 'filesystem.write'. Enables 'untrusted content MUST NOT reach a financial.transfer sink'. Set<String>."
+        },
+        {
+          "key": "principal_clearances",
+          "type": "array",
+          "required": false,
+          "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. 'restricted', 'pii'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>."
+        },
+        {
+          "key": "principal_compartments",
+          "type": "array",
+          "required": false,
+          "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. 'tenant:acme', 'customer:123'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>."
+        },
+        {
+          "key": "surface",
+          "type": "string",
+          "required": true,
+          "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: 'guardrails', 'overwatch', 'ai_gateway' ('sentry' joins at D17 phase 2). The 'Applies to' narrowing target: test with an ordinary condition (context.surface == 'ai_gateway'); no 'has' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later."
+        },
+        {
+          "key": "malicious_package_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether a referenced package carries a known-malicious osv.dev (MAL-) advisory."
+        },
+        {
+          "key": "package_install_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the request installs or downloads a package (pip/npm/cargo/etc.)."
+        },
+        {
+          "key": "package_check_status",
+          "type": "string",
+          "required": false,
+          "description": "Malicious-package lookup status: empty (ok) or degraded (OSV unavailable, fail-open)."
+        },
+        {
+          "key": "max_threat_severity",
+          "type": "number",
+          "required": false,
+          "description": "Aggregate max threat severity across detectors (0=none,1=low,2=medium,3=high,4=critical).",
+          "range": "0-4"
+        }
       ]
     },
     {
@@ -1973,4 +2806,4 @@
       ]
     }
   ]
-}
+}