@highflame/policy 2.2.29 → 2.2.32

package/_schemas/agent_ops/templates/ported/agent-security/agent_identity_multi_agent_safety.cedar

@@ -0,0 +1,164 @@
+// =============================================================================
+// Multi-Agent Orchestration — Cross-Turn Agent Safety
+// =============================================================================
+// Session-aware policies that combine cross-turn detection history with
+// agent identity for defense-in-depth. When one agent in a multi-agent
+// session detects a threat, subsequent agents in the same session are
+// restricted accordingly.
+//
+// Context keys consumed:
+//   - agent_trust_level, agent_type, tool_name, tool_is_sensitive
+//   - session_pii_detected, session_pii_types
+//   - session_secrets_detected, session_injection_detected
+//   - session_command_injection
+//   - session_threat_turns:            Long
+//   - session_cumulative_risk_score:   Long
+//   - suspicious_pattern:              Bool
+//
+// Compliance:
+//   - OWASP LLM01, LLM08
+//
+// Category:  agent-identity
+// Namespace: AgentOps
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: PII containment
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.multi-agent-pii-block-network-tools")
+@name("Block network tools for non-first-party agents after PII")
+@description("Blocks call_tool when agent_trust_level is not \"first_party\", session_pii_detected is true, and tool_name is a network tool.")
+@severity("critical")
+@tags("category:agent-identity,threat:exfiltration,scope:per-agent,detection:aggregate,surface:call-tool")
+@reject_message("Tool execution blocked: PII was detected earlier in this session and non-first-party agents cannot use network tools afterwards.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
+    context has session_pii_detected && context.session_pii_detected == true &&
+    context has tool_name &&
+    (
+        context.tool_name == "http_post" ||
+        context.tool_name == "send_email" ||
+        context.tool_name == "http_request" ||
+        context.tool_name == "webhook"
+    )
+};
+
+@id("agent-identity.multi-agent-pii-block-unverified-write")
+@name("Block unverified agents from writing files after PII")
+@description("Blocks write_file when agent_trust_level is \"unverified\" and session_pii_detected is true.")
+@severity("high")
+@tags("category:agent-identity,threat:pii,scope:per-agent,detection:aggregate,surface:write-file")
+@reject_message("File write blocked: PII was detected earlier in this session and unverified agents cannot persist files.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"write_file",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
+    context has session_pii_detected && context.session_pii_detected == true
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Secrets containment
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.multi-agent-secrets-lockdown")
+@name("Block sensitive tools after secrets in session")
+@description("Blocks call_tool when agent_trust_level is not \"first_party\", session_secrets_detected is true, and tool_is_sensitive is true.")
+@severity("critical")
+@tags("category:agent-identity,threat:secrets,scope:per-agent,detection:aggregate,surface:call-tool")
+@reject_message("Tool execution blocked: secrets were detected earlier in this session and non-first-party agents cannot call sensitive tools afterwards.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
+    context has session_secrets_detected && context.session_secrets_detected == true &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+};
+
+// ---------------------------------------------------------------------------
+// Section 3: Injection escalation
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.multi-agent-post-injection-lockdown")
+@name("Block unverified agents after injection in session")
+@description("Blocks call_tool when agent_trust_level is \"unverified\" and session_injection_detected is true.")
+@severity("critical")
+@tags("category:agent-identity,threat:injection,scope:per-agent,detection:aggregate,surface:call-tool")
+@reject_message("Tool execution blocked: injection was detected earlier in this session — unverified agents cannot continue.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
+    context has session_injection_detected && context.session_injection_detected == true
+};
+
+@id("agent-identity.multi-agent-post-command-injection-shell")
+@name("Block shell after command injection in session")
+@description("Blocks call_tool when session_command_injection is true and tool_name is a shell tool.")
+@severity("critical")
+@tags("category:agent-identity,threat:command-injection,scope:per-agent,detection:aggregate,surface:call-tool,mitre:t1059")
+@reject_message("Tool execution blocked: command injection was detected earlier in this session — no agent may execute shell commands afterwards.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has session_command_injection && context.session_command_injection == true &&
+    context has tool_name &&
+    (context.tool_name == "shell" || context.tool_name == "execute_command" || context.tool_name == "bash")
+};
+
+// ---------------------------------------------------------------------------
+// Section 4: Cumulative risk circuit breakers
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.multi-agent-high-cumulative-risk")
+@name("Block non-first-party sensitive tools at cumulative risk")
+@description("Blocks call_tool when agent_trust_level is not \"first_party\", session_cumulative_risk_score >= 201, and tool_is_sensitive is true.")
+@severity("high")
+@tags("category:agent-identity,scope:per-agent,detection:aggregate,surface:call-tool,posture:catch-all")
+@reject_message("Tool execution blocked: cumulative session risk exceeded the multi-agent threshold for sensitive tools.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
+    context has session_cumulative_risk_score && context.session_cumulative_risk_score >= 201 &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+};
+
+@id("agent-identity.multi-agent-extreme-risk-lockdown")
+@name("Block unverified agents at extreme cumulative risk")
+@description("Blocks call_tool when agent_trust_level is \"unverified\" and session_cumulative_risk_score >= 501 or session_threat_turns >= 6.")
+@severity("critical")
+@tags("category:agent-identity,scope:per-agent,detection:aggregate,surface:call-tool,posture:catch-all")
+@reject_message("Tool execution blocked: this session has accumulated extreme risk — unverified agents are locked out.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
+    (
+        (context has session_cumulative_risk_score && context.session_cumulative_risk_score >= 501) ||
+        (context has session_threat_turns && context.session_threat_turns >= 6)
+    )
+};

package/_schemas/agent_ops/templates/ported/agent-security/agent_identity_multi_agent_trust.cedar

@@ -0,0 +1,143 @@
+// =============================================================================
+// Multi-Agent Orchestration — Agent Trust
+// =============================================================================
+// Production-grade trust policies for multi-agent systems where an
+// orchestrator coordinates sub-agents with varying trust levels. Enforces
+// least-privilege access: each agent gets only the permissions its trust
+// level and type warrant.
+//
+// Context keys consumed:
+//   - agent_id, agent_type, agent_trust_level, agent_framework, agent_publisher
+//   - tool_name, tool_category, tool_is_sensitive, tool_risk_score
+//   - mcp_server_verified
+//   - injection_score, jailbreak_score
+//
+// Compliance:
+//   - OWASP LLM01, LLM08; OWASP ASI03, ASI05
+//
+// Category:  agent-identity
+// Namespace: AgentOps
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: Tiered tool access
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.multi-agent-block-non-first-party-dangerous")
+@name("Block non-first-party agents from dangerous tools")
+@description("Blocks call_tool when agent_trust_level is not \"first_party\" and tool_category is \"dangerous\".")
+@severity("critical")
+@tags("category:agent-identity,scope:per-agent,detection:rule,surface:call-tool")
+@reject_message("Tool execution blocked: dangerous tools are restricted to first-party agents.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
+    context has tool_category && context.tool_category == "dangerous"
+};
+
+@id("agent-identity.multi-agent-block-unverified-sensitive")
+@name("Block unverified agents from sensitive tools")
+@description("Blocks call_tool when agent_trust_level is \"unverified\" and tool_is_sensitive is true.")
+@severity("high")
+@tags("category:agent-identity,scope:per-agent,detection:rule,surface:call-tool")
+@reject_message("Tool execution blocked: unverified agents may only use tools classified as safe.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+};
+
+@id("agent-identity.multi-agent-block-unverified-mcp")
+@name("Block unverified agents on unverified MCP servers")
+@description("Blocks call_tool when agent_trust_level is \"unverified\" and mcp_server_verified is false.")
+@severity("critical")
+@tags("category:agent-identity,threat:supply-chain,scope:per-agent,detection:rule,surface:call-tool")
+@reject_message("Tool execution blocked: unverified agents cannot use unverified MCP servers — supply-chain risk too high.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
+    context has mcp_server_verified && context.mcp_server_verified == false
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Autonomous-agent safeguards
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.multi-agent-cap-autonomous-tool-risk")
+@name("Block high-risk tools for autonomous agents")
+@description("Blocks call_tool when agent_type is \"autonomous\" and tool_risk_score >= 71.")
+@severity("high")
+@tags("category:agent-identity,scope:per-agent,detection:aggregate,surface:call-tool")
+@reject_message("Tool execution blocked: autonomous agents require human oversight for high-risk tools.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_type && context.agent_type == "autonomous" &&
+    context has tool_risk_score && context.tool_risk_score >= 71
+};
+
+@id("agent-identity.multi-agent-autonomous-injection")
+@name("Block injection on autonomous agents (stricter)")
+@description("Blocks process_prompt when agent_type is \"autonomous\" and injection_score >= 51.")
+@severity("high")
+@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,owasp:llm01")
+@reject_message("Prompt blocked: lower injection threshold applies to autonomous agents and was exceeded.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    context has agent_type && context.agent_type == "autonomous" &&
+    context has injection_score && context.injection_score >= 51
+};
+
+@id("agent-identity.multi-agent-autonomous-jailbreak")
+@name("Block jailbreak on autonomous agents (stricter)")
+@description("Blocks process_prompt when agent_type is \"autonomous\" and jailbreak_score >= 51.")
+@severity("high")
+@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,owasp:llm02")
+@reject_message("Prompt blocked: lower jailbreak threshold applies to autonomous agents and was exceeded.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    context has agent_type && context.agent_type == "autonomous" &&
+    context has jailbreak_score && context.jailbreak_score >= 51
+};
+
+// ---------------------------------------------------------------------------
+// Section 3: MCP server-connection trust
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.multi-agent-block-unverified-server-connect")
+@name("Block unverified agents from connecting to MCP servers")
+@description("Blocks connect_server when agent_trust_level is \"unverified\".")
+@severity("high")
+@tags("category:agent-identity,threat:supply-chain,scope:per-agent,detection:rule,surface:connect-server")
+@reject_message("MCP server connection blocked: unverified agents cannot establish new server connections.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"connect_server",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level == "unverified"
+};

package/_schemas/agent_ops/templates/ported/agent-security/agent_security_data_pipeline.cedar

@@ -0,0 +1,45 @@
+// =============================================================================
+// Data Pipeline — Agentic Security
+// =============================================================================
+// Exfiltration prevention and tool risk controls for data pipelines.
+//
+// Context keys consumed:
+//   - suspicious_pattern: Bool
+//   - pattern_type:       String
+//   - tool_risk_score:    Long (0-100)
+//
+// Category:  agent-security
+// Namespace: AgentOps
+// =============================================================================
+
+@id("agent-security.data-pipeline-block-exfiltration")
+@name("Block data exfiltration (data-pipeline profile)")
+@description("Blocks call_tool when suspicious_pattern is true and pattern_type matches an exfiltration class.")
+@severity("critical")
+@tags("category:agent-security,threat:exfiltration,detection:rule,surface:call-tool")
+@reject_message("Tool execution blocked: data exfiltration pattern detected in a data pipeline.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has suspicious_pattern && context.suspicious_pattern == true &&
+    context has pattern_type &&
+    (context.pattern_type == "data_exfiltration" || context.pattern_type == "db_exfiltration")
+};
+
+@id("agent-security.data-pipeline-block-high-risk-tools")
+@name("Block high-risk tools (data-pipeline profile)")
+@description("Blocks call_tool when tool_risk_score >= 61.")
+@severity("high")
+@tags("category:agent-security,detection:aggregate,surface:call-tool,owasp:llm06")
+@reject_message("Tool execution blocked: elevated tool risk in a data pipeline.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has tool_risk_score && context.tool_risk_score >= 61
+};

package/_schemas/agent_ops/templates/ported/agent-security/agent_security_defaults.cedar

@@ -0,0 +1,164 @@
+// =============================================================================
+// Agentic Safety (Default)
+// =============================================================================
+// Blocks suspicious agentic behaviour patterns: tool-call loops, data
+// exfiltration sequences, budget overruns, plus MCP supply-chain risks
+// (tool poisoning, rug pull, risky MCP configs).
+//
+// Context keys consumed:
+//   - loop_detected:         Bool
+//   - loop_count:            Long
+//   - suspicious_pattern:    Bool
+//   - pattern_type:          String
+//   - sequence_risk:         Long (0-100)
+//   - budget_exceeded:       Bool
+//   - budget_remaining_pct:  Long (0-100)
+//   - tool_poisoning_score:  Long (0-100)
+//   - rug_pull_detected:     Bool
+//   - rug_pull_score:        Long (0-100)
+//   - mcp_config_risk:       Bool
+//   - mcp_risk_score:        Long (0-100)
+//
+// Compliance:
+//   - OWASP LLM06, OWASP ASI01, OWASP ASI04
+//
+// Category:  agent-security
+// Namespace: AgentOps
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: Loops, exfiltration, budget
+// ---------------------------------------------------------------------------
+
+@id("agent-security.block-loops")
+@name("Block tool call loops")
+@description("Blocks call_tool when loop_detected is true and loop_count >= 4.")
+@severity("high")
+@tags("category:agent-security,threat:loop,detection:aggregate,surface:call-tool")
+@reject_message("Tool execution blocked: an infinite tool-call loop was detected.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has loop_detected && context.loop_detected == true &&
+    context has loop_count && context.loop_count >= 4
+};
+
+@id("agent-security.block-exfiltration")
+@name("Block data exfiltration patterns")
+@description("Blocks call_tool when suspicious_pattern is true and pattern_type matches an exfiltration class.")
+@severity("critical")
+@tags("category:agent-security,threat:exfiltration,detection:rule,surface:call-tool")
+@reject_message("Tool execution blocked: suspicious action sequence consistent with data exfiltration.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has suspicious_pattern && context.suspicious_pattern == true &&
+    context has pattern_type &&
+    (
+        context.pattern_type == "data_exfiltration" ||
+        context.pattern_type == "secret_exfiltration" ||
+        context.pattern_type == "db_exfiltration"
+    )
+};
+
+@id("agent-security.block-sequence-risk")
+@name("Block high-risk action sequences")
+@description("Blocks call_tool when sequence_risk >= 81.")
+@severity("high")
+@tags("category:agent-security,detection:aggregate,surface:call-tool")
+@reject_message("Tool execution blocked: action sequence scored a high cumulative risk.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has sequence_risk && context.sequence_risk >= 81
+};
+
+@id("agent-security.block-budget-exceeded")
+@name("Block on budget exceeded")
+@description("Blocks call_tool when budget_exceeded is true.")
+@severity("medium")
+@tags("category:agent-security,threat:budget-violation,detection:rule,surface:call-tool")
+@reject_message("Tool execution blocked: the agent has exhausted its token or cost budget.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has budget_exceeded && context.budget_exceeded == true
+};
+
+@id("agent-security.block-budget-low")
+@name("Block when budget critically low")
+@description("Blocks call_tool when budget_remaining_pct <= 4.")
+@severity("medium")
+@tags("category:agent-security,threat:budget-violation,detection:rule,surface:call-tool")
+@reject_message("Tool execution blocked: remaining budget is below the critical threshold.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has budget_remaining_pct && context.budget_remaining_pct <= 4
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: MCP supply chain
+// ---------------------------------------------------------------------------
+
+@id("agent-security.block-tool-poisoning")
+@name("Block tool poisoning")
+@description("Blocks call_tool and connect_server when tool_poisoning_score >= 70.")
+@severity("critical")
+@tags("category:agent-security,threat:tool-poisoning,detection:ml,owasp:asi01")
+@reject_message("Tool execution blocked: hidden manipulation instructions detected in tool description or arguments (OWASP ASI01).")
+forbid (
+    principal,
+    action in [AgentOps::Action::"call_tool", AgentOps::Action::"connect_server"],
+    resource
+)
+when {
+    context has tool_poisoning_score && context.tool_poisoning_score >= 70
+};
+
+@id("agent-security.block-rug-pull")
+@name("Block rug pull attacks")
+@description("Blocks call_tool when rug_pull_detected is true and rug_pull_score >= 70.")
+@severity("high")
+@tags("category:agent-security,threat:rug-pull,detection:ml,owasp:asi04")
+@reject_message("Tool execution blocked: tool behavior has drifted significantly from its established pattern.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has rug_pull_detected && context.rug_pull_detected == true &&
+    context has rug_pull_score && context.rug_pull_score >= 70
+};
+
+@id("agent-security.block-mcp-config-risk")
+@name("Block risky MCP server configs")
+@description("Blocks call_tool and connect_server when mcp_config_risk is true and mcp_risk_score >= 70.")
+@severity("high")
+@tags("category:agent-security,threat:mcp-config-risk,detection:ml,owasp:asi04")
+@reject_message("MCP operation blocked: risky server configuration detected.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"call_tool", AgentOps::Action::"connect_server"],
+    resource
+)
+when {
+    context has mcp_config_risk && context.mcp_config_risk == true &&
+    context has mcp_risk_score && context.mcp_risk_score >= 70
+};

package/_schemas/agent_ops/templates/ported/agent-security/agent_security_malicious_package.cedar

@@ -0,0 +1,59 @@
+// =============================================================================
+// Malicious Package (Default)
+// =============================================================================
+// Blocks tool calls that install or download packages flagged as malicious
+// by the osv.dev database (OpenSSF MAL- advisories). The malicious_package
+// detector (Shield, Tier Slow) parses package-manager invocations (pip, npm,
+// yarn, pnpm, bun, uv, gem, cargo, go, composer) out of tool-call arguments
+// and checks each referenced package against the OSV batch API.
+//
+// Context keys consumed:
+//   - malicious_package_detected: Bool
+//   - package_install_detected:   Bool
+//   - package_check_status:       String ("" | "degraded")
+//
+// Compliance:
+//   - OWASP LLM03 (Supply Chain), OWASP ASI02
+//
+// Category:  agent-security
+// Namespace: AgentOps
+// =============================================================================
+
+@id("agent-security.block-malicious-package")
+@name("Block malicious package installs")
+@description("Blocks call_tool when a referenced package carries a known-malicious osv.dev (MAL-) advisory.")
+@severity("critical")
+@tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:llm03,owasp:asi02")
+@reject_message("Package install blocked: the requested package is flagged as malicious in the osv.dev database.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has malicious_package_detected &&
+    context.malicious_package_detected == true
+};
+
+// Alternative (fail-closed): the detector fails OPEN by design — when the
+// OSV lookup is unavailable, installs proceed with package_check_status set
+// to "degraded". Uncomment to block package installs whenever they cannot be
+// verified, trading install availability for supply-chain certainty.
+//
+// @id("agent-security.block-unverified-package")
+// @name("Block unverified package installs")
+// @description("Blocks call_tool package installs when the malicious-package lookup is degraded.")
+// @severity("medium")
+// @tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:llm03")
+// @reject_message("Package install blocked: the package could not be verified against the malicious-package database.")
+// forbid (
+//     principal,
+//     action == AgentOps::Action::"call_tool",
+//     resource
+// )
+// when {
+//     context has package_install_detected &&
+//     context.package_install_detected == true &&
+//     context has package_check_status &&
+//     context.package_check_status == "degraded"
+// };