@highflame/policy 2.2.29 → 2.2.32

package/_schemas/agent_ops/templates/ported/agent-security/agent_security_param_validation.cedar

@@ -0,0 +1,119 @@
+// =============================================================================
+// Action Parameter Validation  (AARM R3 / CAP-ENF-007)
+// =============================================================================
+// Validates the structured arguments of a tool call. Shield projects well-known,
+// safety-relevant tool-call arguments into `context.action_params` (each value
+// coerced to its declared type), so policies can enforce parameter constraints by
+//   - type:       deny when an argument failed type coercion (param_type_violation)
+//   - range:      numeric bounds on a parameter (e.g. amount, count)
+//   - pattern:    Cedar `like` glob on a string parameter (e.g. path, url)
+//   - allowlist:  permit only an approved set of values
+//   - blocklist:  deny a set of dangerous values
+//
+// These are EXAMPLES — customize the thresholds, patterns, and allow/block lists
+// for your tenant. Not auto-deployed.
+//
+// Context keys consumed:
+//   - action_params:        { amount, count, command, path, url, recipient, target, query }
+//   - param_type_violation: Bool
+//
+// Category:  agent-security
+// Namespace: AgentOps
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// type — deny when any projected argument failed type coercion
+// ---------------------------------------------------------------------------
+@id("agent-security.param-type-violation")
+@name("Deny tool calls with mistyped parameters")
+@description("Denies call_tool when any projected argument was present but failed type coercion (e.g. a non-numeric amount).")
+@severity("high")
+@tags("category:agent-security,surface:call-tool,aarm:r3,check:type,posture:deny-default")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has param_type_violation && context.param_type_violation
+};
+
+// ---------------------------------------------------------------------------
+// range — numeric bound on a parameter
+// ---------------------------------------------------------------------------
+@id("agent-security.param-amount-range")
+@name("Deny tool calls exceeding the amount limit")
+@description("Range check: denies call_tool when action_params.amount exceeds 10000.")
+@severity("high")
+@tags("category:agent-security,surface:call-tool,aarm:r3,check:range,posture:deny-default")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has action_params &&
+    context.action_params has amount &&
+    context.action_params.amount > 10000
+};
+
+// ---------------------------------------------------------------------------
+// blocklist — deny a set of dangerous command values
+// ---------------------------------------------------------------------------
+@id("agent-security.param-command-blocklist")
+@name("Block dangerous shell commands by parameter")
+@description("Blocklist check: denies call_tool when action_params.command is a destructive command.")
+@severity("critical")
+@tags("category:agent-security,surface:call-tool,aarm:r3,check:blocklist,posture:deny-default")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has action_params &&
+    context.action_params has command &&
+    (
+        context.action_params.command like "*rm -rf*" ||
+        context.action_params.command like "*shutdown*" ||
+        context.action_params.command like "*mkfs*"
+    )
+};
+
+// ---------------------------------------------------------------------------
+// pattern — Cedar `like` glob on a string parameter
+// ---------------------------------------------------------------------------
+@id("agent-security.param-path-pattern")
+@name("Restrict file paths by pattern")
+@description("Pattern check: denies call_tool when action_params.path is outside the /workspace/ tree.")
+@severity("high")
+@tags("category:agent-security,surface:call-tool,aarm:r3,check:pattern,posture:deny-default")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has action_params &&
+    context.action_params has path &&
+    !(context.action_params.path like "/workspace/*")
+};
+
+// ---------------------------------------------------------------------------
+// allowlist — permit only an approved set of recipient values
+// ---------------------------------------------------------------------------
+@id("agent-security.param-recipient-allowlist")
+@name("Allow payouts only to approved recipients")
+@description("Allowlist check: denies call_tool when action_params.recipient is not in the approved set.")
+@severity("high")
+@tags("category:agent-security,surface:call-tool,aarm:r3,check:allowlist,posture:deny-default")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has action_params &&
+    context.action_params has recipient &&
+    !(["treasury@example.com", "payroll@example.com"].contains(context.action_params.recipient))
+};

package/_schemas/agent_ops/templates/ported/agent-security/agent_security_tool_risk.cedar

@@ -0,0 +1,66 @@
+// =============================================================================
+// Tool Risk (Default)
+// =============================================================================
+// Blocks dangerous tool calls based on risk scoring, tool classification,
+// and well-known dangerous tool names (shell, execute_command).
+//
+// Context keys consumed:
+//   - tool_name:         String
+//   - tool_risk_score:   Long (0-100)
+//   - tool_is_sensitive: Bool
+//   - tool_category:     String ("safe" | "sensitive" | "dangerous")
+//
+// Compliance:
+//   - OWASP LLM06, OWASP ASI02
+//
+// Category:  agent-security
+// Namespace: AgentOps
+// =============================================================================
+
+@id("agent-security.block-dangerous-tool")
+@name("Block dangerous tools")
+@description("Blocks call_tool when tool_risk_score >= 86 or tool_category equals \"dangerous\".")
+@severity("critical")
+@tags("category:agent-security,detection:aggregate,surface:call-tool,owasp:llm06,owasp:asi02")
+@reject_message("Tool execution blocked: tool is classified as dangerous or scored a high risk.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    (context has tool_risk_score && context.tool_risk_score >= 86) ||
+    (context has tool_category && context.tool_category == "dangerous")
+};
+
+@id("agent-security.block-shell-commands")
+@name("Block shell command execution")
+@description("Blocks call_tool when tool_name equals \"shell\" or \"execute_command\".")
+@severity("high")
+@tags("category:agent-security,threat:command-injection,detection:rule,surface:call-tool,mitre:t1059")
+@reject_message("Tool execution blocked: direct shell or command execution is not permitted.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has tool_name &&
+    (context.tool_name == "shell" || context.tool_name == "execute_command")
+};
+
+@id("agent-security.block-sensitive-high-risk")
+@name("Block sensitive high-risk tools")
+@description("Blocks call_tool when tool_is_sensitive is true and tool_risk_score >= 71.")
+@severity("high")
+@tags("category:agent-security,detection:aggregate,surface:call-tool,owasp:llm06")
+@reject_message("Tool execution blocked: a sensitive tool was called with elevated risk score.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has tool_is_sensitive && context.tool_is_sensitive == true &&
+    context has tool_risk_score && context.tool_risk_score >= 71
+};

package/_schemas/agent_ops/templates/ported/code-security/agent_identity_a2a_supply_chain.cedar

@@ -0,0 +1,101 @@
+// =============================================================================
+// A2A Security — Supply Chain & Behavioural Drift
+// =============================================================================
+// Blocks supply-chain attacks specific to agent-to-agent ecosystems: tool
+// poisoning from external agent tool chains, rug pull behavioural drift,
+// and multi-step credential theft.
+//
+// Context keys consumed:
+//   - agent_id, agent_trust_level
+//   - tool_poisoning_detected, tool_poisoning_score
+//   - rug_pull_detected, rug_pull_score
+//   - suspicious_pattern, pattern_type
+//
+// Compliance:
+//   - OWASP ASI04, OWASP MCP01/MCP03
+//   - MITRE ATT&CK T1552; MITRE ATLAS AML.T0049
+//   - NIST 800-53 SI-7
+//
+// Category:  agent-identity
+// Namespace: AgentOps
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: Tool poisoning
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.a2a-block-tool-poisoning")
+@name("Block tool poisoning from non-first-party agents")
+@description("Blocks call_tool when agent_trust_level is not \"first_party\", tool_poisoning_detected is true, and tool_poisoning_score >= 60.")
+@severity("critical")
+@tags("category:agent-identity,threat:tool-poisoning,scope:per-agent,detection:ml,surface:call-tool,owasp:asi04")
+@reject_message("Tool execution blocked: tool poisoning detected in content from a non-first-party agent — supply-chain risk.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
+    context has tool_poisoning_detected && context.tool_poisoning_detected == true &&
+    context has tool_poisoning_score && context.tool_poisoning_score >= 60
+};
+
+@id("agent-identity.a2a-block-server-poisoning")
+@name("Block poisoned server connections from agents")
+@description("Blocks connect_server when agent_id is non-empty, tool_poisoning_detected is true, and tool_poisoning_score >= 55.")
+@severity("critical")
+@tags("category:agent-identity,threat:tool-poisoning,scope:per-agent,detection:ml,surface:connect-server,owasp:asi04")
+@reject_message("MCP server connection blocked: tool poisoning detected from agent request — server-level poisoning affects all tools.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"connect_server",
+    resource
+)
+when {
+    context has agent_id && context.agent_id != "" &&
+    context has tool_poisoning_detected && context.tool_poisoning_detected == true &&
+    context has tool_poisoning_score && context.tool_poisoning_score >= 55
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Rug pull behavioural drift
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.a2a-block-rug-pull")
+@name("Block rug pull behavioural drift from agents")
+@description("Blocks call_tool when agent_id is non-empty, rug_pull_detected is true, and rug_pull_score >= 70.")
+@severity("critical")
+@tags("category:agent-identity,threat:rug-pull,scope:per-agent,detection:ml,surface:call-tool,owasp:asi04")
+@reject_message("Tool execution blocked: behavioural drift detected — tool behaviour has deviated from established patterns.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_id && context.agent_id != "" &&
+    context has rug_pull_detected && context.rug_pull_detected == true &&
+    context has rug_pull_score && context.rug_pull_score >= 70
+};
+
+// ---------------------------------------------------------------------------
+// Section 3: Credential theft chains
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.a2a-block-credential-theft")
+@name("Block credential theft chains from agents")
+@description("Blocks call_tool when agent_trust_level is not \"first_party\", suspicious_pattern is true, and pattern_type equals \"credential_theft\".")
+@severity("critical")
+@tags("category:agent-identity,threat:exfiltration,scope:per-agent,detection:rule,surface:call-tool")
+@reject_message("Tool execution blocked: credential theft chain detected from a non-first-party agent — multi-step credential harvesting.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
+    context has suspicious_pattern && context.suspicious_pattern == true &&
+    context has pattern_type && context.pattern_type == "credential_theft"
+};

package/_schemas/agent_ops/templates/ported/code-security/agent_security_code_agent.cedar

@@ -0,0 +1,130 @@
+// =============================================================================
+// Code Agent — Agentic Security
+// =============================================================================
+// Tool risk controls, shell execution blocking, loop detection, exfiltration
+// prevention, and budget enforcement for coding assistants.
+//
+// Context keys consumed:
+//   - tool_risk_score, tool_category, tool_is_sensitive, tool_name
+//   - loop_detected, loop_count
+//   - suspicious_pattern, pattern_type
+//   - sequence_risk:    Long (0-100)
+//   - budget_exceeded:  Bool
+//
+// Compliance:
+//   - OWASP LLM06, OWASP ASI02, MITRE T1059
+//
+// Category:  agent-security
+// Namespace: AgentOps
+// =============================================================================
+
+@id("agent-security.code-block-dangerous-tools")
+@name("Block dangerous tools (code profile)")
+@description("Blocks call_tool when tool_risk_score >= 86 or tool_category equals \"dangerous\".")
+@severity("critical")
+@tags("category:agent-security,detection:aggregate,surface:call-tool,owasp:llm06")
+@reject_message("Tool execution blocked: tool is classified as dangerous or scored high risk (code profile).")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    (context has tool_risk_score && context.tool_risk_score >= 86) ||
+    (context has tool_category && context.tool_category == "dangerous")
+};
+
+@id("agent-security.code-block-shell-execution")
+@name("Block shell commands (code profile)")
+@description("Blocks call_tool when tool_name is a shell tool.")
+@severity("high")
+@tags("category:agent-security,threat:command-injection,detection:rule,surface:call-tool,mitre:t1059")
+@reject_message("Tool execution blocked: direct shell or command execution is not permitted for the code profile.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has tool_name &&
+    (context.tool_name == "shell" || context.tool_name == "execute_command" || context.tool_name == "bash")
+};
+
+@id("agent-security.code-block-sensitive-tools")
+@name("Block sensitive tools with elevated risk (code profile)")
+@description("Blocks call_tool when tool_is_sensitive is true and tool_risk_score >= 71.")
+@severity("high")
+@tags("category:agent-security,detection:aggregate,surface:call-tool,owasp:llm06")
+@reject_message("Tool execution blocked: sensitive tool with elevated risk (code profile).")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has tool_is_sensitive && context.tool_is_sensitive == true &&
+    context has tool_risk_score && context.tool_risk_score >= 71
+};
+
+@id("agent-security.code-block-loops")
+@name("Block tool call loops (code profile)")
+@description("Blocks call_tool when loop_detected is true and loop_count >= 6.")
+@severity("high")
+@tags("category:agent-security,threat:loop,detection:aggregate,surface:call-tool")
+@reject_message("Tool execution blocked: infinite tool-call loop detected (code profile).")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has loop_detected && context.loop_detected == true &&
+    context has loop_count && context.loop_count >= 6
+};
+
+@id("agent-security.code-block-exfiltration")
+@name("Block data exfiltration patterns (code profile)")
+@description("Blocks call_tool when suspicious_pattern is true and pattern_type matches an exfiltration class.")
+@severity("critical")
+@tags("category:agent-security,threat:exfiltration,detection:rule,surface:call-tool")
+@reject_message("Tool execution blocked: data exfiltration pattern detected (code profile).")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has suspicious_pattern && context.suspicious_pattern == true &&
+    context has pattern_type &&
+    (context.pattern_type == "data_exfiltration" || context.pattern_type == "secret_exfiltration")
+};
+
+@id("agent-security.code-block-sequence-risk")
+@name("Block high-risk action sequences (code profile)")
+@description("Blocks call_tool when sequence_risk >= 76.")
+@severity("high")
+@tags("category:agent-security,detection:aggregate,surface:call-tool")
+@reject_message("Tool execution blocked: action sequence scored a high cumulative risk (code profile).")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has sequence_risk && context.sequence_risk >= 76
+};
+
+@id("agent-security.code-block-budget-exceeded")
+@name("Block when budget exceeded (code profile)")
+@description("Blocks call_tool when budget_exceeded is true.")
+@severity("medium")
+@tags("category:agent-security,threat:budget-violation,detection:rule,surface:call-tool")
+@reject_message("Tool execution blocked: agent has exhausted its token or cost budget (code profile).")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has budget_exceeded && context.budget_exceeded == true
+};

package/_schemas/agent_ops/templates/ported/code-security/agent_security_code_agent_supply_chain.cedar

@@ -0,0 +1,116 @@
+// =============================================================================
+// Code Agent — Supply Chain Security
+// =============================================================================
+// Detects and blocks MCP server poisoning, indirect prompt injection from
+// tool outputs, credential theft chains, destructive operation sequences,
+// and installs of packages with known-malicious (MAL-) osv.dev advisories.
+//
+// Context keys consumed:
+//   - tool_poisoning_score:       Long (0-100)
+//   - indirect_injection_score:   Long (0-100)
+//   - tool_is_sensitive:          Bool
+//   - suspicious_pattern:         Bool
+//   - pattern_type:               String
+//   - malicious_package_detected: Bool
+//
+// Compliance:
+//   - OWASP ASI01, ASI02, ASI04, LLM01 (indirect), MCP01–05
+//   - MITRE ATLAS AML.T0051, MITRE ATT&CK T1552
+//
+// Category:  agent-security
+// Namespace: AgentOps
+// =============================================================================
+
+@id("agent-security.code-block-server-poisoning")
+@name("Block poisoned MCP servers (code profile)")
+@description("Blocks connect_server when tool_poisoning_score >= 60.")
+@severity("critical")
+@tags("category:agent-security,threat:tool-poisoning,detection:ml,surface:connect-server,owasp:asi04")
+@reject_message("MCP server connection blocked: tool poisoning patterns detected in server tool descriptions.")
+forbid (
+    principal,
+    action == AgentOps::Action::"connect_server",
+    resource
+)
+when {
+    context has tool_poisoning_score && context.tool_poisoning_score >= 60
+};
+
+@id("agent-security.code-block-indirect-injection")
+@name("Block indirect injection (code profile)")
+@description("Blocks call_tool when indirect_injection_score >= 70.")
+@severity("critical")
+@tags("category:agent-security,threat:indirect-injection,detection:ml,surface:call-tool,owasp:llm01,owasp:asi01")
+@reject_message("Content blocked: indirect prompt injection detected in tool output or retrieved content.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has indirect_injection_score && context.indirect_injection_score >= 70
+};
+
+@id("agent-security.code-block-indirect-injection-sensitive")
+@name("Block indirect injection on sensitive tools (code profile)")
+@description("Blocks call_tool when indirect_injection_score >= 50 and tool_is_sensitive is true.")
+@severity("critical")
+@tags("category:agent-security,threat:indirect-injection,detection:ml,surface:call-tool,owasp:asi02")
+@reject_message("Sensitive tool execution blocked: moderate indirect-injection risk detected (code profile).")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has indirect_injection_score && context.indirect_injection_score >= 50 &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+};
+
+@id("agent-security.code-block-credential-theft")
+@name("Block credential theft chains (code profile)")
+@description("Blocks call_tool when suspicious_pattern is true and pattern_type equals \"credential_theft\".")
+@severity("critical")
+@tags("category:agent-security,threat:exfiltration,detection:rule,surface:call-tool,mitre:t1059")
+@reject_message("Tool execution blocked: credential theft chain detected — multi-step credential harvesting pattern.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has suspicious_pattern && context.suspicious_pattern == true &&
+    context has pattern_type && context.pattern_type == "credential_theft"
+};
+
+@id("agent-security.code-block-destructive-sequence")
+@name("Block destructive operation sequences (code profile)")
+@description("Blocks call_tool when suspicious_pattern is true and pattern_type equals \"destructive_sequence\".")
+@severity("critical")
+@tags("category:agent-security,detection:rule,surface:call-tool,owasp:asi02")
+@reject_message("Tool execution blocked: destructive operation sequence detected — bulk deletions, config overwrites, or repo manipulation.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has suspicious_pattern && context.suspicious_pattern == true &&
+    context has pattern_type && context.pattern_type == "destructive_sequence"
+};
+
+@id("agent-security.code-block-malicious-package")
+@name("Block malicious package installs (code profile)")
+@description("Blocks call_tool when a referenced package carries a known-malicious osv.dev (MAL-) advisory.")
+@severity("critical")
+@tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:llm03,owasp:asi02")
+@reject_message("Package install blocked: the requested package is flagged as malicious in the osv.dev database.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has malicious_package_detected &&
+    context.malicious_package_detected == true
+};

package/_schemas/agent_ops/templates/ported/code-security/security_code_agent_encoding.cedar

@@ -0,0 +1,51 @@
+// =============================================================================
+// Code Agent — Encoding & Unicode Attack Protection
+// =============================================================================
+// Blocks invisible Unicode characters in tool arguments and file writes to
+// prevent encoding-based prompt injection and persistent invisible payloads.
+//
+// Tool arguments and file content should be plain text — invisible characters
+// (zero-width joiners, bidirectional overrides, tag characters) indicate
+// payload injection or encoding evasion attempts.
+//
+// Ref: EchoLeak CVE-2025-32711, Rules File Backdoor (Pillar Security)
+//
+// Context keys consumed:
+//   - invisible_chars_detected: Bool
+//
+// Compliance:
+//   - OWASP LLM01 (encoding evasion), OWASP ASI01, NIST 800-53 SI-10
+//
+// Category:  security
+// Namespace: AgentOps
+// =============================================================================
+
+@id("security.code-block-invisible-tool-args")
+@name("Block invisible characters in tool calls (code profile)")
+@description("Blocks call_tool when invisible_chars_detected is true.")
+@severity("critical")
+@tags("category:security,threat:invisible-chars,threat:injection,detection:pattern,surface:call-tool,owasp:asi01")
+@reject_message("Tool execution blocked: invisible Unicode characters detected in tool arguments — encoding evasion or payload injection.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has invisible_chars_detected && context.invisible_chars_detected == true
+};
+
+@id("security.code-block-invisible-file-write")
+@name("Block invisible characters in file writes (code profile)")
+@description("Blocks write_file when invisible_chars_detected is true.")
+@severity("high")
+@tags("category:security,threat:invisible-chars,detection:pattern,surface:write-file,owasp:asi01")
+@reject_message("File write blocked: invisible Unicode characters detected — persistent invisible payloads can backdoor downstream agents.")
+forbid (
+    principal,
+    action == AgentOps::Action::"write_file",
+    resource
+)
+when {
+    context has invisible_chars_detected && context.invisible_chars_detected == true
+};