@highflame/policy 2.2.29 → 2.2.32

package/_schemas/agent_ops/templates/ported/code-security/security_code_agent_path_security.cedar

@@ -0,0 +1,149 @@
+// =============================================================================
+// Code Agent — Path Security
+// =============================================================================
+// Blocks access to sensitive file paths: environment files, credential files,
+// system directories, and credential/key directories. Also blocks destructive
+// file operations (delete, rmdir, unlink) by default.
+//
+// Context keys consumed:
+//   - path:      String
+//   - tool_name: String
+//
+// Compliance:
+//   - NIST 800-53 AC-6, SC-28; MITRE ATT&CK T1552, T1005; CIS 1.4
+//
+// Category:  security
+// Namespace: AgentOps
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: Environment files (.env*)
+// ---------------------------------------------------------------------------
+
+@id("security.code-block-env-files")
+@name("Block dotenv file access (code profile)")
+@description("Blocks read_file, write_file, and call_tool when path matches *.env*.")
+@severity("high")
+@tags("category:security,threat:secrets,detection:pattern,compliance:nist-si-3")
+@reject_message("File access blocked: .env files commonly contain secrets and API keys — use a secrets manager instead.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"read_file", AgentOps::Action::"write_file", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has path && context.path like "*.env*"
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Credential files
+// ---------------------------------------------------------------------------
+
+@id("security.code-block-credential-files")
+@name("Block credential files (code profile)")
+@description("Blocks read_file, write_file, and call_tool when path matches a common credential file.")
+@severity("high")
+@tags("category:security,threat:secrets,detection:pattern,compliance:nist-si-3")
+@reject_message("File access blocked: .netrc, .npmrc, .pypirc, cloud config, and service-account files commonly contain hardcoded credentials.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"read_file", AgentOps::Action::"write_file", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has path &&
+    (
+        context.path like "*/.netrc" ||
+        context.path like "*/.npmrc" ||
+        context.path like "*/.pypirc" ||
+        context.path like "*/.docker/config.json" ||
+        context.path like "*/.kube/config" ||
+        context.path like "*/.config/gcloud/*" ||
+        context.path like "*/credentials.json" ||
+        context.path like "*/service-account*.json"
+    )
+};
+
+// ---------------------------------------------------------------------------
+// Section 3: System directories
+// ---------------------------------------------------------------------------
+
+@id("security.code-block-system-paths")
+@name("Block system directory access (code profile)")
+@description("Blocks read_file, write_file, and call_tool on /etc, /proc, /sys, /root, /var/log, /var/run paths.")
+@severity("high")
+@tags("category:security,threat:path-traversal,detection:pattern,mitre:t1005")
+@reject_message("File access blocked: sensitive system directory targeted — agents may not access /etc, /proc, /sys, /root, or /var.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"read_file", AgentOps::Action::"write_file", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has path &&
+    (
+        context.path like "/etc/*" ||
+        context.path like "/proc/*" ||
+        context.path like "/sys/*" ||
+        context.path like "/root/*" ||
+        context.path like "/var/log/*" ||
+        context.path like "/var/run/*"
+    )
+};
+
+// ---------------------------------------------------------------------------
+// Section 4: Credential and key directories
+// ---------------------------------------------------------------------------
+
+@id("security.code-block-credential-paths")
+@name("Block credential directories (code profile)")
+@description("Blocks read_file, write_file, and call_tool on .ssh, .aws, .gnupg, .azure, .config/gcloud, .pem, and id_* paths.")
+@severity("critical")
+@tags("category:security,threat:secrets,detection:pattern,compliance:nist-si-3")
+@reject_message("File access blocked: SSH, cloud, or GPG key material targeted — agents must never access authentication material.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"read_file", AgentOps::Action::"write_file", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has path &&
+    (
+        context.path like "*/.ssh/*" ||
+        context.path like "*/.aws/*" ||
+        context.path like "*/.gnupg/*" ||
+        context.path like "*/.config/gcloud/*" ||
+        context.path like "*/.azure/*" ||
+        context.path like "*.pem" ||
+        context.path like "*/id_rsa*" ||
+        context.path like "*/id_ed25519*" ||
+        context.path like "*/id_ecdsa*"
+    )
+};
+
+// ---------------------------------------------------------------------------
+// Section 5: Destructive file operations
+// ---------------------------------------------------------------------------
+
+@id("security.code-block-destructive-ops")
+@name("Block destructive file operations (code profile)")
+@description("Blocks call_tool when tool_name is a destructive file operation.")
+@severity("high")
+@tags("category:security,detection:rule,surface:call-tool,compliance:nist-si-3")
+@reject_message("Tool execution blocked: destructive file operations (delete, rmdir, unlink) require explicit human approval.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has tool_name &&
+    (
+        context.tool_name == "fs.delete" ||
+        context.tool_name == "fs.rmdir" ||
+        context.tool_name == "fs.unlink" ||
+        context.tool_name == "fs.remove" ||
+        context.tool_name == "delete_file" ||
+        context.tool_name == "remove_directory"
+    )
+};

package/_schemas/agent_ops/templates/ported/content-safety/trust_safety_chat_assistant.cedar

@@ -0,0 +1,58 @@
+// =============================================================================
+// Chat Assistant — Trust & Safety
+// =============================================================================
+// Strict content moderation for customer-facing chatbots. Lower toxicity
+// thresholds than defaults plus topic restrictions for public-facing
+// content.
+//
+// Context keys consumed:
+//   - violence_score, hate_speech_score, sexual_score, profanity_score: Long
+//   - content_topics:   Set<String>
+//   - topic_confidence: Long (0-100)
+//
+// Compliance:
+//   - EU AI Act, ISO 42001
+//
+// Category:  trust-safety
+// Namespace: AgentOps
+// =============================================================================
+
+@id("trust-safety.chat-block-toxicity")
+@name("Block toxicity (chat profile)")
+@description("Blocks process_prompt when any toxicity score is >= 71 (lower threshold for public chat).")
+@severity("critical")
+@tags("category:trust-safety,threat:harmful,threat:hate-speech,detection:ml,compliance:eu-ai-act")
+@reject_message("Prompt blocked: toxic content detected at the chat-profile threshold.")
+forbid (
+    principal,
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    (context has violence_score    && context.violence_score    >= 71) ||
+    (context has hate_speech_score && context.hate_speech_score >= 71) ||
+    (context has sexual_score      && context.sexual_score      >= 71) ||
+    (context has profanity_score   && context.profanity_score   >= 71)
+};
+
+@id("trust-safety.chat-block-restricted-topics")
+@name("Block restricted topics (chat profile)")
+@description("Blocks process_prompt and call_tool when topic_confidence >= 71 and content_topics contains a restricted category.")
+@severity("high")
+@tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act")
+@reject_message("Prompt blocked: content discusses a topic restricted for chat assistants.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has topic_confidence && context.topic_confidence >= 71 &&
+    context has content_topics &&
+    (
+        context.content_topics.contains("weapons_manufacturing") ||
+        context.content_topics.contains("illegal_activity") ||
+        context.content_topics.contains("controlled_substances") ||
+        context.content_topics.contains("financial_fraud")
+    )
+};

package/_schemas/agent_ops/templates/ported/content-safety/trust_safety_defaults.cedar

@@ -0,0 +1,111 @@
+// =============================================================================
+// Content Safety (Default)
+// =============================================================================
+// Blocks unsafe content using ML classifier scores: violence, weapons, hate
+// speech, criminal activity, sexual content, and excessive profanity.
+//
+// Thresholds:
+//   - violence, weapons, sexual, crime: >= 80 (critical/high)
+//   - hate_speech: >= 75 (lower threshold, zero tolerance)
+//   - profanity:   >= 90 (higher threshold, allows normal expression)
+//
+// Context keys consumed:
+//   - violence_score, weapons_score, hate_speech_score:  Long (0-100)
+//   - crime_score, sexual_score, profanity_score:        Long (0-100)
+//
+// Compliance:
+//   - NIST 800-53 SI-4; ISO 42001; EU AI Act Art. 52
+//
+// Category:  trust-safety
+// Namespace: AgentOps
+// =============================================================================
+
+@id("trust-safety.block-violence")
+@name("Block violent content")
+@description("Blocks process_prompt and call_tool when violence_score >= 80.")
+@severity("critical")
+@tags("category:trust-safety,threat:violence,detection:ml,compliance:nist-si-4,compliance:iso-42001")
+@reject_message("Content blocked: violent content detected.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has violence_score && context.violence_score >= 80
+};
+
+@id("trust-safety.block-weapons")
+@name("Block weapons content")
+@description("Blocks process_prompt and call_tool when weapons_score >= 80.")
+@severity("critical")
+@tags("category:trust-safety,threat:weapons,detection:ml,compliance:nist-si-4")
+@reject_message("Content blocked: weapons-related content detected (manufacturing, procurement, or specifications).")
+forbid (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has weapons_score && context.weapons_score >= 80
+};
+
+@id("trust-safety.block-hate-speech")
+@name("Block hate speech")
+@description("Blocks process_prompt and call_tool when hate_speech_score >= 75.")
+@severity("critical")
+@tags("category:trust-safety,threat:hate-speech,detection:ml,compliance:nist-si-4,compliance:eu-ai-act")
+@reject_message("Content blocked: hate speech or discriminatory content detected.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has hate_speech_score && context.hate_speech_score >= 75
+};
+
+@id("trust-safety.block-crime")
+@name("Block criminal content")
+@description("Blocks process_prompt and call_tool when crime_score >= 80.")
+@severity("high")
+@tags("category:trust-safety,threat:crime,detection:ml,compliance:nist-si-4")
+@reject_message("Content blocked: criminal activity content detected (illegal activity, fraud, or related).")
+forbid (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has crime_score && context.crime_score >= 80
+};
+
+@id("trust-safety.block-sexual")
+@name("Block sexual content")
+@description("Blocks process_prompt and call_tool when sexual_score >= 80.")
+@severity("high")
+@tags("category:trust-safety,threat:sexual,detection:ml,compliance:eu-ai-act,compliance:iso-42001")
+@reject_message("Content blocked: sexually explicit content detected.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has sexual_score && context.sexual_score >= 80
+};
+
+@id("trust-safety.block-profanity")
+@name("Block excessive profanity")
+@description("Blocks process_prompt and call_tool when profanity_score >= 90.")
+@severity("medium")
+@tags("category:trust-safety,threat:profanity,detection:ml")
+@reject_message("Content blocked: excessive profanity detected — please rephrase in professional language.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has profanity_score && context.profanity_score >= 90
+};

package/_schemas/agent_ops/templates/ported/content-safety/trust_safety_semantic.cedar

@@ -0,0 +1,78 @@
+// =============================================================================
+// Semantic Topic Enforcement (Default)
+// =============================================================================
+// Blocks content based on semantic topic classification — used for
+// application-specific topic restrictions (medical, weapons, illegal
+// activity, etc.).
+//
+// Context keys consumed:
+//   - content_topics:    Set<String>
+//   - topic_confidence:  Long (0-100)
+//
+// Compliance:
+//   - EU AI Act, ISO 42001
+//
+// Category:  trust-safety
+// Namespace: AgentOps
+// =============================================================================
+
+@id("trust-safety.block-dangerous-topics")
+@name("Block dangerous topics")
+@description("Blocks process_prompt when content_topics contains weapons or explosives categories.")
+@severity("critical")
+@tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act")
+@reject_message("Prompt blocked: content classified under a dangerous topic (weapons, explosives, illegal synthesis).")
+forbid (
+    principal,
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    context has content_topics &&
+    (
+        context.content_topics.contains("weapons_manufacturing") ||
+        context.content_topics.contains("explosive_materials") ||
+        context.content_topics.contains("illegal_synthesis")
+    )
+};
+
+@id("trust-safety.block-controlled-substances")
+@name("Block controlled substances")
+@description("Blocks process_prompt when content_topics contains controlled substances or precursor chemicals.")
+@severity("high")
+@tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act")
+@reject_message("Prompt blocked: content discusses controlled substances or precursor chemicals.")
+forbid (
+    principal,
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    context has content_topics &&
+    (
+        context.content_topics.contains("controlled_substances") ||
+        context.content_topics.contains("drug_manufacturing") ||
+        context.content_topics.contains("precursor_chemicals")
+    )
+};
+
+@id("trust-safety.block-restricted-topics")
+@name("Block high-confidence restricted topics")
+@description("Blocks process_prompt when topic_confidence >= 81 and content_topics contains a restricted category.")
+@severity("high")
+@tags("category:trust-safety,threat:harmful,detection:ml")
+@reject_message("Prompt blocked: content high-confidence classified into a restricted topic (illegal activity, fraud, social engineering).")
+forbid (
+    principal,
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    context has topic_confidence && context.topic_confidence >= 81 &&
+    context has content_topics &&
+    (
+        context.content_topics.contains("illegal_activity") ||
+        context.content_topics.contains("financial_fraud") ||
+        context.content_topics.contains("social_engineering")
+    )
+};

package/_schemas/agent_ops/templates/ported/content-safety/trust_safety_toxicity.cedar

@@ -0,0 +1,71 @@
+// =============================================================================
+// Toxicity & Content Moderation (Default)
+// =============================================================================
+// Blocks toxic, harmful, or inappropriate content across the six standard
+// toxicity dimensions. Three rules: a strict critical-threshold catch-all,
+// a hate-speech-specific lower threshold, and a "any two moderate signals"
+// combined-toxicity rule.
+//
+// Context keys consumed:
+//   - violence_score:     Long (0-100)
+//   - hate_speech_score:  Long (0-100)
+//   - sexual_score:       Long (0-100)
+//   - weapons_score:      Long (0-100)
+//   - crime_score:        Long (0-100)
+//   - profanity_score:    Long (0-100)
+//
+// Compliance:
+//   - EU AI Act, ISO 42001, NIST SI-4
+//
+// Category:  trust-safety
+// Namespace: AgentOps
+// =============================================================================
+
+@id("trust-safety.block-toxicity-critical")
+@name("Block critical toxicity")
+@description("Blocks process_prompt when any toxicity score is >= 91.")
+@severity("critical")
+@tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act,compliance:iso-42001")
+@reject_message("Prompt blocked: critical-severity toxic content detected.")
+forbid (
+    principal,
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    (context has violence_score    && context.violence_score    >= 91) ||
+    (context has hate_speech_score && context.hate_speech_score >= 91) ||
+    (context has sexual_score      && context.sexual_score      >= 91) ||
+    (context has weapons_score     && context.weapons_score     >= 91) ||
+    (context has crime_score       && context.crime_score       >= 91) ||
+    (context has profanity_score   && context.profanity_score   >= 91)
+};
+
+@id("trust-safety.block-toxicity-combined")
+@name("Block combined toxicity")
+@description("Blocks process_prompt when any two toxicity scores are >= 61.")
+@severity("high")
+@tags("category:trust-safety,threat:harmful,detection:aggregate")
+@reject_message("Prompt blocked: multiple moderate toxicity signals were detected together.")
+forbid (
+    principal,
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    (context has violence_score    && context has hate_speech_score && context.violence_score    >= 61 && context.hate_speech_score >= 61) ||
+    (context has violence_score    && context has sexual_score      && context.violence_score    >= 61 && context.sexual_score      >= 61) ||
+    (context has violence_score    && context has weapons_score     && context.violence_score    >= 61 && context.weapons_score     >= 61) ||
+    (context has violence_score    && context has crime_score       && context.violence_score    >= 61 && context.crime_score       >= 61) ||
+    (context has violence_score    && context has profanity_score   && context.violence_score    >= 61 && context.profanity_score   >= 61) ||
+    (context has hate_speech_score && context has sexual_score      && context.hate_speech_score >= 61 && context.sexual_score      >= 61) ||
+    (context has hate_speech_score && context has weapons_score     && context.hate_speech_score >= 61 && context.weapons_score     >= 61) ||
+    (context has hate_speech_score && context has crime_score       && context.hate_speech_score >= 61 && context.crime_score       >= 61) ||
+    (context has hate_speech_score && context has profanity_score   && context.hate_speech_score >= 61 && context.profanity_score   >= 61) ||
+    (context has sexual_score      && context has weapons_score     && context.sexual_score      >= 61 && context.weapons_score     >= 61) ||
+    (context has sexual_score      && context has crime_score       && context.sexual_score      >= 61 && context.crime_score       >= 61) ||
+    (context has sexual_score      && context has profanity_score   && context.sexual_score      >= 61 && context.profanity_score   >= 61) ||
+    (context has weapons_score     && context has crime_score       && context.weapons_score     >= 61 && context.crime_score       >= 61) ||
+    (context has weapons_score     && context has profanity_score   && context.weapons_score     >= 61 && context.profanity_score   >= 61) ||
+    (context has crime_score       && context has profanity_score   && context.crime_score       >= 61 && context.profanity_score   >= 61)
+};

package/_schemas/agent_ops/templates/ported/data-protection/data_protection_advanced_secrets.cedar

@@ -0,0 +1,74 @@
+// =============================================================================
+// Advanced Detection — Granular Secrets
+// =============================================================================
+// Blocks specific high-risk credential types using granular secret_types
+// matching. Goes beyond the boolean secrets_detected flag to identify
+// cloud provider keys, GitHub tokens, SSH keys, database credentials,
+// and general API tokens.
+//
+// Context keys consumed:
+//   - secret_types: Set<String>
+//
+// Compliance:
+//   - NIST 800-53 IA-5, SC-28; MITRE ATT&CK T1552; CIS 1.4
+//
+// Category:  data-protection
+// Namespace: AgentOps
+// =============================================================================
+
+@id("data-protection.advanced-block-high-risk-secrets")
+@name("Block high-risk credential types")
+@description("Blocks process_prompt, call_tool, read_file, and write_file when secret_types contains a cloud, GitHub, SSH, or database credential.")
+@severity("critical")
+@tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
+@reject_message("Content blocked: high-risk credentials detected (cloud keys, GitHub tokens, SSH keys, or database URLs).")
+forbid (
+    principal,
+    action in [
+        AgentOps::Action::"process_prompt",
+        AgentOps::Action::"call_tool",
+        AgentOps::Action::"read_file",
+        AgentOps::Action::"write_file"
+    ],
+    resource
+)
+when {
+    context has secret_types &&
+    (
+        context.secret_types.contains("aws_access_key") ||
+        context.secret_types.contains("aws_secret_key") ||
+        context.secret_types.contains("gcp_service_account") ||
+        context.secret_types.contains("azure_client_secret") ||
+        context.secret_types.contains("github_token") ||
+        context.secret_types.contains("github_pat") ||
+        context.secret_types.contains("ssh_private_key") ||
+        context.secret_types.contains("database_url")
+    )
+};
+
+@id("data-protection.advanced-block-api-tokens")
+@name("Block API keys and bearer tokens")
+@description("Blocks process_prompt, call_tool, read_file, and write_file when secret_types contains api_key, bearer_token, jwt_token, or OAuth credentials.")
+@severity("high")
+@tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
+@reject_message("Content blocked: API keys, bearer tokens, or OAuth credentials detected.")
+forbid (
+    principal,
+    action in [
+        AgentOps::Action::"process_prompt",
+        AgentOps::Action::"call_tool",
+        AgentOps::Action::"read_file",
+        AgentOps::Action::"write_file"
+    ],
+    resource
+)
+when {
+    context has secret_types &&
+    (
+        context.secret_types.contains("api_key") ||
+        context.secret_types.contains("bearer_token") ||
+        context.secret_types.contains("jwt_token") ||
+        context.secret_types.contains("oauth_token") ||
+        context.secret_types.contains("oauth_secret")
+    )
+};

package/_schemas/agent_ops/templates/ported/data-protection/data_protection_code_block_write_secrets.cedar

@@ -0,0 +1,26 @@
+// =============================================================================
+// Code Agent — Secrets Protection
+// =============================================================================
+// Prevents code agents from writing detected secrets to output files.
+//
+// Context keys consumed:
+//   - secrets_detected: Bool
+//
+// Category:  data-protection
+// Namespace: AgentOps
+// =============================================================================
+
+@id("data-protection.code-block-write-secrets")
+@name("Block writing secrets to files (code profile)")
+@description("Blocks write_file when secrets_detected is true.")
+@severity("critical")
+@tags("category:data-protection,threat:secrets,detection:rule,surface:write-file,owasp:llm06")
+@reject_message("File write blocked: secrets detected in content — code agents must not persist credentials.")
+forbid (
+    principal,
+    action == AgentOps::Action::"write_file",
+    resource
+)
+when {
+    context has secrets_detected && context.secrets_detected == true
+};

package/_schemas/agent_ops/templates/ported/data-protection/data_protection_data_pipeline.cedar

@@ -0,0 +1,52 @@
+// =============================================================================
+// Data Pipeline — Data Protection (Secrets)
+// =============================================================================
+// Strict secrets detection for data pipelines. Any secret triggers a block;
+// secrets in writes are blocked unconditionally to prevent persistence.
+//
+// Context keys consumed:
+//   - secrets_detected: Bool
+//   - secret_count:     Long
+//
+// Compliance:
+//   - OWASP LLM06
+//
+// Category:  data-protection
+// Namespace: AgentOps
+// =============================================================================
+
+@id("data-protection.data-pipeline-block-secrets")
+@name("Block secrets in data pipeline")
+@description("Blocks process_prompt, call_tool, read_file, and write_file when secrets_detected is true.")
+@severity("critical")
+@tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
+@reject_message("Request blocked: secrets detected in a data pipeline — any credential exposure is unacceptable here.")
+forbid (
+    principal,
+    action in [
+        AgentOps::Action::"process_prompt",
+        AgentOps::Action::"call_tool",
+        AgentOps::Action::"read_file",
+        AgentOps::Action::"write_file"
+    ],
+    resource
+)
+when {
+    context has secrets_detected && context.secrets_detected == true
+};
+
+@id("data-protection.data-pipeline-block-secrets-output")
+@name("Block secrets in pipeline outputs")
+@description("Blocks write_file when secrets_detected is true or secret_count >= 1.")
+@severity("critical")
+@tags("category:data-protection,threat:secrets,detection:rule,surface:write-file,owasp:llm06")
+@reject_message("File write blocked: secrets detected in pipeline output — credentials must not be persisted.")
+forbid (
+    principal,
+    action == AgentOps::Action::"write_file",
+    resource
+)
+when {
+    (context has secrets_detected && context.secrets_detected == true) ||
+    (context has secret_count && context.secret_count >= 1)
+};