@highflame/policy 2.2.29 → 2.2.32

package/_schemas/agent_ops/templates/templates.json

@@ -1,7 +1,7 @@
 {
   "service": "agent_ops",
   "version": "1.0.0",
-  "description": "AgentOps policy templates — unified agent guardrails for code agents, MCP tools, and AI Gateway traffic",
+  "description": "AgentOps policy templates \u2014 unified agent guardrails for code agents, MCP tools, and AI Gateway traffic",
   "categories": [
     {
       "id": "threat-detection",
@@ -41,7 +41,7 @@
     {
       "id": "sandbox",
       "name": "Sandbox",
-      "description": "Forge sandbox provisioning profiles — capability ceilings for the OS-layer envelope (writable paths, egress, exec, mechanism toggles, isolation tier)."
+      "description": "Forge sandbox provisioning profiles \u2014 capability ceilings for the OS-layer envelope (writable paths, egress, exec, mechanism toggles, isolation tier)."
     }
   ],
   "defaults": [
@@ -52,7 +52,10 @@
       "category": "organization",
       "file": "defaults/baseline.cedar",
       "severity": "low",
-      "tags": ["category:organization", "posture:permit-default"],
+      "tags": [
+        "category:organization",
+        "posture:permit-default"
+      ],
       "is_active": true
     }
   ],
@@ -64,7 +67,10 @@
       "category": "organization",
       "file": "defaults/baseline.cedar",
       "severity": "low",
-      "tags": ["category:organization", "posture:permit-default"],
+      "tags": [
+        "category:organization",
+        "posture:permit-default"
+      ],
       "auto_deploy": true
     },
     {
@@ -74,7 +80,12 @@
       "category": "sandbox",
       "file": "profiles/locked_down.cedar",
       "severity": "high",
-      "tags": ["category:sandbox", "surface:provision-sandbox", "scope:per-agent", "posture:deny-default"]
+      "tags": [
+        "category:sandbox",
+        "surface:provision-sandbox",
+        "scope:per-agent",
+        "posture:deny-default"
+      ]
     },
     {
       "id": "sandbox.data-processing",
@@ -83,7 +94,12 @@
       "category": "sandbox",
       "file": "profiles/data_processing.cedar",
       "severity": "high",
-      "tags": ["category:sandbox", "surface:provision-sandbox", "scope:per-agent", "posture:deny-default"]
+      "tags": [
+        "category:sandbox",
+        "surface:provision-sandbox",
+        "scope:per-agent",
+        "posture:deny-default"
+      ]
     },
     {
       "id": "sandbox.network-dev",
@@ -92,7 +108,12 @@
       "category": "sandbox",
       "file": "profiles/network_dev.cedar",
       "severity": "high",
-      "tags": ["category:sandbox", "surface:provision-sandbox", "scope:per-agent", "posture:deny-default"]
+      "tags": [
+        "category:sandbox",
+        "surface:provision-sandbox",
+        "scope:per-agent",
+        "posture:deny-default"
+      ]
     },
     {
       "id": "sandbox.gpu-training",
@@ -101,7 +122,730 @@
       "category": "sandbox",
       "file": "profiles/gpu_training.cedar",
       "severity": "high",
-      "tags": ["category:sandbox", "surface:provision-sandbox", "scope:per-agent", "posture:deny-default"]
+      "tags": [
+        "category:sandbox",
+        "surface:provision-sandbox",
+        "scope:per-agent",
+        "posture:deny-default"
+      ]
+    },
+    {
+      "id": "data-protection.defaults",
+      "name": "Secrets Detection",
+      "description": "Block content containing API keys, tokens, credentials, or other secrets across prompts, tool calls, and file operations.",
+      "category": "data-protection",
+      "file": "ported/data-protection/data_protection_defaults.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
+    },
+    {
+      "id": "security.injection",
+      "name": "Injection & Jailbreak Detection",
+      "description": "Block prompt injection and jailbreak attempts using ML classifier confidence plus invisible-character defence.",
+      "category": "threat-detection",
+      "file": "ported/threat-detection/security_injection.cedar",
+      "severity": "high",
+      "tags": [
+        "category:security",
+        "threat:injection",
+        "threat:jailbreak",
+        "detection:ml",
+        "owasp:llm01",
+        "owasp:llm02"
+      ]
+    },
+    {
+      "id": "privacy.defaults",
+      "name": "Structural PII",
+      "description": "Block well-formatted sensitive identifiers \u2014 SSNs, credit cards, IBANs, API keys \u2014 via fast deterministic pattern matching. High precision, low latency, few false positives; use as the always-on baseline.",
+      "category": "data-protection",
+      "file": "ported/data-protection/privacy_defaults.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:privacy",
+        "threat:pii",
+        "detection:pattern",
+        "compliance:pci-dss",
+        "compliance:hipaa"
+      ]
+    },
+    {
+      "id": "privacy.pii-model",
+      "name": "Contextual PII",
+      "description": "Block the same sensitive identifiers when the ML model infers them from surrounding context \u2014 catches unstructured or novel PII the structural patterns miss. Higher recall; requires the pii_model detector.",
+      "category": "data-protection",
+      "file": "ported/data-protection/privacy_pii_model.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:privacy",
+        "threat:pii",
+        "detection:ml",
+        "compliance:pci-dss",
+        "compliance:hipaa"
+      ]
+    },
+    {
+      "id": "trust-safety.toxicity",
+      "name": "Toxicity & Content Moderation",
+      "description": "Block toxic, violent, hateful, sexual, and profane content using classifier scores with a combined-toxicity catch-all.",
+      "category": "content-safety",
+      "file": "ported/content-safety/trust_safety_toxicity.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:trust-safety",
+        "threat:harmful",
+        "threat:hate-speech",
+        "detection:ml",
+        "compliance:eu-ai-act"
+      ]
+    },
+    {
+      "id": "agent-security.tool-risk",
+      "name": "Tool Risk",
+      "description": "Block dangerous tool calls, shell execution, and sensitive tools with elevated risk scores.",
+      "category": "agent-security",
+      "file": "ported/agent-security/agent_security_tool_risk.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-security",
+        "threat:command-injection",
+        "owasp:llm06",
+        "owasp:asi02"
+      ]
+    },
+    {
+      "id": "agent-security.malicious-package",
+      "name": "Malicious Package",
+      "description": "Block package installs (pip, npm, yarn, pnpm, bun, uv, gem, cargo, go, composer) flagged as malicious.",
+      "category": "agent-security",
+      "file": "ported/agent-security/agent_security_malicious_package.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-security",
+        "threat:supply-chain",
+        "owasp:llm03",
+        "owasp:asi02"
+      ]
+    },
+    {
+      "id": "agent-security.defaults",
+      "name": "Agentic Safety",
+      "description": "Block tool-call loops, exfiltration patterns, budget violations, tool poisoning, rug pull, and MCP configuration risks.",
+      "category": "agent-security",
+      "file": "ported/agent-security/agent_security_defaults.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-security",
+        "threat:loop",
+        "threat:exfiltration",
+        "threat:tool-poisoning",
+        "threat:rug-pull",
+        "owasp:asi01",
+        "owasp:asi04"
+      ]
+    },
+    {
+      "id": "security.patterns",
+      "name": "Security Pattern Detection",
+      "description": "Block command injection, path traversal, and SQL injection using regex-based pattern detection.",
+      "category": "threat-detection",
+      "file": "ported/threat-detection/security_patterns.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:security",
+        "threat:command-injection",
+        "threat:sql-injection",
+        "threat:path-traversal",
+        "detection:pattern",
+        "mitre:t1059"
+      ]
+    },
+    {
+      "id": "trust-safety.semantic",
+      "name": "Semantic Topic Enforcement",
+      "description": "Block content classified into dangerous topics (weapons, controlled substances, illegal activity).",
+      "category": "content-safety",
+      "file": "ported/content-safety/trust_safety_semantic.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:trust-safety",
+        "threat:harmful",
+        "detection:ml",
+        "compliance:eu-ai-act",
+        "compliance:iso-42001"
+      ]
+    },
+    {
+      "id": "agent-identity.defaults",
+      "name": "Agent Identity & Trust",
+      "description": "Trust-based access control: block unverified agents from dangerous/sensitive tools, stricter thresholds for autonomous agents, cross-turn lockdown after session threats.",
+      "category": "agent-security",
+      "file": "ported/agent-security/agent_identity_defaults.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-identity",
+        "scope:per-agent",
+        "owasp:llm01"
+      ]
+    },
+    {
+      "id": "tools.mcp-tool-permissions",
+      "name": "MCP Tool Permissions",
+      "description": "Per-tool MCP access control: example GitHub read/write split, org-wide exclusion list, unverified server block.",
+      "category": "tool-permissioning",
+      "file": "ported/tool-permissioning/tools_mcp_tool_permissions.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:tools",
+        "threat:supply-chain",
+        "posture:deny-default"
+      ]
+    },
+    {
+      "id": "tools.mcp-server-allowlist",
+      "name": "MCP Server Allowlist",
+      "description": "Restrict MCP server connections to a pre-approved list. Customize the allowlist values to match the servers permitted in your environment.",
+      "category": "tool-permissioning",
+      "file": "ported/tool-permissioning/tools_mcp_server_allowlist.cedar",
+      "severity": "medium",
+      "tags": [
+        "category:tools",
+        "surface:connect-server",
+        "scope:org-wide",
+        "posture:deny-default"
+      ]
+    },
+    {
+      "id": "security.chat-assistant",
+      "name": "Chat Assistant \u2014 Security",
+      "description": "Aggressive injection and jailbreak defence for customer-facing chatbots (lower thresholds than defaults).",
+      "category": "threat-detection",
+      "file": "ported/threat-detection/security_chat_assistant.cedar",
+      "severity": "high",
+      "tags": [
+        "category:security",
+        "threat:injection",
+        "threat:jailbreak",
+        "detection:ml"
+      ]
+    },
+    {
+      "id": "trust-safety.chat-assistant",
+      "name": "Chat Assistant \u2014 Trust & Safety",
+      "description": "Strict content moderation and topic restrictions for public-facing chat (lower toxicity thresholds).",
+      "category": "content-safety",
+      "file": "ported/content-safety/trust_safety_chat_assistant.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:trust-safety",
+        "threat:harmful",
+        "compliance:eu-ai-act"
+      ]
+    },
+    {
+      "id": "data-protection.code-block-write-secrets",
+      "name": "Code Agent \u2014 Secrets Protection",
+      "description": "Prevent code agents from writing detected secrets to output files.",
+      "category": "data-protection",
+      "file": "ported/data-protection/data_protection_code_block_write_secrets.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:data-protection",
+        "threat:secrets"
+      ]
+    },
+    {
+      "id": "security.code-agent-encoding",
+      "name": "Code Agent \u2014 Encoding Attacks",
+      "description": "Block invisible Unicode characters in tool arguments and file writes for coding agents.",
+      "category": "code-security",
+      "file": "ported/code-security/security_code_agent_encoding.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:security",
+        "threat:invisible-chars",
+        "threat:injection"
+      ]
+    },
+    {
+      "id": "security.code-agent-path-security",
+      "name": "Code Agent \u2014 Path Security",
+      "description": "Block .env files, credential files, system directories, key material, and destructive file operations for coding agents.",
+      "category": "code-security",
+      "file": "ported/code-security/security_code_agent_path_security.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:security",
+        "threat:secrets",
+        "threat:path-traversal"
+      ]
+    },
+    {
+      "id": "agent-security.code-agent",
+      "name": "Code Agent \u2014 Agentic Security",
+      "description": "Tool risk controls, shell blocking, loop detection, exfiltration prevention, and budget enforcement for coding assistants.",
+      "category": "code-security",
+      "file": "ported/code-security/agent_security_code_agent.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-security",
+        "threat:exfiltration",
+        "threat:loop",
+        "owasp:llm06"
+      ]
+    },
+    {
+      "id": "agent-security.code-agent-supply-chain",
+      "name": "Code Agent \u2014 Supply Chain",
+      "description": "Block MCP server poisoning, indirect prompt injection, credential theft chains, destructive sequences, and malicious package installs for coding agents.",
+      "category": "code-security",
+      "file": "ported/code-security/agent_security_code_agent_supply_chain.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-security",
+        "threat:tool-poisoning",
+        "threat:indirect-injection",
+        "threat:exfiltration",
+        "owasp:asi01",
+        "owasp:asi04"
+      ]
+    },
+    {
+      "id": "data-protection.data-pipeline",
+      "name": "Data Pipeline \u2014 Secrets",
+      "description": "Strict secrets detection for data pipelines and zero-tolerance secret writes.",
+      "category": "data-protection",
+      "file": "ported/data-protection/data_protection_data_pipeline.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
+    },
+    {
+      "id": "security.data-pipeline-block-injection",
+      "name": "Data Pipeline \u2014 Injection Defence",
+      "description": "Lower injection threshold for RAG and data processing pipelines.",
+      "category": "threat-detection",
+      "file": "ported/threat-detection/security_data_pipeline_block_injection.cedar",
+      "severity": "high",
+      "tags": [
+        "category:security",
+        "threat:injection",
+        "owasp:llm01"
+      ]
+    },
+    {
+      "id": "agent-security.data-pipeline",
+      "name": "Data Pipeline \u2014 Agentic Security",
+      "description": "Exfiltration prevention and tool risk controls for data processing pipelines.",
+      "category": "agent-security",
+      "file": "ported/agent-security/agent_security_data_pipeline.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-security",
+        "threat:exfiltration"
+      ]
+    },
+    {
+      "id": "agent-identity.multi-agent-trust",
+      "name": "Multi-Agent Orchestration \u2014 Agent Trust",
+      "description": "Tiered trust access control: only first-party agents can use dangerous tools, unverified restricted to safe tools, lower risk ceilings for autonomous agents.",
+      "category": "agent-security",
+      "file": "ported/agent-security/agent_identity_multi_agent_trust.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-identity",
+        "scope:per-agent",
+        "owasp:llm01",
+        "owasp:llm02"
+      ]
+    },
+    {
+      "id": "agent-identity.multi-agent-safety",
+      "name": "Multi-Agent Orchestration \u2014 Cross-Turn Safety",
+      "description": "Session-aware policies: PII/secrets containment, injection lockdown, cumulative risk circuit breakers for multi-agent sessions.",
+      "category": "agent-security",
+      "file": "ported/agent-security/agent_identity_multi_agent_safety.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-identity",
+        "scope:per-agent",
+        "threat:pii",
+        "threat:secrets",
+        "threat:injection"
+      ]
+    },
+    {
+      "id": "agent-identity.a2a-cross-origin",
+      "name": "A2A Security \u2014 Cross-Origin Trust",
+      "description": "Block confused-deputy attacks and trust-boundary violations from cross-system agent communication.",
+      "category": "agent-security",
+      "file": "ported/agent-security/agent_identity_a2a_cross_origin.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-identity",
+        "threat:supply-chain",
+        "owasp:llm08",
+        "owasp:asi03"
+      ]
+    },
+    {
+      "id": "agent-identity.a2a-inter-agent-injection",
+      "name": "A2A Security \u2014 Inter-Agent Injection Defence",
+      "description": "Block indirect injection via tool outputs, multi-turn progressive attacks via deep-context detection, and encoded payload delivery between agents.",
+      "category": "agent-security",
+      "file": "ported/agent-security/agent_identity_a2a_inter_agent_injection.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-identity",
+        "threat:indirect-injection",
+        "threat:encoded-payload",
+        "owasp:llm01"
+      ]
+    },
+    {
+      "id": "agent-identity.a2a-supply-chain",
+      "name": "A2A Security \u2014 Supply Chain & Behavioural Drift",
+      "description": "Block tool poisoning from external agent ecosystems, rug pull behavioural drift, and credential theft chains.",
+      "category": "code-security",
+      "file": "ported/code-security/agent_identity_a2a_supply_chain.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-identity",
+        "threat:tool-poisoning",
+        "threat:rug-pull",
+        "threat:exfiltration",
+        "owasp:asi04"
+      ]
+    },
+    {
+      "id": "agent-identity.a2a-identity-enforcement",
+      "name": "A2A Security \u2014 Agent Identity Enforcement",
+      "description": "Enforce strict identity requirements for cross-system agents: block anonymous, require framework registration, prevent unverified autonomous.",
+      "category": "agent-security",
+      "file": "ported/agent-security/agent_identity_a2a_identity_enforcement.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-identity",
+        "threat:spoofing",
+        "scope:per-agent",
+        "owasp:asi04"
+      ]
+    },
+    {
+      "id": "agent-identity.a2a-escalation",
+      "name": "A2A Security \u2014 Escalation Detection",
+      "description": "Detect progressive capability escalation across turns with session peak monitoring and cumulative risk circuit breakers.",
+      "category": "agent-security",
+      "file": "ported/agent-security/agent_identity_a2a_escalation.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-identity",
+        "threat:escalation",
+        "scope:per-agent",
+        "owasp:llm01"
+      ]
+    },
+    {
+      "id": "data-protection.advanced-secrets",
+      "name": "Advanced Detection \u2014 Granular Secrets",
+      "description": "Block specific high-risk credential types (cloud, GitHub, SSH, database) and general API tokens.",
+      "category": "data-protection",
+      "file": "ported/data-protection/data_protection_advanced_secrets.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
+    },
+    {
+      "id": "privacy.advanced-pii",
+      "name": "Comprehensive PII",
+      "description": "Block every PII type \u2014 structural and contextual, sensitive and situational. Situational entities (names, locations, dates, etc.) are real PII but appear in ordinary text, so this tier flags often; one forbid rule per entity lets you disable the ones you don't need. Opt-in for strict environments.",
+      "category": "data-protection",
+      "file": "ported/data-protection/privacy_advanced_pii.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:privacy",
+        "threat:pii",
+        "detection:pattern",
+        "compliance:pci-dss",
+        "compliance:hipaa"
+      ]
+    },
+    {
+      "id": "security.advanced-block-critical-severity",
+      "name": "Advanced Detection \u2014 Threat Severity",
+      "description": "Catch-all that blocks any content flagged as critical severity by any detector.",
+      "category": "threat-detection",
+      "file": "ported/threat-detection/security_advanced_block_critical_severity.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:security",
+        "detection:aggregate",
+        "posture:catch-all"
+      ]
+    },
+    {
+      "id": "agent-security.param-validation",
+      "name": "Action Parameter Validation",
+      "description": "Validate tool-call arguments by type, range, pattern, and allowlist/blocklist. Customize the thresholds and lists for your tenant.",
+      "category": "agent-security",
+      "file": "ported/agent-security/agent_security_param_validation.cedar",
+      "severity": "high",
+      "tags": [
+        "category:agent-security",
+        "surface:call-tool",
+        "aarm:r3",
+        "posture:deny-default"
+      ]
+    },
+    {
+      "id": "semantic.defaults",
+      "name": "Semantic Threat Detection",
+      "description": "Block injection attacks (command, SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.",
+      "category": "threat-detection",
+      "file": "ported/threat-detection/semantic_defaults.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:semantic",
+        "threat:injection",
+        "threat:jailbreak",
+        "owasp:llm01",
+        "owasp:llm02"
+      ]
+    },
+    {
+      "id": "trust-safety.defaults",
+      "name": "Content Safety",
+      "description": "Block violent, hateful, sexual, criminal content plus excessive profanity using ML classifier scores.",
+      "category": "content-safety",
+      "file": "ported/content-safety/trust_safety_defaults.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:trust-safety",
+        "threat:harmful",
+        "compliance:eu-ai-act",
+        "compliance:iso-42001"
+      ]
+    },
+    {
+      "id": "tools.defaults",
+      "name": "Tool Permissioning",
+      "description": "Block sensitive system-path file access and destructive MCP file-operation tools.",
+      "category": "tool-permissioning",
+      "file": "ported/tool-permissioning/tools_defaults.cedar",
+      "severity": "high",
+      "tags": [
+        "category:tools",
+        "threat:path-traversal",
+        "detection:pattern",
+        "mitre:t1005",
+        "owasp:asi02"
+      ]
+    },
+    {
+      "id": "tools.block-shell",
+      "name": "Block shell and command execution",
+      "description": "Blocks call_tool when tool_name is shell, bash, sh, terminal, cmd, or powershell.",
+      "category": "tool-permissioning",
+      "file": "ported/tool-permissioning/tools_block_shell.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:tools",
+        "threat:command-injection",
+        "detection:rule",
+        "surface:call-tool",
+        "owasp:llm06",
+        "mitre:t1059"
+      ]
+    },
+    {
+      "id": "tools.bash-operation-classes",
+      "name": "Bash Operation Class Restrictions",
+      "description": "Tiered shell control from the bash AST classifier: blocks network access and writes, requires step-up approval for execute-enabling or unrecognized commands; closes MCP guardrail bypass via the shell.",
+      "category": "tool-permissioning",
+      "file": "ported/tool-permissioning/tools_bash_operation_classes.cedar",
+      "severity": "high",
+      "tags": [
+        "category:tools",
+        "threat:exfiltration",
+        "threat:command-injection",
+        "detection:rule",
+        "surface:call-tool",
+        "owasp:asi02",
+        "mitre:t1059",
+        "step-up"
+      ]
+    },
+    {
+      "id": "organization.deny-baseline",
+      "name": "Default Deny All",
+      "description": "Organization-wide deny baseline; combine with scoped permit rules for deny-by-default posture.",
+      "category": "organization",
+      "file": "ported/organization/organization_deny_baseline.cedar",
+      "severity": "high",
+      "tags": [
+        "category:organization",
+        "posture:deny-default",
+        "scope:org-wide"
+      ]
+    },
+    {
+      "id": "organization.team-permissions",
+      "name": "Project-Based Permissions (ReBAC)",
+      "description": "Grant IDE access based on project scope using Cedar entity hierarchy \u2014 example dev/support project split.",
+      "category": "organization",
+      "file": "ported/organization/organization_team_permissions.cedar",
+      "severity": "medium",
+      "tags": [
+        "category:organization",
+        "scope:per-tool",
+        "posture:deny-default"
+      ]
+    },
+    {
+      "id": "agent-identity.claude-block-injection",
+      "name": "Agent-Specific Guardrails",
+      "description": "Per-agent security guardrails \u2014 injection blocking for the Claude agent. Customize agent IDs for your deployment. PII is handled by the privacy.* templates.",
+      "category": "agent-security",
+      "file": "ported/agent-security/agent_identity_claude_block_injection.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-identity",
+        "scope:per-agent",
+        "threat:injection"
+      ]
+    }
+  ],
+  "profiles": [
+    {
+      "id": "baseline-protection",
+      "name": "Baseline Protection",
+      "description": "The essential starting set for any agent: prompt-injection defense, secrets and PII blocking, and toxicity moderation. Safe to deploy fleet-wide.",
+      "severity": "high",
+      "tags": [
+        "baseline",
+        "injection",
+        "secrets",
+        "pii",
+        "toxicity"
+      ],
+      "template_ids": [
+        "security.injection",
+        "security.patterns",
+        "data-protection.defaults",
+        "privacy.pii-model",
+        "trust-safety.toxicity"
+      ]
+    },
+    {
+      "id": "code-agent",
+      "name": "Code Agent",
+      "description": "For coding assistants and dev agents: path-traversal and encoding-attack defense, supply-chain and malicious-package blocking, shell-command control, secret-write prevention, and tool-risk scoring.",
+      "severity": "high",
+      "tags": [
+        "code-agent",
+        "supply-chain",
+        "shell",
+        "path-security",
+        "secrets"
+      ],
+      "template_ids": [
+        "security.code-agent-encoding",
+        "security.code-agent-path-security",
+        "agent-security.code-agent",
+        "agent-security.code-agent-supply-chain",
+        "agent-security.malicious-package",
+        "data-protection.code-block-write-secrets",
+        "tools.block-shell",
+        "agent-security.tool-risk"
+      ]
+    },
+    {
+      "id": "mcp-gateway",
+      "name": "MCP Gateway Egress Guard",
+      "description": "For MCP/tool traffic through the AI Gateway: per-tool and per-server allow-listing, malicious-package blocking, tool-risk scoring, and secret exfiltration prevention.",
+      "severity": "high",
+      "tags": [
+        "mcp",
+        "tools",
+        "egress",
+        "allowlist",
+        "secrets"
+      ],
+      "template_ids": [
+        "tools.mcp-tool-permissions",
+        "tools.mcp-server-allowlist",
+        "agent-security.malicious-package",
+        "agent-security.tool-risk",
+        "data-protection.defaults"
+      ]
+    },
+    {
+      "id": "chat-assistant",
+      "name": "Chat Assistant",
+      "description": "For customer-facing chatbots: aggressive injection and jailbreak defense, strict toxicity moderation, and PII blocking in prompts and responses.",
+      "severity": "high",
+      "tags": [
+        "chat-assistant",
+        "toxicity",
+        "pii",
+        "injection"
+      ],
+      "template_ids": [
+        "security.chat-assistant",
+        "trust-safety.chat-assistant",
+        "trust-safety.toxicity",
+        "privacy.pii-model",
+        "security.injection"
+      ]
+    },
+    {
+      "id": "data-pipeline",
+      "name": "Data Pipeline",
+      "description": "For batch and data-processing agents: bulk secret and PII protection, data-pipeline-scoped injection defense, and agentic data-handling controls.",
+      "severity": "medium",
+      "tags": [
+        "data-pipeline",
+        "secrets",
+        "pii",
+        "data-protection"
+      ],
+      "template_ids": [
+        "data-protection.data-pipeline",
+        "data-protection.defaults",
+        "privacy.advanced-pii",
+        "security.data-pipeline-block-injection",
+        "agent-security.data-pipeline"
+      ]
+    },
+    {
+      "id": "multi-agent",
+      "name": "Multi-Agent Security",
+      "description": "For agent-to-agent (A2A) and multi-agent systems: cross-origin and inter-agent injection defense, identity enforcement, privilege-escalation detection, and multi-agent trust controls.",
+      "severity": "high",
+      "tags": [
+        "multi-agent",
+        "a2a",
+        "identity",
+        "escalation"
+      ],
+      "template_ids": [
+        "agent-identity.multi-agent-trust",
+        "agent-identity.multi-agent-safety",
+        "agent-identity.a2a-cross-origin",
+        "agent-identity.a2a-inter-agent-injection",
+        "agent-identity.a2a-identity-enforcement",
+        "agent-identity.a2a-escalation"
+      ]
     }
   ]
 }