@highflame/policy 2.2.3 → 2.2.5

package/_schemas/ai_gateway/templates/defaults/pii_model.cedar

@@ -0,0 +1,90 @@
+// =============================================================================
+// Contextual PII (Tier 2)
+// =============================================================================
+// Blocks the same high-sensitivity identifier groups inferred from surrounding context by the ML PII model — catches unstructured or novel PII the structural patterns miss (higher recall). Requires the pii_model detector.
+//
+// Sensitivity tiers and the structural (regex) / contextual (model) type
+// vocabulary are defined canonically in schemas/_shared/pii_taxonomy.json and
+// enforced by tools/lint-templates.
+//
+// Context keys consumed:
+//   - pii_types: Set<String>  (union of structural lowercase + contextual uppercase types)
+//
+// Category:  privacy
+// Namespace: AIGateway
+// =============================================================================
+
+@id("privacy.block-pii-national-id-model")
+@name("Block national ID numbers (contextual)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain a national ID (SSN, passport, or driver's license).")
+@severity("high")
+@tags("category:privacy,threat:pii,detection:ml,owasp:llm06")
+@reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
+forbid (
+    principal,
+    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types && context.pii_types.contains("NATIONAL_ID")
+};
+
+@id("privacy.block-pii-credit-card-model")
+@name("Block credit card numbers (contextual)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain a credit card number.")
+@severity("critical")
+@tags("category:privacy,threat:pii,detection:ml,compliance:pci-dss,owasp:llm06")
+@reject_message("Content blocked: credit card number patterns detected.")
+forbid (
+    principal,
+    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types && context.pii_types.contains("CREDIT_CARD")
+};
+
+@id("privacy.block-pii-bank-account-model")
+@name("Block bank account numbers (contextual)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain a bank account number (IBAN, SWIFT/BIC, or routing number).")
+@severity("critical")
+@tags("category:privacy,threat:pii,detection:ml,owasp:llm06")
+@reject_message("Content blocked: bank account (IBAN) number patterns detected.")
+forbid (
+    principal,
+    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types && context.pii_types.contains("ACCOUNT_NUMBER")
+};
+
+@id("privacy.block-pii-medical-model")
+@name("Block medical identifiers (contextual)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain medical data (record number, MBI, NPI, or blood type).")
+@severity("medium")
+@tags("category:privacy,threat:pii,detection:ml,compliance:hipaa,owasp:llm06")
+@reject_message("Content blocked: medical record identifier patterns detected.")
+forbid (
+    principal,
+    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types && context.pii_types.contains("MEDICAL")
+};
+
+@id("privacy.block-pii-credential-model")
+@name("Block credentials (contextual)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain a credential or secret (API key, token, password hash, or private key).")
+@severity("critical")
+@tags("category:privacy,threat:pii,detection:ml,owasp:llm06")
+@reject_message("Content blocked: credential or API key patterns detected.")
+forbid (
+    principal,
+    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types && context.pii_types.contains("CREDENTIAL")
+};

package/_schemas/ai_gateway/templates/secrets.cedar

@@ -0,0 +1,46 @@
+// =============================================================================
+// Secrets Detection
+// =============================================================================
+// Blocks AI Gateway operations when secrets or credentials are detected in the
+// content. Covers both LLM prompt processing and MCP tool calls. PII is handled
+// by the canonical privacy.* templates (defaults/pii*.cedar).
+//
+// Context keys consumed:
+//   - secrets_detected:  Bool
+//
+// Compliance:
+//   - OWASP LLM06
+//
+// Category:  data-protection
+// Namespace: AIGateway
+// =============================================================================
+
+@id("data-protection.block-secrets")
+@name("Block secrets in prompts")
+@description("Blocks process_prompt when secrets_detected is true.")
+@severity("critical")
+@tags("category:data-protection,threat:secrets,detection:rule,surface:process-prompt,owasp:llm06")
+@reject_message("Prompt blocked: secrets or credentials were detected — remove sensitive data and retry.")
+forbid (
+    principal,
+    action == AIGateway::Action::"process_prompt",
+    resource
+)
+when {
+    context has secrets_detected && context.secrets_detected == true
+};
+
+@id("data-protection.block-secrets-tools")
+@name("Block secrets in tool calls")
+@description("Blocks call_tool when secrets_detected is true.")
+@severity("critical")
+@tags("category:data-protection,threat:secrets,detection:rule,surface:call-tool,owasp:llm06")
+@reject_message("Tool execution blocked: secrets or credentials were detected in tool arguments.")
+forbid (
+    principal,
+    action == AIGateway::Action::"call_tool",
+    resource
+)
+when {
+    context has secrets_detected && context.secrets_detected == true
+};

package/_schemas/ai_gateway/templates/templates.json

@@ -21,7 +21,12 @@
     {
       "id": "data-protection",
       "name": "Data Protection",
-      "description": "Prevent secrets and PII leakage in LLM chat completions and MCP operations."
+      "description": "Prevent secrets leakage in LLM chat completions and MCP operations."
+    },
+    {
+      "id": "privacy",
+      "name": "Privacy",
+      "description": "Block personally identifiable information (PII) in LLM prompts and MCP tool calls."
     },
     {
       "id": "organization",
@@ -59,7 +64,13 @@
       "category": "semantic",
       "file": "defaults/semantic.cedar",
       "severity": "critical",
-      "tags": ["category:semantic", "threat:injection", "threat:jailbreak", "owasp:llm01", "owasp:llm02"]
+      "tags": [
+        "category:semantic",
+        "threat:injection",
+        "threat:jailbreak",
+        "owasp:llm01",
+        "owasp:llm02"
+      ]
     },
     {
       "id": "tools.defaults",
@@ -68,7 +79,12 @@
       "category": "tools",
       "file": "defaults/tools.cedar",
       "severity": "critical",
-      "tags": ["category:tools", "threat:command-injection", "owasp:llm06", "owasp:asi02"]
+      "tags": [
+        "category:tools",
+        "threat:command-injection",
+        "owasp:llm06",
+        "owasp:asi02"
+      ]
     },
     {
       "id": "agent-security.defaults",
@@ -77,7 +93,15 @@
       "category": "agent-security",
       "file": "defaults/agent_security.cedar",
       "severity": "critical",
-      "tags": ["category:agent-security", "threat:tool-poisoning", "threat:rug-pull", "threat:indirect-injection", "threat:supply-chain", "owasp:asi01", "owasp:asi04"]
+      "tags": [
+        "category:agent-security",
+        "threat:tool-poisoning",
+        "threat:rug-pull",
+        "threat:indirect-injection",
+        "threat:supply-chain",
+        "owasp:asi01",
+        "owasp:asi04"
+      ]
     },
     {
       "id": "tools.mcp-server-allowlist",
@@ -95,16 +119,65 @@
       "category": "tools",
       "file": "mcp_tool_permissions.cedar",
       "severity": "critical",
-      "tags": ["category:tools", "threat:supply-chain", "posture:permit-default"]
+      "tags": [
+        "category:tools",
+        "threat:supply-chain",
+        "posture:permit-default"
+      ]
     },
     {
-      "id": "data-protection.pii-redaction",
-      "name": "PII & Secrets Redaction",
-      "description": "Block requests containing PII or secrets across LLM prompts and MCP tool calls.",
+      "id": "data-protection.secrets",
+      "name": "Secrets Detection",
+      "description": "Block requests containing secrets or credentials across LLM prompts and MCP tool calls.",
       "category": "data-protection",
-      "file": "pii_redaction.cedar",
+      "file": "secrets.cedar",
+      "severity": "critical",
+      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
+    },
+    {
+      "id": "privacy.defaults",
+      "name": "Structural PII",
+      "description": "Block well-formatted sensitive identifiers — SSNs, credit cards, IBANs, API keys — via fast deterministic pattern matching. High precision, low latency, few false positives; use as the always-on baseline.",
+      "category": "privacy",
+      "file": "defaults/pii.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:privacy",
+        "threat:pii",
+        "detection:pattern",
+        "compliance:pci-dss",
+        "compliance:hipaa"
+      ]
+    },
+    {
+      "id": "privacy.pii-model",
+      "name": "Contextual PII",
+      "description": "Block the same sensitive identifiers when the ML model infers them from surrounding context — catches unstructured or novel PII the structural patterns miss. Higher recall; requires the pii_model detector.",
+      "category": "privacy",
+      "file": "defaults/pii_model.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:privacy",
+        "threat:pii",
+        "detection:ml",
+        "compliance:pci-dss",
+        "compliance:hipaa"
+      ]
+    },
+    {
+      "id": "privacy.advanced-pii",
+      "name": "Comprehensive PII",
+      "description": "Block every PII type — structural and contextual, sensitive and situational. Situational entities (names, locations, dates, etc.) are real PII but appear in ordinary text, so this tier flags often; one forbid rule per entity lets you disable the ones you don't need. Opt-in for strict environments.",
+      "category": "privacy",
+      "file": "defaults/pii_advanced.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:pii", "threat:secrets", "threat:exfiltration", "owasp:llm06"]
+      "tags": [
+        "category:privacy",
+        "threat:pii",
+        "detection:pattern",
+        "compliance:pci-dss",
+        "compliance:hipaa"
+      ]
     },
     {
       "id": "organization.permit-llm-default",
@@ -113,7 +186,11 @@
       "category": "organization",
       "file": "llm_default_allow.cedar",
       "severity": "low",
-      "tags": ["category:organization", "surface:process-prompt", "posture:permit-default"]
+      "tags": [
+        "category:organization",
+        "surface:process-prompt",
+        "posture:permit-default"
+      ]
     }
   ]
 }

package/_schemas/guardrails/templates/defaults/pii.cedar

@@ -1,55 +1,164 @@
 // =============================================================================
-// PII Detection (Default)
+// Structural PII (Tier 1)
 // =============================================================================
-// Blocks LLM responses that contain personally identifiable information,
-// with a stricter rule for the most sensitive PII types (SSN, credit card,
-// passport).
+// Blocks high-sensitivity identifiers that have a deterministic structure (SSNs, credit cards, IBANs, API keys) using fast regex pattern matching — high precision, low latency, few false positives. One forbid rule per identifier group.
 //
-// Context keys consumed:
-//   - pii_detected:  Bool
-//   - pii_types:     Set<String>
-//   - direction:     String ("input" | "output")
+// Sensitivity tiers and the structural (regex) / contextual (model) type
+// vocabulary are defined canonically in schemas/_shared/pii_taxonomy.json and
+// enforced by tools/lint-templates.
 //
-// Compliance:
-//   - GDPR, HIPAA, PCI-DSS (depending on data classification)
+// Context keys consumed:
+//   - pii_types: Set<String>  (union of structural lowercase + contextual uppercase types)
 //
 // Category:  privacy
 // Namespace: Guardrails
 // =============================================================================
 
-@id("privacy.block-pii-output")
-@name("Block PII in outputs")
-@description("Blocks process_prompt outputs when pii_detected is true.")
+@id("privacy.block-pii-national-id")
+@name("Block national ID numbers (structural)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain a national ID (SSN, passport, or driver's license).")
 @severity("high")
-@tags("category:privacy,threat:pii,detection:rule,surface:process-prompt,compliance:gdpr")
-@reject_message("Response blocked: personally identifiable information was detected in the output.")
+@tags("category:privacy,threat:pii,detection:pattern,owasp:llm06")
+@reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
-    context has pii_detected && context.pii_detected == true &&
-    context has direction && context.direction == "output"
+    context has pii_types &&
+    (
+        context.pii_types.contains("ssn") ||
+        context.pii_types.contains("passport") ||
+        context.pii_types.contains("national_id") ||
+        context.pii_types.contains("drivers_license")
+    )
 };
 
-@id("privacy.block-pii-sensitive")
-@name("Block sensitive PII types in outputs")
-@description("Blocks process_prompt outputs when pii_types contains SSN, credit_card, or passport.")
+@id("privacy.block-pii-credit-card")
+@name("Block credit card numbers (structural)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain a credit card number.")
 @severity("critical")
-@tags("category:privacy,threat:pii,detection:rule,surface:process-prompt,compliance:gdpr,compliance:hipaa,compliance:pci-dss")
-@reject_message("Response blocked: highly sensitive PII (SSN, credit card, or passport) was detected.")
+@tags("category:privacy,threat:pii,detection:pattern,compliance:pci-dss,owasp:llm06")
+@reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types && context.pii_types.contains("credit_card")
+};
+
+@id("privacy.block-pii-bank-account")
+@name("Block bank account numbers (structural)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain a bank account number (IBAN, SWIFT/BIC, or routing number).")
+@severity("critical")
+@tags("category:privacy,threat:pii,detection:pattern,owasp:llm06")
+@reject_message("Content blocked: bank account (IBAN) number patterns detected.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
-    context has direction && context.direction == "output" &&
     context has pii_types &&
     (
-        context.pii_types.contains("ssn") ||
-        context.pii_types.contains("credit_card") ||
-        context.pii_types.contains("passport")
+        context.pii_types.contains("iban") ||
+        context.pii_types.contains("bank_account") ||
+        context.pii_types.contains("swift_bic") ||
+        context.pii_types.contains("aba_routing")
+    )
+};
+
+@id("privacy.block-pii-medical")
+@name("Block medical identifiers (structural)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain medical data (record number, MBI, NPI, or blood type).")
+@severity("medium")
+@tags("category:privacy,threat:pii,detection:pattern,compliance:hipaa,owasp:llm06")
+@reject_message("Content blocked: medical record identifier patterns detected.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types &&
+    (
+        context.pii_types.contains("medical_record") ||
+        context.pii_types.contains("patient_record") ||
+        context.pii_types.contains("medicare_beneficiary_id") ||
+        context.pii_types.contains("npi") ||
+        context.pii_types.contains("medical_term") ||
+        context.pii_types.contains("blood_type")
+    )
+};
+
+@id("privacy.block-pii-tax-id")
+@name("Block tax identifiers (structural)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain a tax ID (ITIN, EIN, or PTIN).")
+@severity("high")
+@tags("category:privacy,threat:pii,detection:pattern,owasp:llm06")
+@reject_message("Content blocked: tax identifier (ITIN or EIN) patterns detected.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types &&
+    (
+        context.pii_types.contains("itin") ||
+        context.pii_types.contains("ein") ||
+        context.pii_types.contains("ptin")
+    )
+};
+
+@id("privacy.block-pii-credential")
+@name("Block credentials (structural)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain a credential or secret (API key, token, password hash, or private key).")
+@severity("critical")
+@tags("category:privacy,threat:pii,detection:pattern,owasp:llm06")
+@reject_message("Content blocked: credential or API key patterns detected.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types &&
+    (
+        context.pii_types.contains("aws_access_key") ||
+        context.pii_types.contains("api_key") ||
+        context.pii_types.contains("jwt_token") ||
+        context.pii_types.contains("encryption_key") ||
+        context.pii_types.contains("http_basic_auth") ||
+        context.pii_types.contains("gcp_credential") ||
+        context.pii_types.contains("gcp_api_key") ||
+        context.pii_types.contains("gcp_signed_policy") ||
+        context.pii_types.contains("session_cookie") ||
+        context.pii_types.contains("oauth_token") ||
+        context.pii_types.contains("tls_certificate") ||
+        context.pii_types.contains("password_hash") ||
+        context.pii_types.contains("csrf_token")
+    )
+};
+
+@id("privacy.block-pii-crypto")
+@name("Block cryptocurrency addresses (structural)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain a cryptocurrency wallet address.")
+@severity("high")
+@tags("category:privacy,threat:pii,detection:pattern,owasp:llm06")
+@reject_message("Content blocked: cryptocurrency wallet address patterns detected.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types &&
+    (
+        context.pii_types.contains("bitcoin_address") ||
+        context.pii_types.contains("ethereum_address")
     )
 };

package/_schemas/guardrails/templates/defaults/pii_model.cedar

@@ -0,0 +1,90 @@
+// =============================================================================
+// Contextual PII (Tier 2)
+// =============================================================================
+// Blocks the same high-sensitivity identifier groups inferred from surrounding context by the ML PII model — catches unstructured or novel PII the structural patterns miss (higher recall). Requires the pii_model detector.
+//
+// Sensitivity tiers and the structural (regex) / contextual (model) type
+// vocabulary are defined canonically in schemas/_shared/pii_taxonomy.json and
+// enforced by tools/lint-templates.
+//
+// Context keys consumed:
+//   - pii_types: Set<String>  (union of structural lowercase + contextual uppercase types)
+//
+// Category:  privacy
+// Namespace: Guardrails
+// =============================================================================
+
+@id("privacy.block-pii-national-id-model")
+@name("Block national ID numbers (contextual)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain a national ID (SSN, passport, or driver's license).")
+@severity("high")
+@tags("category:privacy,threat:pii,detection:ml,owasp:llm06")
+@reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types && context.pii_types.contains("NATIONAL_ID")
+};
+
+@id("privacy.block-pii-credit-card-model")
+@name("Block credit card numbers (contextual)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain a credit card number.")
+@severity("critical")
+@tags("category:privacy,threat:pii,detection:ml,compliance:pci-dss,owasp:llm06")
+@reject_message("Content blocked: credit card number patterns detected.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types && context.pii_types.contains("CREDIT_CARD")
+};
+
+@id("privacy.block-pii-bank-account-model")
+@name("Block bank account numbers (contextual)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain a bank account number (IBAN, SWIFT/BIC, or routing number).")
+@severity("critical")
+@tags("category:privacy,threat:pii,detection:ml,owasp:llm06")
+@reject_message("Content blocked: bank account (IBAN) number patterns detected.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types && context.pii_types.contains("ACCOUNT_NUMBER")
+};
+
+@id("privacy.block-pii-medical-model")
+@name("Block medical identifiers (contextual)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain medical data (record number, MBI, NPI, or blood type).")
+@severity("medium")
+@tags("category:privacy,threat:pii,detection:ml,compliance:hipaa,owasp:llm06")
+@reject_message("Content blocked: medical record identifier patterns detected.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types && context.pii_types.contains("MEDICAL")
+};
+
+@id("privacy.block-pii-credential-model")
+@name("Block credentials (contextual)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain a credential or secret (API key, token, password hash, or private key).")
+@severity("critical")
+@tags("category:privacy,threat:pii,detection:ml,owasp:llm06")
+@reject_message("Content blocked: credential or API key patterns detected.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types && context.pii_types.contains("CREDENTIAL")
+};