@highflame/policy 2.2.31 → 2.2.32

package/_schemas/agent_ops/schema.cedarschema

@@ -297,6 +297,14 @@ namespace AgentOps {
         "agent_framework"?: String,
         "agent_publisher"?: String,
 
+        // Supply-chain / package safety + aggregate threat severity (optional —
+        // ADR 0012 unified port). Projected by Shield's malicious-package and
+        // threat-severity detectors; every read is `has`-guarded in policy.
+        "malicious_package_detected"?: Boolean,
+        "package_install_detected"?: Boolean,
+        "package_check_status"?: String,
+        "max_threat_severity"?: Long,
+
     };
 
     /// Context for call_tool action (agentic tool execution)
@@ -493,6 +501,14 @@ namespace AgentOps {
         // File & Path (optional)
         "path"?: String,
 
+        // Supply-chain / package safety + aggregate threat severity (optional —
+        // ADR 0012 unified port). Projected by Shield's malicious-package and
+        // threat-severity detectors; every read is `has`-guarded in policy.
+        "malicious_package_detected"?: Boolean,
+        "package_install_detected"?: Boolean,
+        "package_check_status"?: String,
+        "max_threat_severity"?: Long,
+
     };
 
     /// Context for read_file action
@@ -825,6 +841,14 @@ namespace AgentOps {
         "agent_framework"?: String,
         "agent_publisher"?: String,
 
+        // Supply-chain / package safety + aggregate threat severity (optional —
+        // ADR 0012 unified port). Projected by Shield's malicious-package and
+        // threat-severity detectors; every read is `has`-guarded in policy.
+        "malicious_package_detected"?: Boolean,
+        "package_install_detected"?: Boolean,
+        "package_check_status"?: String,
+        "max_threat_severity"?: Long,
+
     };
 
     /// Context for provision_sandbox action (Forge sandbox-create envelope).

package/_schemas/agent_ops/templates/ported/agent-security/agent_identity_a2a_cross_origin.cedar

@@ -0,0 +1,92 @@
+// =============================================================================
+// A2A Security — Cross-Origin Trust Boundary Enforcement
+// =============================================================================
+// Detects and blocks confused-deputy attacks where an agent from one trust
+// domain attempts to operate in another. Primary signal in A2A
+// communication where independent agents cross separate trust domains.
+//
+// Shield cross-origin detector scores (discrete):
+//   90 mixed localhost + external | 85 URL injection | 80 proxy/redirect
+//   75 multi-origin tool configs  | 70 mixed HTTP/HTTPS | 65 JSON multi-URL
+//   60 generic multi-domain patterns
+//
+// Context keys consumed:
+//   - cross_origin_detected, cross_origin_score
+//   - agent_id, agent_trust_level
+//   - tool_is_sensitive
+//
+// Compliance:
+//   - OWASP LLM08, OWASP ASI03; NIST 800-53 AC-4
+//
+// Category:  agent-identity
+// Namespace: AgentOps
+// =============================================================================
+
+@id("agent-identity.a2a-block-cross-origin-critical")
+@name("Block critical cross-origin from any agent")
+@description("Blocks process_prompt and call_tool when cross_origin_detected is true and cross_origin_score >= 80.")
+@severity("critical")
+@tags("category:agent-identity,threat:supply-chain,detection:ml,owasp:llm08")
+@reject_message("Request blocked: high-confidence cross-origin trust-boundary violation detected — confused-deputy attack.")
+forbid (
+    principal is AgentOps::Agent,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has agent_id && context.agent_id != "" &&
+    context has cross_origin_detected && context.cross_origin_detected == true &&
+    context has cross_origin_score && context.cross_origin_score >= 80
+};
+
+@id("agent-identity.a2a-block-cross-origin-unverified")
+@name("Block cross-origin from unverified agents")
+@description("Blocks process_prompt and call_tool when agent_trust_level is \"unverified\", cross_origin_detected is true, and cross_origin_score >= 60.")
+@severity("high")
+@tags("category:agent-identity,threat:supply-chain,scope:per-agent,detection:ml,owasp:asi03")
+@reject_message("Request blocked: unverified agent attempted cross-origin activity — no trust attestation across trust domains.")
+forbid (
+    principal is AgentOps::Agent,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
+    context has cross_origin_detected && context.cross_origin_detected == true &&
+    context has cross_origin_score && context.cross_origin_score >= 60
+};
+
+@id("agent-identity.a2a-block-cross-origin-server-connect")
+@name("Block cross-origin MCP server connections")
+@description("Blocks connect_server when agent_trust_level is not \"first_party\", cross_origin_detected is true, and cross_origin_score >= 65.")
+@severity("critical")
+@tags("category:agent-identity,threat:supply-chain,scope:per-agent,detection:ml,surface:connect-server")
+@reject_message("MCP server connection blocked: non-first-party agent crossed trust boundaries during connection — supply-chain risk.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"connect_server",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
+    context has cross_origin_detected && context.cross_origin_detected == true &&
+    context has cross_origin_score && context.cross_origin_score >= 65
+};
+
+@id("agent-identity.a2a-block-cross-origin-sensitive-tools")
+@name("Block cross-origin on sensitive tools")
+@description("Blocks call_tool when cross_origin_detected is true, cross_origin_score >= 60, and tool_is_sensitive is true.")
+@severity("high")
+@tags("category:agent-identity,threat:supply-chain,detection:ml,surface:call-tool,owasp:llm08")
+@reject_message("Sensitive tool execution blocked: cross-origin signal present — sensitive tools amplify confused-deputy impact.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_id && context.agent_id != "" &&
+    context has cross_origin_detected && context.cross_origin_detected == true &&
+    context has cross_origin_score && context.cross_origin_score >= 60 &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+};

package/_schemas/agent_ops/templates/ported/agent-security/agent_identity_a2a_escalation.cedar

@@ -0,0 +1,99 @@
+// =============================================================================
+// A2A Security — Escalation Detection & Circuit Breakers
+// =============================================================================
+// Detects progressive capability escalation across agent turns. Lower
+// circuit-breaker thresholds than the multi-agent profile because A2A
+// communication spans separate trust domains with no shared orchestrator
+// to reset session state.
+//
+// Context keys consumed:
+//   - agent_trust_level
+//   - session_max_injection_score, session_max_jailbreak_score: Long (0-100)
+//   - session_cumulative_risk_score: Long
+//   - session_threat_turns:          Long
+//   - tool_is_sensitive:             Bool
+//
+// Compliance:
+//   - OWASP LLM01 (multi-turn); MITRE ATLAS AML.T0051
+//   - NIST 800-53 SI-4, IR-4
+//
+// Category:  agent-identity
+// Namespace: AgentOps
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: Session peak score monitoring
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.a2a-block-session-injection-peak")
+@name("Block agents at high session injection peak")
+@description("Blocks call_tool and process_prompt when agent_trust_level is not \"first_party\" and session_max_injection_score >= 70.")
+@severity("critical")
+@tags("category:agent-identity,threat:injection,scope:per-agent,detection:aggregate,owasp:llm01")
+@reject_message("Request blocked: this session previously crossed the injection peak threshold; non-first-party agents are restricted.")
+forbid (
+    principal is AgentOps::Agent,
+    action in [AgentOps::Action::"call_tool", AgentOps::Action::"process_prompt"],
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
+    context has session_max_injection_score && context.session_max_injection_score >= 70
+};
+
+@id("agent-identity.a2a-block-session-jailbreak-peak")
+@name("Block agents at high session jailbreak peak")
+@description("Blocks process_prompt when agent_trust_level is not \"first_party\" and session_max_jailbreak_score >= 70.")
+@severity("critical")
+@tags("category:agent-identity,threat:jailbreak,scope:per-agent,detection:aggregate,owasp:llm02")
+@reject_message("Request blocked: this session previously crossed the jailbreak peak threshold; non-first-party agents are restricted.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
+    context has session_max_jailbreak_score && context.session_max_jailbreak_score >= 70
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Cumulative risk circuit breaker
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.a2a-cumulative-risk-lockdown")
+@name("Block non-first-party agents at cumulative risk")
+@description("Blocks call_tool when agent_trust_level is not \"first_party\", session_cumulative_risk_score >= 151, and tool_is_sensitive is true.")
+@severity("high")
+@tags("category:agent-identity,scope:per-agent,detection:aggregate,surface:call-tool,posture:catch-all")
+@reject_message("Tool execution blocked: cumulative session risk exceeded the A2A circuit-breaker threshold for sensitive tools.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
+    context has session_cumulative_risk_score && context.session_cumulative_risk_score >= 151 &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+};
+
+// ---------------------------------------------------------------------------
+// Section 3: Threat turn escalation
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.a2a-threat-turn-escalation")
+@name("Block unverified agents after repeated threat turns")
+@description("Blocks call_tool when agent_trust_level is \"unverified\" and session_threat_turns >= 3.")
+@severity("critical")
+@tags("category:agent-identity,scope:per-agent,detection:aggregate,surface:call-tool,posture:catch-all")
+@reject_message("Tool execution blocked: 3+ threat turns in this session — unverified agents are locked out to stop adversarial probing.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
+    context has session_threat_turns && context.session_threat_turns >= 3
+};

package/_schemas/agent_ops/templates/ported/agent-security/agent_identity_a2a_identity_enforcement.cedar

@@ -0,0 +1,101 @@
+// =============================================================================
+// A2A Security — Agent Identity Enforcement
+// =============================================================================
+// Enforces strict identity requirements for cross-system agent communication:
+// blocks anonymous agents, requires framework registration for sensitive
+// operations, restricts server connections, and unconditionally blocks the
+// most dangerous combination — autonomous + unverified.
+//
+// Context keys consumed:
+//   - agent_id, agent_type, agent_trust_level, agent_framework
+//   - tool_is_sensitive: Bool
+//
+// Compliance:
+//   - OWASP ASI05 (Identity Spoofing); NIST 800-63
+//   - NIST 800-53 IA-2, IA-8
+//
+// Category:  agent-identity
+// Namespace: AgentOps
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: Anonymous agents
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.a2a-block-anonymous-agents")
+@name("Block anonymous agents from tools")
+@description("Blocks call_tool when agent_id is empty, agent_type is non-empty, and agent_type is not \"human_proxy\".")
+@severity("critical")
+@tags("category:agent-identity,threat:spoofing,scope:per-agent,detection:rule,surface:call-tool,owasp:asi04")
+@reject_message("Tool execution blocked: agent declares a type but no agent ID — improperly configured or spoofed identity.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_id && context.agent_id == "" &&
+    context has agent_type && context.agent_type != "" &&
+    context.agent_type != "human_proxy"
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Framework registration
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.a2a-block-unregistered-framework")
+@name("Block unregistered frameworks from sensitive tools")
+@description("Blocks call_tool when agent_framework is empty, agent_trust_level is \"unverified\", and tool_is_sensitive is true.")
+@severity("high")
+@tags("category:agent-identity,scope:per-agent,detection:rule,surface:call-tool")
+@reject_message("Sensitive tool execution blocked: unverified agent with no registered framework — black-box integration cannot be trusted.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_framework && context.agent_framework == "" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+};
+
+// ---------------------------------------------------------------------------
+// Section 3: MCP server connections
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.a2a-block-unverified-server-connect")
+@name("Block unverified agents from server connections")
+@description("Blocks connect_server when agent_trust_level is \"unverified\" and agent_id is non-empty.")
+@severity("high")
+@tags("category:agent-identity,threat:supply-chain,scope:per-agent,detection:rule,surface:connect-server")
+@reject_message("MCP server connection blocked: unverified agents cannot establish new server connections in A2A mode.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"connect_server",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
+    context has agent_id && context.agent_id != ""
+};
+
+// ---------------------------------------------------------------------------
+// Section 4: Maximum-risk combination
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.a2a-block-autonomous-unverified")
+@name("Block autonomous unverified agents")
+@description("Blocks call_tool when agent_type is \"autonomous\" and agent_trust_level is \"unverified\".")
+@severity("critical")
+@tags("category:agent-identity,scope:per-agent,detection:rule,surface:call-tool,owasp:asi04")
+@reject_message("Tool execution blocked: autonomous + unverified is the maximum-risk agent configuration and is not permitted.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_type && context.agent_type == "autonomous" &&
+    context has agent_trust_level && context.agent_trust_level == "unverified"
+};

package/_schemas/agent_ops/templates/ported/agent-security/agent_identity_a2a_inter_agent_injection.cedar

@@ -0,0 +1,120 @@
+// =============================================================================
+// A2A Security — Inter-Agent Injection Defence
+// =============================================================================
+// Detects and blocks prompt injection that travels between independent
+// agents: indirect injection via tool outputs, multi-turn progressive
+// attacks tracked by a GRU deep-context detector, and encoded-payload
+// delivery (base64, hex, hash content).
+//
+// Context keys consumed:
+//   - agent_id, agent_trust_level
+//   - indirect_injection_score: Long (0-100)
+//   - tool_is_sensitive:        Bool
+//   - multi_turn_detection:     Bool
+//   - injection_deep_context_score, jailbreak_deep_context_score: Long
+//   - encoded_content_detected: Bool
+//   - encoded_score:            Long
+//
+// Compliance:
+//   - OWASP LLM01 (indirect), OWASP ASI01
+//   - MITRE ATLAS AML.T0051; NIST 800-53 SI-10
+//
+// Category:  agent-identity
+// Namespace: AgentOps
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: Indirect injection
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.a2a-block-indirect-injection")
+@name("Block indirect injection from agent tool calls")
+@description("Blocks call_tool when agent_id is non-empty and indirect_injection_score >= 60.")
+@severity("critical")
+@tags("category:agent-identity,threat:indirect-injection,detection:ml,surface:call-tool,owasp:llm01")
+@reject_message("Tool execution blocked: indirect prompt injection detected in agent-received content — primary A2A attack vector.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_id && context.agent_id != "" &&
+    context has indirect_injection_score && context.indirect_injection_score >= 60
+};
+
+@id("agent-identity.a2a-block-indirect-injection-sensitive")
+@name("Block indirect injection on sensitive tools (A2A)")
+@description("Blocks call_tool when agent_id is non-empty, indirect_injection_score >= 40, and tool_is_sensitive is true.")
+@severity("critical")
+@tags("category:agent-identity,threat:indirect-injection,detection:ml,surface:call-tool,owasp:asi01")
+@reject_message("Sensitive tool execution blocked: moderate indirect-injection risk in agent content — sensitive tools amplify damage.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_id && context.agent_id != "" &&
+    context has indirect_injection_score && context.indirect_injection_score >= 40 &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Multi-turn progressive attacks
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.a2a-block-deep-context-injection")
+@name("Block multi-turn progressive injection")
+@description("Blocks process_prompt when agent_trust_level is not \"first_party\", multi_turn_detection is true, and injection_deep_context_score >= 60.")
+@severity("high")
+@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,owasp:llm01")
+@reject_message("Prompt blocked: multi-turn progressive injection detected by the deep-context model across conversation history.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
+    context has multi_turn_detection && context.multi_turn_detection == true &&
+    context has injection_deep_context_score && context.injection_deep_context_score >= 60
+};
+
+@id("agent-identity.a2a-block-deep-context-jailbreak")
+@name("Block multi-turn progressive jailbreak")
+@description("Blocks process_prompt when agent_trust_level is not \"first_party\", multi_turn_detection is true, and jailbreak_deep_context_score >= 60.")
+@severity("high")
+@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,owasp:llm02")
+@reject_message("Prompt blocked: multi-turn progressive jailbreak detected by the deep-context model across conversation history.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level != "first_party" &&
+    context has multi_turn_detection && context.multi_turn_detection == true &&
+    context has jailbreak_deep_context_score && context.jailbreak_deep_context_score >= 60
+};
+
+// ---------------------------------------------------------------------------
+// Section 3: Encoded payload delivery
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.a2a-block-encoded-injection")
+@name("Block encoded payload delivery between agents")
+@description("Blocks process_prompt and call_tool when agent_id is non-empty, encoded_content_detected is true, and encoded_score >= 60.")
+@severity("high")
+@tags("category:agent-identity,threat:encoded-payload,detection:pattern,owasp:llm01")
+@reject_message("Request blocked: encoded payload detected in agent communication — agents should exchange plaintext, not encoded content.")
+forbid (
+    principal is AgentOps::Agent,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has agent_id && context.agent_id != "" &&
+    context has encoded_content_detected && context.encoded_content_detected == true &&
+    context has encoded_score && context.encoded_score >= 60
+};

package/_schemas/agent_ops/templates/ported/agent-security/agent_identity_claude_block_injection.cedar

@@ -0,0 +1,30 @@
+// =============================================================================
+// Agent-Specific Guardrails
+// =============================================================================
+// Per-agent security policies applied based on the agent identity. Different
+// agents have different risk profiles — this template rule covers Claude
+// (injection focus); customize the agent IDs for your deployment. PII is
+// handled uniformly by the canonical privacy.* templates (defaults/pii*.cedar),
+// not per-agent.
+//
+// Context keys consumed:
+//   - detected_threats:  Set<String>
+//
+// Category:  agent-identity
+// Namespace: AgentOps
+// =============================================================================
+
+@id("agent-identity.claude-block-injection")
+@name("Block injection on Claude agent")
+@description("Blocks process_prompt for the Claude agent when detected_threats contains \"prompt_injection\".")
+@severity("critical")
+@tags("category:agent-identity,threat:injection,scope:per-agent,detection:rule,surface:process-prompt,owasp:llm01")
+@reject_message("Prompt blocked: prompt injection detected for the Claude agent.")
+forbid (
+    principal == AgentOps::Agent::"claude",
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    context has detected_threats && context.detected_threats.contains("prompt_injection")
+};

package/_schemas/agent_ops/templates/ported/agent-security/agent_identity_defaults.cedar

@@ -0,0 +1,122 @@
+// =============================================================================
+// Agent Identity & Trust (Default)
+// =============================================================================
+// Trust-based access control for AI agents authenticated via API key or JWT
+// with agent claims. Uses identity context keys populated from Shield's
+// authentication layer.
+//
+// Agent trust levels:
+//   - first_party:          Your own agents (highest trust)
+//   - verified_third_party: Audited external agents (medium trust)
+//   - unverified:           Unknown/untrusted agents (lowest trust)
+//
+// Agent types:
+//   - orchestrator, autonomous, tool_agent, human_proxy
+//
+// Context keys consumed:
+//   - agent_id, agent_type, agent_trust_level, agent_framework, agent_publisher
+//   - tool_name, tool_category, tool_is_sensitive, tool_risk_score
+//   - injection_score
+//   - session_threat_turns
+//
+// Category:  agent-identity
+// Namespace: AgentOps
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: Trust-based tool access
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.block-unverified-dangerous-tools")
+@name("Block unverified agents from dangerous tools")
+@description("Blocks call_tool when agent_trust_level is \"unverified\" and tool_category is \"dangerous\".")
+@severity("critical")
+@tags("category:agent-identity,scope:per-agent,detection:rule,surface:call-tool")
+@reject_message("Tool execution blocked: unverified agents cannot execute dangerous tools.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
+    context has tool_category && context.tool_category == "dangerous"
+};
+
+@id("agent-identity.block-unverified-shell")
+@name("Block unverified agents from shell execution")
+@description("Blocks call_tool when agent_trust_level is \"unverified\" and tool_name is a shell tool.")
+@severity("critical")
+@tags("category:agent-identity,threat:command-injection,scope:per-agent,detection:rule,surface:call-tool")
+@reject_message("Tool execution blocked: shell and command execution require a verified agent.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
+    context has tool_name &&
+    (
+        context.tool_name == "shell" ||
+        context.tool_name == "execute_command" ||
+        context.tool_name == "bash"
+    )
+};
+
+@id("agent-identity.block-unverified-sensitive-tools")
+@name("Block unverified agents from sensitive tools")
+@description("Blocks call_tool when agent_trust_level is \"unverified\", tool_is_sensitive is true, and tool_risk_score >= 61.")
+@severity("high")
+@tags("category:agent-identity,scope:per-agent,detection:aggregate,surface:call-tool")
+@reject_message("Tool execution blocked: unverified agent attempted a sensitive tool with elevated risk.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true &&
+    context has tool_risk_score && context.tool_risk_score >= 61
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Autonomous-agent restrictions
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.block-autonomous-injection")
+@name("Block injection on autonomous agents")
+@description("Blocks process_prompt when agent_type is \"autonomous\" and injection_score >= 51.")
+@severity("high")
+@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,owasp:llm01")
+@reject_message("Prompt blocked: lower injection threshold applies to autonomous agents and was exceeded.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    context has agent_type && context.agent_type == "autonomous" &&
+    context has injection_score && context.injection_score >= 51
+};
+
+// ---------------------------------------------------------------------------
+// Section 3: Cross-turn enforcement
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.block-unverified-after-threats")
+@name("Block unverified agents after session threats")
+@description("Blocks call_tool when agent_trust_level is \"unverified\" and session_threat_turns >= 1.")
+@severity("critical")
+@tags("category:agent-identity,scope:per-agent,detection:aggregate,surface:call-tool")
+@reject_message("Tool execution blocked: prior turns in this session detected threats; unverified agents cannot continue.")
+forbid (
+    principal is AgentOps::Agent,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
+    context has session_threat_turns && context.session_threat_turns >= 1
+};