@highflame/policy 2.2.31 → 2.2.32

package/_schemas/agent_ops/templates/ported/tool-permissioning/tools_bash_operation_classes.cedar

@@ -0,0 +1,142 @@
+// =============================================================================
+// Tool Permissioning: Bash AST operation classes (Opt-in)
+// =============================================================================
+// Tiered shell control driven by Shield's bash_ast classifier. The classifier
+// parses every shell command (bash, sh, zsh, dash) into an AST and emits
+// tool_operation_classes, a set drawn from:
+//
+//   readonly | network_access | write_enabling | execute_enabling | unknown
+//
+// One command can carry several classes ("curl -o f https://x" is
+// {network_access, write_enabling}). "unknown" means the classifier saw a
+// command it cannot vouch for (not in its command lists, or variable
+// expanded) and is a reason to deny, never to allow. The set is never empty,
+// so every shell command lands in at least one section below.
+//
+// Posture per class when this template is active:
+//
+//   readonly          -> allowed silently
+//   network_access    -> blocked (Section 1)
+//   write_enabling    -> blocked (Section 2)
+//   execute_enabling  -> step-up human approval (Section 3)
+//   unknown           -> step-up human approval (Section 3)
+//
+// Together, Sections 1 and 3 close the side door where an operation denied
+// as an MCP tool is replayed through the shell: recognized network
+// primitives (curl, ssh, nc) are blocked outright, and unrecognized CLI
+// clients (gh, aws) classify as "unknown" and require human approval. No
+// shell command reaches the network or executes silently unless it is
+// purely read-only.
+//
+// Section 3 carries @step_up_required (AARM R4, CAP-ENF-004): Shield
+// suspends the command and issues an OpenID CIBA challenge; the command
+// runs only after an approver carrying the named AuthN role approves it,
+// and the timeout denies it (fail-closed). Customize before deploying:
+//   - role: must exist in authn.roles ("security_oncall" is a placeholder;
+//     unknown roles reject the policy at deploy time)
+//   - timeout_seconds: default 86400 (24h), bounds [60, 604800]
+//
+// Context keys consumed:
+//   - tool_operation_classes: Set<String>
+//
+// Compliance:
+//   - NIST 800-53 CM-7, AC-6(1); OWASP LLM06, ASI02; MITRE ATT&CK T1059
+//
+// Category:  tools
+// Namespace: AgentOps
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: Network access
+// ---------------------------------------------------------------------------
+// Recognized network primitives: curl, wget, ssh, scp, nc, rsync, dig, nmap.
+// Blocking this class forces network operations back through MCP tools,
+// where per-tool policies apply.
+
+@id("tools.block-bash-network")
+@name("Block network access from shell commands")
+@description("Blocks call_tool when the bash AST classifier marks the command network_access (curl, wget, ssh, nc), closing the side door where an operation denied as an MCP tool is replayed through the shell.")
+@severity("high")
+@tags("category:tools,threat:exfiltration,detection:rule,surface:call-tool,owasp:asi02")
+@reject_message("Tool execution blocked: network access from shell commands is restricted; use the approved MCP tool for this operation.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has tool_operation_classes &&
+    context.tool_operation_classes.contains("network_access")
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Filesystem and environment writes
+// ---------------------------------------------------------------------------
+// rm, mv, cp, chmod, dd, sed -i, output redirects (>, >>, &>), and
+// environment mutation (export VAR=val, unset).
+
+@id("tools.block-bash-write")
+@name("Block filesystem and environment writes from shell")
+@description("Blocks call_tool when the bash AST classifier marks the command write_enabling (rm, mv, sed -i, output redirects, environment mutation).")
+@severity("high")
+@tags("category:tools,detection:rule,surface:call-tool,owasp:asi02,mitre:t1059")
+@reject_message("Tool execution blocked: filesystem and environment modification from shell commands is restricted in this environment.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has tool_operation_classes &&
+    context.tool_operation_classes.contains("write_enabling")
+};
+
+// ---------------------------------------------------------------------------
+// Section 3: Execute-enabling and unrecognized commands (step-up approval)
+// ---------------------------------------------------------------------------
+// Process spawning and sub-interpreters ($(...), python3, sudo, PATH=
+// hijacks) plus any command the classifier could not recognize. Routed to
+// human approval rather than blocked: these classes cover a large legitimate
+// surface (build scripts, interpreters, CLI clients), so a human decides.
+//
+// Cedar is deny-overrides and Shield emits step-up only when the decision is
+// Allow, so this permit must not coexist with a forbid on the same classes.
+// To hard-block instead of gating on approval, replace this rule with:
+//
+//   @id("tools.block-bash-execute-unknown")
+//   @name("Block execute-enabling and unknown shell commands")
+//   @description("Blocks call_tool when the bash AST classifier marks the command execute_enabling (spawns processes or sub-interpreters) or unknown (unrecognized or variable-expanded commands).")
+//   @severity("critical")
+//   @tags("category:tools,threat:command-injection,detection:rule,surface:call-tool,owasp:llm06,mitre:t1059")
+//   @reject_message("Tool execution blocked: the shell command spawns processes or contains commands that cannot be classified.")
+//   forbid (
+//       principal,
+//       action == AgentOps::Action::"call_tool",
+//       resource
+//   )
+//   when {
+//       context has tool_operation_classes &&
+//       (
+//           context.tool_operation_classes.contains("execute_enabling") ||
+//           context.tool_operation_classes.contains("unknown")
+//       )
+//   };
+
+@id("tools.allow-bash-step-up")
+@name("Permit risky shell commands with step-up approval")
+@description("Permits call_tool but suspends it for human approval when the bash AST classifier marks the command execute_enabling or unknown; an approver with the configured AuthN role must approve before the command runs.")
+@severity("high")
+@tags("category:tools,threat:command-injection,surface:call-tool,mitre:t1059,step-up")
+@step_up_required("role=security_oncall,timeout_seconds=3600")
+permit (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has tool_operation_classes &&
+    (
+        context.tool_operation_classes.contains("execute_enabling") ||
+        context.tool_operation_classes.contains("unknown")
+    )
+};

package/_schemas/agent_ops/templates/ported/tool-permissioning/tools_block_shell.cedar

@@ -0,0 +1,40 @@
+// =============================================================================
+// Tool Permissioning — Shell execution block (Opt-in)
+// =============================================================================
+// Blocks shell and command execution tools. Inactive unless explicitly enabled
+// because it blocks ALL shell access (including safe commands like git and
+// echo). Intended for high-security environments where shell access is
+// prohibited.
+//
+// Context keys consumed:
+//   - tool_name: String
+//
+// Compliance:
+//   - NIST 800-53 CM-7; OWASP LLM06; MITRE ATT&CK T1059
+//
+// Category:  tools
+// Namespace: AgentOps
+// =============================================================================
+
+@id("tools.block-shell")
+@name("Block shell and command execution")
+@description("Blocks call_tool when tool_name is shell, bash, sh, terminal, cmd, or powershell.")
+@severity("critical")
+@tags("category:tools,threat:command-injection,detection:rule,surface:call-tool,owasp:llm06,mitre:t1059")
+@reject_message("Tool execution blocked: shell/command execution is restricted in this environment.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has tool_name &&
+    (
+        context.tool_name == "shell" ||
+        context.tool_name == "bash" ||
+        context.tool_name == "sh" ||
+        context.tool_name == "terminal" ||
+        context.tool_name == "cmd" ||
+        context.tool_name == "powershell"
+    )
+};

package/_schemas/agent_ops/templates/ported/tool-permissioning/tools_defaults.cedar

@@ -0,0 +1,76 @@
+// =============================================================================
+// Tool Permissioning (Default)
+// =============================================================================
+// Sensitive system-path file access and destructive MCP file-operation
+// blocking. Shell-execution blocking lives in tools_shell_block.cedar as a
+// separate opt-in template and is not bundled with this default.
+//
+// Context keys consumed:
+//   - path:      String
+//   - tool_name: String
+//
+// Compliance:
+//   - NIST 800-53 AC-3, AC-6, CM-7
+//   - OWASP ASI02; MITRE ATT&CK T1005
+//
+// Category:  tools
+// Namespace: AgentOps
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: Sensitive system paths
+// ---------------------------------------------------------------------------
+
+@id("tools.block-system-paths")
+@name("Block system directory access")
+@description("Blocks read_file and write_file when path matches a sensitive Linux or macOS system directory.")
+@severity("high")
+@tags("category:tools,threat:path-traversal,detection:pattern,mitre:t1005")
+@reject_message("File access blocked: sensitive system directory targeted (/etc, /proc, /sys, /root, /var, /System, /Library, /private).")
+forbid (
+    principal,
+    action in [AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    resource
+)
+when {
+    context has path &&
+    (
+        context.path like "/etc/*" ||
+        context.path like "/proc/*" ||
+        context.path like "/sys/*" ||
+        context.path like "/root/*" ||
+        context.path like "/var/log/*" ||
+        context.path like "/var/run/*" ||
+        context.path like "/private/etc/*" ||
+        context.path like "/private/var/*" ||
+        context.path like "/Library/*" ||
+        context.path like "/System/*"
+    )
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Destructive MCP file operations
+// ---------------------------------------------------------------------------
+
+@id("tools.block-destructive-ops")
+@name("Block destructive file operations")
+@description("Blocks call_tool when tool_name is a destructive MCP file operation.")
+@severity("high")
+@tags("category:tools,detection:rule,surface:call-tool,owasp:asi02")
+@reject_message("Tool execution blocked: destructive file operations (delete, rmdir, unlink) require explicit human approval.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has tool_name &&
+    (
+        context.tool_name == "fs.delete" ||
+        context.tool_name == "fs.rmdir" ||
+        context.tool_name == "fs.unlink" ||
+        context.tool_name == "fs.remove" ||
+        context.tool_name == "delete_file" ||
+        context.tool_name == "remove_directory"
+    )
+};

package/_schemas/agent_ops/templates/ported/tool-permissioning/tools_mcp_server_allowlist.cedar

@@ -0,0 +1,41 @@
+// =============================================================================
+// MCP Server Allowlist
+// =============================================================================
+// Restricts MCP server connections to a pre-approved list. Customize the
+// `context.mcp_server` values in the permit rule to match the allowed
+// servers for your environment.
+//
+// Context keys consumed:
+//   - mcp_server: String
+//
+// Category:  tools
+// Namespace: AgentOps
+// =============================================================================
+
+@id("tools.allow-mcp-allowlist")
+@name("Allow allowlisted MCP servers")
+@description("Permits connect_server when mcp_server is in the allowlist.")
+@severity("medium")
+@tags("category:tools,surface:connect-server,scope:org-wide,posture:deny-default")
+permit (
+    principal,
+    action == AgentOps::Action::"connect_server",
+    resource
+)
+when {
+    context has mcp_server &&
+    (context.mcp_server == "filesystem" ||
+     context.mcp_server == "playwright")
+};
+
+@id("tools.deny-non-allowlisted-mcp")
+@name("Block non-allowlisted MCP servers")
+@description("Blocks connect_server unconditionally so only the allowlist permit applies.")
+@severity("medium")
+@tags("category:tools,surface:connect-server,scope:org-wide,posture:deny-default")
+@reject_message("MCP server connection blocked: server is not on the allowlist.")
+forbid (
+    principal,
+    action == AgentOps::Action::"connect_server",
+    resource
+);

package/_schemas/agent_ops/templates/ported/tool-permissioning/tools_mcp_tool_permissions.cedar

@@ -0,0 +1,103 @@
+// =============================================================================
+// MCP Tool Permissions
+// =============================================================================
+// Per-tool access control for MCP servers — fine-grained permissioning that
+// allows specific tools from a server while denying others.
+//
+// Bundled rules cover:
+//   - GitHub MCP example: permit read tools, block write tools
+//   - Org-wide exclusion list (untrusted / deprecated servers)
+//   - Unverified MCP server block
+//
+// Context keys consumed:
+//   - mcp_server:           String
+//   - tool_name:            String
+//   - mcp_server_verified:  Bool
+//
+// Category:  tools
+// Namespace: AgentOps
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: Example — GitHub MCP read/write split
+// ---------------------------------------------------------------------------
+
+@id("tools.allow-github-mcp-read")
+@name("Allow GitHub MCP read tools")
+@description("Permits call_tool when mcp_server is \"github\" and tool_name is a read-only operation.")
+@severity("medium")
+@tags("category:tools,scope:per-tool,surface:call-tool,posture:deny-default")
+permit (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has mcp_server && context.mcp_server == "github" &&
+    context has tool_name &&
+    (
+        context.tool_name == "read_issues" ||
+        context.tool_name == "get_issue" ||
+        context.tool_name == "list_repos" ||
+        context.tool_name == "get_pull_request" ||
+        context.tool_name == "search_code" ||
+        context.tool_name == "get_file_contents"
+    )
+};
+
+@id("tools.block-github-mcp-write")
+@name("Block GitHub MCP write tools")
+@description("Blocks call_tool when mcp_server is \"github\"; combine with the read-allow permit above.")
+@severity("high")
+@tags("category:tools,scope:per-tool,surface:call-tool,posture:deny-default")
+@reject_message("Tool execution blocked: write operations against the GitHub MCP server are not permitted.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has mcp_server && context.mcp_server == "github"
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Org-wide exclusion list
+// ---------------------------------------------------------------------------
+
+@id("tools.exclude-mcp-servers")
+@name("Block excluded MCP servers")
+@description("Blocks call_tool when mcp_server is in the org-wide exclusion list.")
+@severity("critical")
+@tags("category:tools,scope:org-wide,surface:call-tool,posture:deny-default")
+@reject_message("Tool execution blocked: MCP server is on the org-wide exclusion list.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has mcp_server &&
+    (
+        context.mcp_server == "untrusted-server" ||
+        context.mcp_server == "deprecated-server"
+    )
+};
+
+// ---------------------------------------------------------------------------
+// Section 3: Unverified server block
+// ---------------------------------------------------------------------------
+
+@id("tools.block-unverified-mcp-tools")
+@name("Block unverified MCP server tools")
+@description("Blocks call_tool when mcp_server_verified is false.")
+@severity("high")
+@tags("category:tools,threat:supply-chain,detection:rule,surface:call-tool")
+@reject_message("Tool execution blocked: MCP server is not from a verified registry.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has mcp_server_verified && context.mcp_server_verified == false
+};