@highflame/policy 2.2.31 → 2.2.33

package/_schemas/agent_ops/templates/ported/data-protection/privacy_pii_model.cedar

@@ -0,0 +1,90 @@
+// =============================================================================
+// Contextual PII (Tier 2)
+// =============================================================================
+// Blocks the same high-sensitivity identifier groups inferred from surrounding context by the ML PII model — catches unstructured or novel PII the structural patterns miss (higher recall). Requires the pii_model detector.
+//
+// Sensitivity tiers and the structural (regex) / contextual (model) type
+// vocabulary are defined canonically in schemas/_shared/pii_taxonomy.json and
+// enforced by tools/lint-templates.
+//
+// Context keys consumed:
+//   - pii_types: Set<String>  (union of structural lowercase + contextual uppercase types)
+//
+// Category:  privacy
+// Namespace: AgentOps
+// =============================================================================
+
+@id("privacy.block-pii-national-id-model")
+@name("Block national ID numbers (contextual)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain a national ID (SSN, passport, or driver's license).")
+@severity("high")
+@tags("category:privacy,threat:pii,detection:ml,owasp:llm06")
+@reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types && context.pii_types.contains("NATIONAL_ID")
+};
+
+@id("privacy.block-pii-credit-card-model")
+@name("Block credit card numbers (contextual)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain a credit card number.")
+@severity("critical")
+@tags("category:privacy,threat:pii,detection:ml,compliance:pci-dss,owasp:llm06")
+@reject_message("Content blocked: credit card number patterns detected.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types && context.pii_types.contains("CREDIT_CARD")
+};
+
+@id("privacy.block-pii-bank-account-model")
+@name("Block bank account numbers (contextual)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain a bank account number (IBAN, SWIFT/BIC, or routing number).")
+@severity("critical")
+@tags("category:privacy,threat:pii,detection:ml,owasp:llm06")
+@reject_message("Content blocked: bank account (IBAN) number patterns detected.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types && context.pii_types.contains("ACCOUNT_NUMBER")
+};
+
+@id("privacy.block-pii-medical-model")
+@name("Block medical identifiers (contextual)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain medical data (record number, MBI, NPI, or blood type).")
+@severity("medium")
+@tags("category:privacy,threat:pii,detection:ml,compliance:hipaa,owasp:llm06")
+@reject_message("Content blocked: medical record identifier patterns detected.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types && context.pii_types.contains("MEDICAL")
+};
+
+@id("privacy.block-pii-credential-model")
+@name("Block credentials (contextual)")
+@description("Blocks prompts, tool calls, and file reads/writes that contain a credential or secret (API key, token, password hash, or private key).")
+@severity("critical")
+@tags("category:privacy,threat:pii,detection:ml,owasp:llm06")
+@reject_message("Content blocked: credential or API key patterns detected.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    resource
+)
+when {
+    context has pii_types && context.pii_types.contains("CREDENTIAL")
+};

package/_schemas/agent_ops/templates/ported/organization/organization_deny_baseline.cedar

@@ -0,0 +1,22 @@
+// =============================================================================
+// Default Deny All
+// =============================================================================
+// Org-wide baseline that blocks everything unless explicitly permitted by
+// other policies. Pair with scoped permit rules (e.g. team_permissions) for
+// a deny-by-default posture.
+//
+// Category:  organization
+// Namespace: AgentOps
+// =============================================================================
+
+@id("organization.deny-baseline")
+@name("Block all actions (deny baseline)")
+@description("Blocks all actions; pair with scoped permit rules for a deny-by-default posture.")
+@severity("high")
+@tags("category:organization,posture:deny-default,scope:org-wide")
+@reject_message("Request blocked: this organization uses a deny-by-default baseline — only explicitly permitted actions are allowed.")
+forbid (
+    principal,
+    action,
+    resource
+);

package/_schemas/agent_ops/templates/ported/organization/organization_team_permissions.cedar

@@ -0,0 +1,38 @@
+// =============================================================================
+// Project-Based Permissions (ReBAC)
+// =============================================================================
+// Grants IDE access based on project membership using Cedar's entity
+// hierarchy. Resources (Tool, Server, FilePath, etc.) are parented under
+// Project, so `resource in Project::"..."` matches all resources scoped
+// to that project.
+//
+// Entity hierarchy required:
+//   Account::"acme-corp"
+//     ├── Project::"dev-project"
+//     └── Project::"support-project"
+//
+// Category:  organization
+// Namespace: AgentOps
+// =============================================================================
+
+@id("organization.allow-dev-project")
+@name("Permit dev project full access")
+@description("Permits all actions on resources scoped to Project::\"dev-project\".")
+@severity("medium")
+@tags("category:organization,scope:per-tool,posture:deny-default")
+permit (
+    principal,
+    action,
+    resource in AgentOps::Project::"dev-project"
+);
+
+@id("organization.allow-support-project-read")
+@name("Permit support project read-only access")
+@description("Permits process_prompt and read_file actions on resources scoped to Project::\"support-project\".")
+@severity("medium")
+@tags("category:organization,scope:per-tool,posture:deny-default")
+permit (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"read_file"],
+    resource in AgentOps::Project::"support-project"
+);

package/_schemas/agent_ops/templates/ported/threat-detection/security_advanced_block_critical_severity.cedar

@@ -0,0 +1,30 @@
+// =============================================================================
+// Advanced Detection — Threat Severity
+// =============================================================================
+// Catch-all that blocks any content flagged as critical severity by any
+// detector. Acts as a safety net behind all other policies.
+//
+// Context keys consumed:
+//   - highest_severity: String
+//
+// Compliance:
+//   - NIST 800-53 SI-3, SI-4
+//
+// Category:  security
+// Namespace: AgentOps
+// =============================================================================
+
+@id("security.advanced-block-critical-severity")
+@name("Block critical-severity threats")
+@description("Blocks process_prompt when highest_severity equals \"critical\".")
+@severity("critical")
+@tags("category:security,detection:aggregate,surface:process-prompt,posture:catch-all,compliance:nist-si-3")
+@reject_message("Prompt blocked: a critical-severity threat was reported by at least one detector.")
+forbid (
+    principal,
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    context has highest_severity && context.highest_severity == "critical"
+};

package/_schemas/agent_ops/templates/ported/threat-detection/security_chat_assistant.cedar

@@ -0,0 +1,47 @@
+// =============================================================================
+// Chat Assistant — Security
+// =============================================================================
+// Aggressive injection and jailbreak defence for customer-facing chatbots.
+// Lower thresholds than the org-wide defaults — public-facing chat has the
+// highest adversarial surface.
+//
+// Context keys consumed:
+//   - injection_score:  Long (0-100)
+//   - jailbreak_score:  Long (0-100)
+//
+// Compliance:
+//   - OWASP LLM01, OWASP LLM02
+//
+// Category:  security
+// Namespace: AgentOps
+// =============================================================================
+
+@id("security.chat-block-injection")
+@name("Block injection (chat profile)")
+@description("Blocks process_prompt and call_tool when injection_score >= 71 (lower threshold for public chat).")
+@severity("high")
+@tags("category:security,threat:injection,detection:ml,owasp:llm01")
+@reject_message("Prompt blocked: prompt injection detected with high confidence (chat profile).")
+forbid (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has injection_score && context.injection_score >= 71
+};
+
+@id("security.chat-block-jailbreak")
+@name("Block jailbreak (chat profile)")
+@description("Blocks process_prompt when jailbreak_score >= 66 (lower threshold for public chat).")
+@severity("high")
+@tags("category:security,threat:jailbreak,detection:ml,owasp:llm02")
+@reject_message("Prompt blocked: jailbreak attempt detected with high confidence (chat profile).")
+forbid (
+    principal,
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    context has jailbreak_score && context.jailbreak_score >= 66
+};

package/_schemas/agent_ops/templates/ported/threat-detection/security_data_pipeline_block_injection.cedar

@@ -0,0 +1,31 @@
+// =============================================================================
+// Data Pipeline — Security
+// =============================================================================
+// Aggressive injection defence for RAG inputs and data processing — these
+// pipelines consume external content as trusted input and have the highest
+// adversarial surface for indirect injection.
+//
+// Context keys consumed:
+//   - injection_score: Long (0-100)
+//
+// Compliance:
+//   - OWASP LLM01
+//
+// Category:  security
+// Namespace: AgentOps
+// =============================================================================
+
+@id("security.data-pipeline-block-injection")
+@name("Block pipeline injection (data-pipeline profile)")
+@description("Blocks process_prompt and call_tool when injection_score >= 66 (lower threshold for data pipelines).")
+@severity("high")
+@tags("category:security,threat:injection,detection:ml,owasp:llm01")
+@reject_message("Request blocked: prompt injection detected at the data-pipeline threshold — RAG inputs are high-risk for indirect injection.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has injection_score && context.injection_score >= 66
+};

package/_schemas/agent_ops/templates/ported/threat-detection/security_injection.cedar

@@ -0,0 +1,82 @@
+// =============================================================================
+// Injection & Jailbreak Detection (Default)
+// =============================================================================
+// Blocks prompt injection and jailbreak attempts using ML classifier
+// confidence scores plus an invisible-character defence for encoded
+// injection payloads.
+//
+// Context keys consumed:
+//   - injection_score:           Long (0-100)
+//   - jailbreak_score:           Long (0-100)
+//   - invisible_chars_detected:  Bool
+//   - invisible_chars_score:     Long (0-100)
+//
+// Compliance:
+//   - OWASP LLM01, OWASP LLM02
+//   - MITRE ATLAS AML.T0051, AML.T0054
+//
+// Category:  security
+// Namespace: AgentOps
+// =============================================================================
+
+@id("security.block-injection-ml")
+@name("Block injection (ML)")
+@description("Blocks process_prompt and call_tool when injection_score >= 86.")
+@severity("high")
+@tags("category:security,threat:injection,detection:ml,owasp:llm01,mitre:atlas-t0051")
+@reject_message("Prompt blocked: the ML classifier detected prompt injection with high confidence.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has injection_score && context.injection_score >= 86
+};
+
+@id("security.block-jailbreak-ml")
+@name("Block jailbreak (ML)")
+@description("Blocks process_prompt when jailbreak_score >= 81.")
+@severity("high")
+@tags("category:security,threat:jailbreak,detection:ml,owasp:llm02,mitre:atlas-t0054")
+@reject_message("Prompt blocked: the ML classifier detected a jailbreak attempt with high confidence.")
+forbid (
+    principal,
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    context has jailbreak_score && context.jailbreak_score >= 81
+};
+
+@id("security.block-injection-combined")
+@name("Block injection + jailbreak (combined)")
+@description("Blocks process_prompt when injection_score >= 61 and jailbreak_score >= 61.")
+@severity("high")
+@tags("category:security,threat:injection,threat:jailbreak,detection:ml")
+@reject_message("Prompt blocked: moderate injection and jailbreak signals were detected together.")
+forbid (
+    principal,
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    context has injection_score && context has jailbreak_score &&
+    context.injection_score >= 61 && context.jailbreak_score >= 61
+};
+
+@id("security.block-invisible-chars")
+@name("Block invisible-character injection")
+@description("Blocks process_prompt when invisible_chars_detected is true and invisible_chars_score >= 51.")
+@severity("high")
+@tags("category:security,threat:invisible-chars,threat:injection,detection:pattern")
+@reject_message("Prompt blocked: invisible Unicode characters often used for injection were detected.")
+forbid (
+    principal,
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    context has invisible_chars_detected && context.invisible_chars_detected == true &&
+    context has invisible_chars_score && context.invisible_chars_score >= 51
+};

package/_schemas/agent_ops/templates/ported/threat-detection/security_patterns.cedar

@@ -0,0 +1,72 @@
+// =============================================================================
+// Security Pattern Detection (Default)
+// =============================================================================
+// Blocks command injection, path traversal, and SQL injection using
+// regex-based pattern detection from Shield's security detectors.
+//
+// Context keys consumed:
+//   - command_injection_detected:  Bool
+//   - path_traversal_detected:     Bool
+//   - path_traversal_severity:     String
+//   - sql_injection_detected:      Bool
+//   - sql_injection_score:         Long (0-100)
+//
+// Compliance:
+//   - MITRE T1059 (Command Injection), T1005 (Data from Local System)
+//
+// Category:  security
+// Namespace: AgentOps
+// =============================================================================
+
+@id("security.block-command-injection")
+@name("Block command injection")
+@description("Blocks process_prompt and call_tool when command_injection_detected is true.")
+@severity("critical")
+@tags("category:security,threat:command-injection,detection:pattern,mitre:t1059")
+@reject_message("Request blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has command_injection_detected && context.command_injection_detected == true
+};
+
+@id("security.block-path-traversal")
+@name("Block path traversal")
+@description("Blocks process_prompt, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")
+@severity("high")
+@tags("category:security,threat:path-traversal,detection:pattern,mitre:t1005")
+@reject_message("Request blocked: path traversal pattern detected — sensitive system files or deep directory traversal.")
+forbid (
+    principal,
+    action in [
+        AgentOps::Action::"process_prompt",
+        AgentOps::Action::"call_tool",
+        AgentOps::Action::"read_file",
+        AgentOps::Action::"write_file"
+    ],
+    resource
+)
+when {
+    context has path_traversal_detected && context.path_traversal_detected == true &&
+    context has path_traversal_severity &&
+    (context.path_traversal_severity == "critical" || context.path_traversal_severity == "high")
+};
+
+@id("security.block-sql-injection")
+@name("Block SQL injection")
+@description("Blocks process_prompt and call_tool when sql_injection_detected is true and sql_injection_score >= 75.")
+@severity("high")
+@tags("category:security,threat:sql-injection,detection:pattern")
+@reject_message("Request blocked: SQL injection pattern detected — tautology, UNION attack, or destructive query.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has sql_injection_detected && context.sql_injection_detected == true &&
+    context has sql_injection_score && context.sql_injection_score >= 75
+};

package/_schemas/agent_ops/templates/ported/threat-detection/semantic_defaults.cedar

@@ -0,0 +1,155 @@
+// =============================================================================
+// Semantic Threat Detection (Default)
+// =============================================================================
+// Blocks injection attacks (command, SQL, path traversal), prompt injection,
+// jailbreak attempts, and encoded payloads using two detection tiers:
+//
+//   Tier 1 — Pattern-based (always available, no external dependency)
+//     command_injection, sql_injection, path_traversal, detect_encoded
+//
+//   Tier 2 — ML classifiers (require Highflame API token)
+//     injection_score, jailbreak_score
+//
+// Content-safety rules (violence, hate, sexual, etc.) live in content_safety.cedar.
+//
+// Context keys consumed:
+//   - detected_threats: Set<String>
+//   - injection_score:  Long (0-100)
+//   - jailbreak_score:  Long (0-100)
+//
+// Compliance:
+//   - OWASP LLM01, LLM02; OWASP ASI01, ASI02
+//   - MITRE ATLAS AML.T0051, AML.T0054; MITRE ATT&CK T1059, T1005
+//   - NIST 800-53 SI-3, SI-4
+//
+// Category:  semantic
+// Namespace: AgentOps
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Tier 1: Pattern-based injection detection
+// ---------------------------------------------------------------------------
+
+@id("semantic.block-command-injection-tool")
+@name("Block command injection in tool calls")
+@description("Blocks call_tool when detected_threats contains \"command_injection\".")
+@severity("critical")
+@tags("category:semantic,threat:command-injection,detection:pattern,surface:call-tool,mitre:t1059,owasp:asi02")
+@reject_message("Tool execution blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has detected_threats && context.detected_threats.contains("command_injection")
+};
+
+@id("semantic.block-command-injection-prompt")
+@name("Block command injection in prompts")
+@description("Blocks process_prompt when detected_threats contains \"command_injection\".")
+@severity("critical")
+@tags("category:semantic,threat:command-injection,detection:pattern,surface:process-prompt,mitre:t1059")
+@reject_message("Prompt blocked: command injection pattern detected.")
+forbid (
+    principal,
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    context has detected_threats && context.detected_threats.contains("command_injection")
+};
+
+@id("semantic.block-sql-injection-tool")
+@name("Block SQL injection in tool calls")
+@description("Blocks call_tool when detected_threats contains \"sql_injection\".")
+@severity("high")
+@tags("category:semantic,threat:sql-injection,detection:pattern,surface:call-tool")
+@reject_message("Tool execution blocked: SQL injection pattern detected — tautology, UNION attack, or destructive query.")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has detected_threats && context.detected_threats.contains("sql_injection")
+};
+
+@id("semantic.block-sql-injection-prompt")
+@name("Block SQL injection in prompts")
+@description("Blocks process_prompt when detected_threats contains \"sql_injection\".")
+@severity("high")
+@tags("category:semantic,threat:sql-injection,detection:pattern,surface:process-prompt")
+@reject_message("Prompt blocked: SQL injection pattern detected.")
+forbid (
+    principal,
+    action == AgentOps::Action::"process_prompt",
+    resource
+)
+when {
+    context has detected_threats && context.detected_threats.contains("sql_injection")
+};
+
+@id("semantic.block-path-traversal")
+@name("Block path traversal")
+@description("Blocks call_tool, read_file, and write_file when detected_threats contains \"path_traversal\".")
+@severity("high")
+@tags("category:semantic,threat:path-traversal,detection:pattern,mitre:t1005")
+@reject_message("Request blocked: path traversal pattern detected — sensitive system files or deep directory traversal.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    resource
+)
+when {
+    context has detected_threats && context.detected_threats.contains("path_traversal")
+};
+
+@id("semantic.block-encoded")
+@name("Block encoded payloads in tool calls")
+@description("Blocks call_tool when detected_threats contains \"detect_encoded\".")
+@severity("medium")
+@tags("category:semantic,threat:encoded-payload,detection:pattern,surface:call-tool")
+@reject_message("Tool execution blocked: encoded or obfuscated payload detected (base64 or hash IOCs in tool arguments).")
+forbid (
+    principal,
+    action == AgentOps::Action::"call_tool",
+    resource
+)
+when {
+    context has detected_threats && context.detected_threats.contains("detect_encoded")
+};
+
+// ---------------------------------------------------------------------------
+// Tier 2: ML classifier detection
+// ---------------------------------------------------------------------------
+
+@id("semantic.block-injection-ml")
+@name("Block injection (ML)")
+@description("Blocks process_prompt and call_tool when injection_score >= 75.")
+@severity("critical")
+@tags("category:semantic,threat:injection,detection:ml,owasp:llm01,mitre:atlas-t0051")
+@reject_message("Request blocked: prompt injection detected by ML classifier with high confidence.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has injection_score && context.injection_score >= 75
+};
+
+@id("semantic.block-jailbreak-ml")
+@name("Block jailbreak (ML)")
+@description("Blocks process_prompt and call_tool when jailbreak_score >= 75.")
+@severity("critical")
+@tags("category:semantic,threat:jailbreak,detection:ml,owasp:llm02,mitre:atlas-t0054")
+@reject_message("Request blocked: jailbreak attempt detected by ML classifier with high confidence.")
+forbid (
+    principal,
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    resource
+)
+when {
+    context has jailbreak_score && context.jailbreak_score >= 75
+};