@highflame/policy 2.2.33 → 2.2.35
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/_schemas/agent_ops/templates/ported/agent-security/agent_identity_multi_agent_safety.cedar +3 -17
- package/_schemas/agent_ops/templates/ported/threat-detection/security_patterns.cedar +7 -19
- package/_schemas/agent_ops/templates/ported/threat-detection/semantic_defaults.cedar +7 -33
- package/_schemas/agent_ops/templates/templates.json +4 -6
- package/_schemas/ai_gateway/templates/defaults/tools.cedar +3 -17
- package/_schemas/ai_gateway/templates/templates.json +1 -2
- package/_schemas/guardrails/templates/defaults/security_patterns.cedar +7 -19
- package/_schemas/guardrails/templates/profiles/multi_agent/agent_safety.cedar +3 -17
- package/_schemas/guardrails/templates/templates.json +4 -6
- package/_schemas/overwatch/context.json +222 -0
- package/_schemas/overwatch/schema.cedarschema +72 -0
- package/_schemas/sentry/templates/templates.json +0 -14
- package/dist/aarm-annotation.d.ts +18 -0
- package/dist/aarm-annotation.js +36 -1
- package/dist/aarm-annotations.gen.js +21 -0
- package/dist/agent_ops-defaults.gen.js +25 -79
- package/dist/ai_gateway-defaults.gen.js +6 -21
- package/dist/ai_gateway-detectors.gen.js +2 -2
- package/dist/guardrails-defaults.gen.js +18 -46
- package/dist/guardrails-detectors.gen.js +2 -2
- package/dist/overwatch-context.gen.d.ts +2 -1
- package/dist/overwatch-context.gen.js +2 -0
- package/dist/overwatch-defaults.gen.js +105 -42
- package/dist/overwatch-detectors.gen.js +2 -2
- package/dist/overwatch-entities.gen.js +5 -1
- package/dist/sentry-defaults.gen.d.ts +1 -1
- package/dist/sentry-defaults.gen.js +0 -56
- package/dist/sentry-detectors.gen.js +2 -2
- package/dist/service-schemas.gen.d.ts +1 -1
- package/dist/service-schemas.gen.js +114 -0
- package/package.json +1 -1
- package/_schemas/sentry/templates/defaults/file_safety.cedar +0 -31
|
@@ -1,31 +0,0 @@
|
|
|
1
|
-
// =============================================================================
|
|
2
|
-
// File & Attachment Safety (Default)
|
|
3
|
-
// =============================================================================
|
|
4
|
-
// Blocks file uploads to AI chat services when document content contains
|
|
5
|
-
// secrets. PII in uploads is handled by the canonical privacy.* templates
|
|
6
|
-
// (defaults/pii*.cedar), which scope to upload_file.
|
|
7
|
-
//
|
|
8
|
-
// Context keys consumed:
|
|
9
|
-
// - secrets_detected: Bool
|
|
10
|
-
//
|
|
11
|
-
// Compliance:
|
|
12
|
-
// - NIST 800-53 SC-28; GDPR Art. 32
|
|
13
|
-
//
|
|
14
|
-
// Category: file-safety
|
|
15
|
-
// Namespace: Sentry
|
|
16
|
-
// =============================================================================
|
|
17
|
-
|
|
18
|
-
@id("file-safety.block-upload-secrets")
|
|
19
|
-
@name("Block file uploads with secrets")
|
|
20
|
-
@description("Blocks upload_file when secrets_detected is true.")
|
|
21
|
-
@severity("critical")
|
|
22
|
-
@tags("category:file-safety,threat:secrets,detection:rule,surface:upload-file,owasp:llm06")
|
|
23
|
-
@reject_message("File upload blocked: secrets or credentials detected in document content.")
|
|
24
|
-
forbid (
|
|
25
|
-
principal,
|
|
26
|
-
action == Sentry::Action::"upload_file",
|
|
27
|
-
resource
|
|
28
|
-
)
|
|
29
|
-
when {
|
|
30
|
-
context has secrets_detected && context.secrets_detected == true
|
|
31
|
-
};
|