@highflame/policy 2.2.35 → 2.2.37

package/dist/service-schemas.gen.js

@@ -78,13 +78,23 @@ namespace AgentOps {
     // Actions
     // =========================================================================
 
-    /// Process user prompts and AI responses for security threats and content violations
+    /// Process user prompts for security threats and content violations
     action "process_prompt" appliesTo {
         principal: [User, Agent],
         resource: [App, Agent, Session],
         context: ProcessPromptContext
     };
 
+    /// Process model responses for security threats and content violations.
+    /// Distinct trigger from process_prompt (ADR 0031). Declared ahead of a
+    /// caller: no AgentOps producer emits model responses today, so this is
+    /// namespace symmetry with ai_gateway/guardrails until one does.
+    action "process_response" appliesTo {
+        principal: [User, Agent],
+        resource: [App, Agent, Session],
+        context: ProcessResponseContext
+    };
+
     /// Execute tool calls (shell, file operations, MCP tools)
     action "call_tool" appliesTo {
         principal: [User, Agent],
@@ -130,7 +140,15 @@ namespace AgentOps {
     // Context Types (Action-Specific)
     // =========================================================================
 
-    /// Context for process_prompt action (user prompts & AI responses)
+    /// Context for the process_response action.
+    ///
+    /// An alias, not a copy: prompts and responses are inspected by the same
+    /// detector pipeline and carry the same keys — only the trigger differs
+    /// (ADR 0031). Aliasing means a new detector key cannot land on one
+    /// direction and go missing on the other.
+    type ProcessResponseContext = ProcessPromptContext;
+
+    /// Context for process_prompt action (user prompts)
     type ProcessPromptContext = {
         // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
         "role"?: String,
@@ -166,12 +184,12 @@ namespace AgentOps {
         "indirect_injection_score"?: Long, // Indirect injection via tool outputs (0-100)
 
         // Privacy - Secrets (optional)
-        "secrets_detected"?: Boolean,
+        "secrets_detected"?: Bool,
         "secret_count"?: Long,
         "secret_types"?: Set<String>,    // ["aws_access_key", "github_token", ...]
 
         // Privacy - PII (optional)
-        "pii_detected"?: Boolean,
+        "pii_detected"?: Bool,
         "pii_count"?: Long,
         "pii_types"?: Set<String>,       // ["email", "phone", "ssn", "credit_card", ...]
         "pii_score"?: Long,         // PII ML classifier confidence (0-100)
@@ -195,65 +213,65 @@ namespace AgentOps {
         "topic_confidence"?: Long,           // 0-100
 
         // Security - Invisible Character Detection (optional)
-        "invisible_chars_detected"?: Boolean,
+        "invisible_chars_detected"?: Bool,
         "invisible_chars_score"?: Long,      // 0-100
 
         // Security - Pattern Detection (optional)
-        "command_injection_detected"?: Boolean,
+        "command_injection_detected"?: Bool,
         "command_injection_type"?: String,       // "reverse_shell" | "privilege_escalation" | ...
         "command_injection_score"?: Long,        // 0-100
-        "path_traversal_detected"?: Boolean,
+        "path_traversal_detected"?: Bool,
         "path_traversal_severity"?: String,      // "critical" | "high" | "medium" | "low" | "none"
         "path_traversal_type"?: String,
-        "sql_injection_detected"?: Boolean,
+        "sql_injection_detected"?: Bool,
         "sql_injection_type"?: String,           // "tautology" | "union_based" | "destructive" | ...
         "sql_injection_score"?: Long,            // 0-100
 
         // Security - Cross-Origin Escalation (optional)
-        "cross_origin_detected"?: Boolean,
+        "cross_origin_detected"?: Bool,
         "cross_origin_type"?: String,            // "cross_origin_tool" | "cross_origin_server" | "none"
         "cross_origin_score"?: Long,             // 0-100
 
         // Security - Encoded Injection (optional)
-        "encoded_content_detected"?: Boolean,
+        "encoded_content_detected"?: Bool,
         "encoded_types"?: Set<String>,           // ["base64", "hex", "unicode", "url", ...]
         "encoded_count"?: Long,
         "encoded_score"?: Long,                  // 0-100
 
         // Language & Script Detection (optional)
         "detected_language"?: String,            // ISO language code
-        "is_english"?: Boolean,
+        "is_english"?: Bool,
         "language_confidence"?: Long,            // 0-100
         "detected_script"?: String,              // "latin" | "cyrillic" | "arabic" | "unknown" | ...
-        "is_latin_script"?: Boolean,
+        "is_latin_script"?: Bool,
         "script_confidence"?: Long,              // 0-100
 
         // Content Analysis (optional)
         "hallucination_score"?: Long,
         "factuality_score"?: Long,               // 0-100
         "sentiment_score"?: Long,
-        "contains_code"?: Boolean,
+        "contains_code"?: Bool,
         "code_languages"?: Set<String>,
         "code_ratio"?: Long,                     // 0-100
-        "keyword_matched"?: Boolean,
+        "keyword_matched"?: Bool,
         "keyword_categories"?: Set<String>,
         "keyword_count"?: Long,
-        "contains_non_ascii"?: Boolean,
-        "phishing_detected"?: Boolean,
+        "contains_non_ascii"?: Bool,
+        "phishing_detected"?: Bool,
         "content_safety_score"?: Long,           // 0-100
-        "content_safety_blocked"?: Boolean,
+        "content_safety_blocked"?: Bool,
 
         // Agentic - Multi-Turn Context (optional)
         "conversation_turn"?: Long,
-        "multi_turn_detection"?: Boolean,
+        "multi_turn_detection"?: Bool,
 
         // Session Detection History — cross-turn sticky flags (optional)
-        "session_pii_detected"?: Boolean,
+        "session_pii_detected"?: Bool,
         "session_pii_types"?: Set<String>,
-        "session_secrets_detected"?: Boolean,
+        "session_secrets_detected"?: Bool,
         "session_secret_types"?: Set<String>,
-        "session_injection_detected"?: Boolean,
-        "session_command_injection"?: Boolean,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
         "session_threat_turns"?: Long,
         "session_max_injection_score"?: Long,
         "session_max_jailbreak_score"?: Long,
@@ -283,14 +301,14 @@ namespace AgentOps {
         "flow_resolution_status"?: String,       // "known" | "inferred" | "unknown" | "conflicted"
         "flow_origins"?: Set<String>,            // "mcp_tool_result" | "model" | "file" | "database" | "user"
         "flow_sink"?: String,                    // "external_model" | "local_model" | "external_mcp" | "trusted_mcp" | "user_secure_output" | "public_network" | "file"
-        "flow_sink_is_external"?: Boolean,
+        "flow_sink_is_external"?: Bool,
         "flow_sink_effects"?: Set<String>,       // "network.send" | "financial.transfer" | "filesystem.write" | ...
         "principal_clearances"?: Set<String>,    // ADR 0020 D8 — clearances AuthN mints for the principal
         "principal_compartments"?: Set<String>,  // ADR 0020 D8 — compartments the principal is admitted to
 
         // Usage Budget — multi-window token & cost enforcement (optional)
         "budget_remaining_pct"?: Long,
-        "budget_exceeded"?: Boolean,
+        "budget_exceeded"?: Bool,
         "budget_cost_micros_this_turn"?: Long,
         "budget_model"?: String,
         "budget_tokens_pct_session"?: Long,
@@ -298,15 +316,15 @@ namespace AgentOps {
         "budget_tokens_pct_monthly"?: Long,
         "budget_cost_pct_daily"?: Long,
         "budget_cost_pct_monthly"?: Long,
-        "budget_exceeded_session"?: Boolean,
-        "budget_exceeded_daily"?: Boolean,
-        "budget_exceeded_monthly"?: Boolean,
+        "budget_exceeded_session"?: Bool,
+        "budget_exceeded_daily"?: Bool,
+        "budget_exceeded_monthly"?: Bool,
 
         // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
         "rpm_remaining_pct"?: Long,
-        "rpm_exceeded"?: Boolean,
+        "rpm_exceeded"?: Bool,
         "tpm_remaining_pct"?: Long,
-        "tpm_exceeded"?: Boolean,
+        "tpm_exceeded"?: Bool,
 
         // Agent Identity — authenticated agent principal metadata (optional)
         "agent_id"?: String,
@@ -318,8 +336,8 @@ namespace AgentOps {
         // Supply-chain / package safety + aggregate threat severity (optional —
         // ADR 0012 unified port). Projected by Shield's malicious-package and
         // threat-severity detectors; every read is \`has\`-guarded in policy.
-        "malicious_package_detected"?: Boolean,
-        "package_install_detected"?: Boolean,
+        "malicious_package_detected"?: Bool,
+        "package_install_detected"?: Bool,
         "package_check_status"?: String,
         "max_threat_severity"?: Long,
 
@@ -346,9 +364,9 @@ namespace AgentOps {
         // Tool Risk (optional)
         "tool_name"?: String,
         "tool_risk_score"?: Long,        // 0-100
-        "tool_is_sensitive"?: Boolean,
+        "tool_is_sensitive"?: Bool,
         "tool_category"?: String,        // "safe" | "sensitive" | "dangerous"
-        "tool_is_builtin"?: Boolean,
+        "tool_is_builtin"?: Bool,
 
         // AARM R3 (CAP-ENF-007) — Action Parameter Validation
         "action_params"?: {
@@ -361,29 +379,29 @@ namespace AgentOps {
             "target"?: String,
             "query"?: String,
         },
-        "param_type_violation"?: Boolean,
+        "param_type_violation"?: Bool,
         "param_type_violations"?: Set<String>,
 
         // MCP context (optional)
         "mcp_server"?: String,
         "mcp_tool"?: String,
-        "mcp_server_verified"?: Boolean,
+        "mcp_server_verified"?: Bool,
 
         // Agentic - Behavioral Patterns (optional)
-        "suspicious_pattern"?: Boolean,
+        "suspicious_pattern"?: Bool,
         "pattern_type"?: String,         // "data_exfiltration" | "secret_exfiltration" | ...
         "sequence_risk"?: Long,          // 0-100
 
         // Agentic - Loop Detection (optional)
-        "loop_detected"?: Boolean,
+        "loop_detected"?: Bool,
         "loop_count"?: Long,
         "loop_tool"?: String,
 
         // Security checks on tool arguments (optional)
-        "secrets_detected"?: Boolean,
+        "secrets_detected"?: Bool,
         "secret_count"?: Long,
         "secret_types"?: Set<String>,
-        "pii_detected"?: Boolean,
+        "pii_detected"?: Bool,
         "pii_types"?: Set<String>,
         "pii_count"?: Long,
         "pii_score"?: Long,
@@ -398,58 +416,65 @@ namespace AgentOps {
         "topic_confidence"?: Long,           // 0-100
 
         // Security - Pattern Detection (optional)
-        "command_injection_detected"?: Boolean,
+        "command_injection_detected"?: Bool,
         "command_injection_type"?: String,
         "command_injection_score"?: Long,
-        "path_traversal_detected"?: Boolean,
+        "path_traversal_detected"?: Bool,
         "path_traversal_severity"?: String,
         "path_traversal_type"?: String,
-        "sql_injection_detected"?: Boolean,
+        "sql_injection_detected"?: Bool,
         "sql_injection_type"?: String,
         "sql_injection_score"?: Long,
 
         // Security - Cross-Origin Escalation (optional)
-        "cross_origin_detected"?: Boolean,
+        "cross_origin_detected"?: Bool,
         "cross_origin_type"?: String,
         "cross_origin_score"?: Long,
 
         // Security - Invisible Character Detection (optional)
-        "invisible_chars_detected"?: Boolean,
+        "invisible_chars_detected"?: Bool,
         "invisible_chars_score"?: Long,
 
         // Security - Encoded Injection (optional)
-        "encoded_content_detected"?: Boolean,
+        "encoded_content_detected"?: Bool,
         "encoded_types"?: Set<String>,
         "encoded_count"?: Long,
         "encoded_score"?: Long,
 
         // Agentic - Agent Security (optional)
-        "tool_poisoning_detected"?: Boolean,
+        "tool_poisoning_detected"?: Bool,
         "tool_poisoning_score"?: Long,
         "tool_poisoning_type"?: String,
-        "rug_pull_detected"?: Boolean,
+        "rug_pull_detected"?: Bool,
         "rug_pull_score"?: Long,
         "rug_pull_type"?: String,
 
         // Agentic - MCP Risk (optional)
-        "mcp_config_risk"?: Boolean,
+        "mcp_config_risk"?: Bool,
         "mcp_risk_type"?: String,
         "mcp_risk_score"?: Long,
 
         // Tool Operation Classifier (optional)
         "tool_operation_classes"?: Set<String>,
 
+        // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \\n); Cedar \`like\` is anchored so patterns start with "*": sub-tree "*\\n/etc/*", bare dir "*\\n/etc\\n*", exact "*\\n/etc/passwd\\n*" ---
+        "resolved_target_paths"?: String,  // union of resolved absolute target paths, any capability
+        "read_target_paths"?: String,      // paths the command reads or enumerates
+        "write_target_paths"?: String,     // paths the command writes, creates, or destroys
+        "exec_target_paths"?: String,      // paths executed as a script
+        "unresolved_target"?: Bool,        // a target hid behind a variable/glob/$()/inline code, or the path-list cap truncated
+
         // Agentic - Multi-Turn Context (optional)
         "conversation_turn"?: Long,
-        "multi_turn_detection"?: Boolean,
+        "multi_turn_detection"?: Bool,
 
         // Session Detection History — cross-turn sticky flags (optional)
-        "session_pii_detected"?: Boolean,
+        "session_pii_detected"?: Bool,
         "session_pii_types"?: Set<String>,
-        "session_secrets_detected"?: Boolean,
+        "session_secrets_detected"?: Bool,
         "session_secret_types"?: Set<String>,
-        "session_injection_detected"?: Boolean,
-        "session_command_injection"?: Boolean,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
         "session_threat_turns"?: Long,
         "session_max_injection_score"?: Long,
         "session_max_jailbreak_score"?: Long,
@@ -479,14 +504,14 @@ namespace AgentOps {
         "flow_resolution_status"?: String,       // "known" | "inferred" | "unknown" | "conflicted"
         "flow_origins"?: Set<String>,            // "mcp_tool_result" | "model" | "file" | "database" | "user"
         "flow_sink"?: String,                    // "external_model" | "local_model" | "external_mcp" | "trusted_mcp" | "user_secure_output" | "public_network" | "file"
-        "flow_sink_is_external"?: Boolean,
+        "flow_sink_is_external"?: Bool,
         "flow_sink_effects"?: Set<String>,       // "network.send" | "financial.transfer" | "filesystem.write" | ...
         "principal_clearances"?: Set<String>,    // ADR 0020 D8 — clearances AuthN mints for the principal
         "principal_compartments"?: Set<String>,  // ADR 0020 D8 — compartments the principal is admitted to
 
         // Usage Budget (optional)
         "budget_remaining_pct"?: Long,
-        "budget_exceeded"?: Boolean,
+        "budget_exceeded"?: Bool,
         "budget_cost_micros_this_turn"?: Long,
         "budget_model"?: String,
         "budget_tokens_pct_session"?: Long,
@@ -494,15 +519,15 @@ namespace AgentOps {
         "budget_tokens_pct_monthly"?: Long,
         "budget_cost_pct_daily"?: Long,
         "budget_cost_pct_monthly"?: Long,
-        "budget_exceeded_session"?: Boolean,
-        "budget_exceeded_daily"?: Boolean,
-        "budget_exceeded_monthly"?: Boolean,
+        "budget_exceeded_session"?: Bool,
+        "budget_exceeded_daily"?: Bool,
+        "budget_exceeded_monthly"?: Bool,
 
         // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
         "rpm_remaining_pct"?: Long,
-        "rpm_exceeded"?: Boolean,
+        "rpm_exceeded"?: Bool,
         "tpm_remaining_pct"?: Long,
-        "tpm_exceeded"?: Boolean,
+        "tpm_exceeded"?: Bool,
 
         // Aggregated threat summary (optional)
         "highest_severity"?: String,
@@ -522,8 +547,8 @@ namespace AgentOps {
         // Supply-chain / package safety + aggregate threat severity (optional —
         // ADR 0012 unified port). Projected by Shield's malicious-package and
         // threat-severity detectors; every read is \`has\`-guarded in policy.
-        "malicious_package_detected"?: Boolean,
-        "package_install_detected"?: Boolean,
+        "malicious_package_detected"?: Bool,
+        "package_install_detected"?: Bool,
         "package_check_status"?: String,
         "max_threat_severity"?: Long,
 
@@ -551,14 +576,14 @@ namespace AgentOps {
         "path"?: String,
 
         // Security checks on file content (optional)
-        "secrets_detected"?: Boolean,
+        "secrets_detected"?: Bool,
         "secret_count"?: Long,
         "secret_types"?: Set<String>,
-        "pii_detected"?: Boolean,
+        "pii_detected"?: Bool,
         "pii_types"?: Set<String>,
 
         // Security - Path Traversal (optional)
-        "path_traversal_detected"?: Boolean,
+        "path_traversal_detected"?: Bool,
         "path_traversal_severity"?: String,
         "path_traversal_type"?: String,
 
@@ -568,12 +593,12 @@ namespace AgentOps {
         "detected_threats"?: Set<String>,
 
         // Session Detection History (optional)
-        "session_pii_detected"?: Boolean,
+        "session_pii_detected"?: Bool,
         "session_pii_types"?: Set<String>,
-        "session_secrets_detected"?: Boolean,
+        "session_secrets_detected"?: Bool,
         "session_secret_types"?: Set<String>,
-        "session_injection_detected"?: Boolean,
-        "session_command_injection"?: Boolean,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
         "session_threat_turns"?: Long,
         "session_max_injection_score"?: Long,
         "session_max_jailbreak_score"?: Long,
@@ -603,14 +628,14 @@ namespace AgentOps {
         "flow_resolution_status"?: String,       // "known" | "inferred" | "unknown" | "conflicted"
         "flow_origins"?: Set<String>,            // "mcp_tool_result" | "model" | "file" | "database" | "user"
         "flow_sink"?: String,                    // "external_model" | "local_model" | "external_mcp" | "trusted_mcp" | "user_secure_output" | "public_network" | "file"
-        "flow_sink_is_external"?: Boolean,
+        "flow_sink_is_external"?: Bool,
         "flow_sink_effects"?: Set<String>,       // "network.send" | "financial.transfer" | "filesystem.write" | ...
         "principal_clearances"?: Set<String>,    // ADR 0020 D8 — clearances AuthN mints for the principal
         "principal_compartments"?: Set<String>,  // ADR 0020 D8 — compartments the principal is admitted to
 
         // Usage Budget (optional)
         "budget_remaining_pct"?: Long,
-        "budget_exceeded"?: Boolean,
+        "budget_exceeded"?: Bool,
         "budget_cost_micros_this_turn"?: Long,
         "budget_model"?: String,
         "budget_tokens_pct_session"?: Long,
@@ -618,15 +643,15 @@ namespace AgentOps {
         "budget_tokens_pct_monthly"?: Long,
         "budget_cost_pct_daily"?: Long,
         "budget_cost_pct_monthly"?: Long,
-        "budget_exceeded_session"?: Boolean,
-        "budget_exceeded_daily"?: Boolean,
-        "budget_exceeded_monthly"?: Boolean,
+        "budget_exceeded_session"?: Bool,
+        "budget_exceeded_daily"?: Bool,
+        "budget_exceeded_monthly"?: Bool,
 
         // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
         "rpm_remaining_pct"?: Long,
-        "rpm_exceeded"?: Boolean,
+        "rpm_exceeded"?: Bool,
         "tpm_remaining_pct"?: Long,
-        "tpm_exceeded"?: Boolean,
+        "tpm_exceeded"?: Bool,
 
         // Agent Identity (optional)
         "agent_id"?: String,
@@ -659,18 +684,18 @@ namespace AgentOps {
         "path"?: String,
 
         // Security - Invisible Character Detection in write content (optional)
-        "invisible_chars_detected"?: Boolean,
+        "invisible_chars_detected"?: Bool,
         "invisible_chars_score"?: Long,
 
         // Security checks on content being written (optional)
-        "secrets_detected"?: Boolean,
+        "secrets_detected"?: Bool,
         "secret_count"?: Long,
         "secret_types"?: Set<String>,
-        "pii_detected"?: Boolean,
+        "pii_detected"?: Bool,
         "pii_types"?: Set<String>,
 
         // Security - Path Traversal (optional)
-        "path_traversal_detected"?: Boolean,
+        "path_traversal_detected"?: Bool,
         "path_traversal_severity"?: String,
         "path_traversal_type"?: String,
 
@@ -680,12 +705,12 @@ namespace AgentOps {
         "detected_threats"?: Set<String>,
 
         // Session Detection History (optional)
-        "session_pii_detected"?: Boolean,
+        "session_pii_detected"?: Bool,
         "session_pii_types"?: Set<String>,
-        "session_secrets_detected"?: Boolean,
+        "session_secrets_detected"?: Bool,
         "session_secret_types"?: Set<String>,
-        "session_injection_detected"?: Boolean,
-        "session_command_injection"?: Boolean,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
         "session_threat_turns"?: Long,
         "session_max_injection_score"?: Long,
         "session_max_jailbreak_score"?: Long,
@@ -715,14 +740,14 @@ namespace AgentOps {
         "flow_resolution_status"?: String,       // "known" | "inferred" | "unknown" | "conflicted"
         "flow_origins"?: Set<String>,            // "mcp_tool_result" | "model" | "file" | "database" | "user"
         "flow_sink"?: String,                    // "external_model" | "local_model" | "external_mcp" | "trusted_mcp" | "user_secure_output" | "public_network" | "file"
-        "flow_sink_is_external"?: Boolean,
+        "flow_sink_is_external"?: Bool,
         "flow_sink_effects"?: Set<String>,       // "network.send" | "financial.transfer" | "filesystem.write" | ...
         "principal_clearances"?: Set<String>,    // ADR 0020 D8 — clearances AuthN mints for the principal
         "principal_compartments"?: Set<String>,  // ADR 0020 D8 — compartments the principal is admitted to
 
         // Usage Budget (optional)
         "budget_remaining_pct"?: Long,
-        "budget_exceeded"?: Boolean,
+        "budget_exceeded"?: Bool,
         "budget_cost_micros_this_turn"?: Long,
         "budget_model"?: String,
         "budget_tokens_pct_session"?: Long,
@@ -730,15 +755,15 @@ namespace AgentOps {
         "budget_tokens_pct_monthly"?: Long,
         "budget_cost_pct_daily"?: Long,
         "budget_cost_pct_monthly"?: Long,
-        "budget_exceeded_session"?: Boolean,
-        "budget_exceeded_daily"?: Boolean,
-        "budget_exceeded_monthly"?: Boolean,
+        "budget_exceeded_session"?: Bool,
+        "budget_exceeded_daily"?: Bool,
+        "budget_exceeded_monthly"?: Bool,
 
         // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
         "rpm_remaining_pct"?: Long,
-        "rpm_exceeded"?: Boolean,
+        "rpm_exceeded"?: Bool,
         "tpm_remaining_pct"?: Long,
-        "tpm_exceeded"?: Boolean,
+        "tpm_exceeded"?: Bool,
 
         // Agent Identity (optional)
         "agent_id"?: String,
@@ -769,20 +794,20 @@ namespace AgentOps {
 
         // MCP context (optional)
         "mcp_server"?: String,
-        "mcp_server_verified"?: Boolean,
+        "mcp_server_verified"?: Bool,
 
         // Agentic - Agent Security (optional)
-        "tool_poisoning_detected"?: Boolean,
+        "tool_poisoning_detected"?: Bool,
         "tool_poisoning_score"?: Long,
         "tool_poisoning_type"?: String,
 
         // Agentic - MCP Risk (optional)
-        "mcp_config_risk"?: Boolean,
+        "mcp_config_risk"?: Bool,
         "mcp_risk_type"?: String,
         "mcp_risk_score"?: Long,
 
         // Security - Cross-Origin Escalation (optional)
-        "cross_origin_detected"?: Boolean,
+        "cross_origin_detected"?: Bool,
         "cross_origin_type"?: String,
         "cross_origin_score"?: Long,
 
@@ -792,12 +817,12 @@ namespace AgentOps {
         "detected_threats"?: Set<String>,
 
         // Session Detection History (optional)
-        "session_pii_detected"?: Boolean,
+        "session_pii_detected"?: Bool,
         "session_pii_types"?: Set<String>,
-        "session_secrets_detected"?: Boolean,
+        "session_secrets_detected"?: Bool,
         "session_secret_types"?: Set<String>,
-        "session_injection_detected"?: Boolean,
-        "session_command_injection"?: Boolean,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
         "session_threat_turns"?: Long,
         "session_max_injection_score"?: Long,
         "session_max_jailbreak_score"?: Long,
@@ -827,14 +852,14 @@ namespace AgentOps {
         "flow_resolution_status"?: String,       // "known" | "inferred" | "unknown" | "conflicted"
         "flow_origins"?: Set<String>,            // "mcp_tool_result" | "model" | "file" | "database" | "user"
         "flow_sink"?: String,                    // "external_model" | "local_model" | "external_mcp" | "trusted_mcp" | "user_secure_output" | "public_network" | "file"
-        "flow_sink_is_external"?: Boolean,
+        "flow_sink_is_external"?: Bool,
         "flow_sink_effects"?: Set<String>,       // "network.send" | "financial.transfer" | "filesystem.write" | ...
         "principal_clearances"?: Set<String>,    // ADR 0020 D8 — clearances AuthN mints for the principal
         "principal_compartments"?: Set<String>,  // ADR 0020 D8 — compartments the principal is admitted to
 
         // Usage Budget (optional)
         "budget_remaining_pct"?: Long,
-        "budget_exceeded"?: Boolean,
+        "budget_exceeded"?: Bool,
         "budget_cost_micros_this_turn"?: Long,
         "budget_model"?: String,
         "budget_tokens_pct_session"?: Long,
@@ -842,15 +867,15 @@ namespace AgentOps {
         "budget_tokens_pct_monthly"?: Long,
         "budget_cost_pct_daily"?: Long,
         "budget_cost_pct_monthly"?: Long,
-        "budget_exceeded_session"?: Boolean,
-        "budget_exceeded_daily"?: Boolean,
-        "budget_exceeded_monthly"?: Boolean,
+        "budget_exceeded_session"?: Bool,
+        "budget_exceeded_daily"?: Bool,
+        "budget_exceeded_monthly"?: Bool,
 
         // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
         "rpm_remaining_pct"?: Long,
-        "rpm_exceeded"?: Boolean,
+        "rpm_exceeded"?: Bool,
         "tpm_remaining_pct"?: Long,
-        "tpm_exceeded"?: Boolean,
+        "tpm_exceeded"?: Bool,
 
         // Agent Identity (optional)
         "agent_id"?: String,
@@ -862,8 +887,8 @@ namespace AgentOps {
         // Supply-chain / package safety + aggregate threat severity (optional —
         // ADR 0012 unified port). Projected by Shield's malicious-package and
         // threat-severity detectors; every read is \`has\`-guarded in policy.
-        "malicious_package_detected"?: Boolean,
-        "package_install_detected"?: Boolean,
+        "malicious_package_detected"?: Bool,
+        "package_install_detected"?: Bool,
         "package_check_status"?: String,
         "max_threat_severity"?: Long,
 
@@ -909,7 +934,7 @@ namespace AgentOps {
         // requested (i.e. whenever egress_hosts is non-empty), so a "no network"
         // profile can gate on this single boolean. egress_hosts then narrows the
         // host allowlist for profiles that DO permit egress.
-        "network_egress"?: Boolean,
+        "network_egress"?: Bool,
         "egress_hosts"?: Set<String>,          // Host allowlist for egress, e.g. {"pypi.org"}
         "exec_allowlist"?: Set<String>,        // Executables the sandbox may run, e.g. {"python", "python3"}
         // Curated mechanism toggles (ADR 0017 D1.3) — authorization facts only;
@@ -986,6 +1011,13 @@ entity Server in [Project];
 /// MCP prompt -- resource for process_prompt action
 entity LlmPrompt in [Project];
 
+/// Model response -- resource for process_response action.
+/// Parented to Project like every other resource: Shield injects
+/// \`when { resource in <Ns>::Project::"<id>" }\` into every synced rule
+/// (shield#428), so a resource outside the project hierarchy would make
+/// every policy written against it unsatisfiable.
+entity LlmResponse in [Project];
+
 /// File/resource path -- resource for read_file/write_file actions
 entity FilePath in [Project];
 
@@ -1048,6 +1080,13 @@ action call_tool appliesTo {
     // --- Tool Operation Classifier ---
     tool_operation_classes?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
 
+    // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \\n); Cedar \`like\` is anchored so patterns start with "*": sub-tree "*\\n/etc/*", bare dir "*\\n/etc\\n*", exact "*\\n/etc/passwd\\n*" ---
+    resolved_target_paths?: String,  // union of resolved absolute target paths, any capability
+    read_target_paths?: String,      // paths the command reads or enumerates
+    write_target_paths?: String,     // paths the command writes, creates, or destroys
+    exec_target_paths?: String,      // paths executed as a script
+    unresolved_target?: Bool,        // a target hid behind a variable/glob/$()/inline code, or the path-list cap truncated
+
     // --- MCP Trust ---
     mcp_server_verified?: Bool,       // Whether server is from verified registry
 
@@ -1186,12 +1225,13 @@ action connect_server appliesTo {
   },
 };
 
-// Process a prompt (MCP prompts/get or LLM chat completions)
-// Threat focus: injection, jailbreak, secrets, PII, content safety
-action process_prompt appliesTo {
-  principal: [User, MCP_Client],
-  resource: [LlmPrompt],
-  context: {
+// Shared content-inspection context.
+//
+// Prompts and responses are inspected by the same detector pipeline and so
+// carry the same context keys; only the TRIGGER differs (ADR 0031). Declaring
+// the shape once means a new detector key cannot land on one direction and go
+// missing on the other — the drift class shield#393 / shield#387 were about.
+type ContentInspectionContext = {
     // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
     role?: String,
     privilege_scope?: Set<String>,
@@ -1270,7 +1310,29 @@ action process_prompt appliesTo {
     rpm_exceeded?: Bool,
     tpm_remaining_pct?: Long,
     tpm_exceeded?: Bool,
-  },
+};
+
+// Process a prompt (MCP prompts/get or LLM chat completions)
+// Threat focus: injection, jailbreak, secrets, PII, content safety
+action process_prompt appliesTo {
+  principal: [User, MCP_Client],
+  resource: [LlmPrompt],
+  context: ContentInspectionContext,
+};
+
+// Process a model response (LLM chat completion output, streamed or buffered)
+// Threat focus: data leakage in output, harmful content, hallucination,
+// indirect injection carried back to the caller.
+//
+// Distinct from process_prompt so that (a) a policy can be scoped to one
+// direction from its head alone and (b) Shield's action-scoped detector
+// scheduling (INV-DET-001) can keep prompt-only detectors off the egress
+// path — before this action existed, a prompt-scoped dlp/model_armor/webhook
+// rule shipped response bodies downstream. See ADR 0031.
+action process_response appliesTo {
+  principal: [User, MCP_Client],
+  resource: [LlmResponse],
+  context: ContentInspectionContext,
 };
 
 // Read an MCP resource (resources/read, resources/list)
@@ -1471,13 +1533,24 @@ namespace Guardrails {
     // Actions
     // =========================================================================
 
-    /// Process user prompts and AI responses for security threats and content violations
+    /// Process user prompts for security threats and content violations
     action "process_prompt" appliesTo {
         principal: [User, Agent],
         resource: [App, Agent, Session],
         context: ProcessPromptContext
     };
 
+    /// Process model responses for security threats and content violations.
+    /// Distinct trigger from process_prompt (ADR 0031) so a policy can be
+    /// scoped to one direction from its head, and so Shield's action-scoped
+    /// detector scheduling (INV-DET-001) keeps prompt-only detectors off the
+    /// egress path.
+    action "process_response" appliesTo {
+        principal: [User, Agent],
+        resource: [App, Agent, Session],
+        context: ProcessResponseContext
+    };
+
     /// Execute tool calls (shell, file operations, MCP tools)
     action "call_tool" appliesTo {
         principal: [User, Agent],
@@ -1510,7 +1583,17 @@ namespace Guardrails {
     // Context Types (Action-Specific)
     // =========================================================================
 
-    /// Context for process_prompt action (user prompts & AI responses)
+    /// Context for the process_response action.
+    ///
+    /// An alias, not a copy: prompts and responses are inspected by the same
+    /// detector pipeline and carry the same keys — only the trigger differs
+    /// (ADR 0031). Aliasing means a new detector key cannot land on one
+    /// direction and go missing on the other, and it guarantees no policy
+    /// loses a context key at the cutover, since this is byte-for-byte the
+    /// shape responses were already evaluated against under process_prompt.
+    type ProcessResponseContext = ProcessPromptContext;
+
+    /// Context for process_prompt action (user prompts)
     type ProcessPromptContext = {
         // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
         "role"?: String,
@@ -1821,6 +1904,13 @@ namespace Guardrails {
         // Tool Operation Classifier (optional) — populated by AST-based classifiers (bash, python, etc.)
         "tool_operation_classes"?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
 
+        // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \\n); Cedar \`like\` is anchored so patterns start with "*": sub-tree "*\\n/etc/*", bare dir "*\\n/etc\\n*", exact "*\\n/etc/passwd\\n*" ---
+        "resolved_target_paths"?: String,  // union of resolved absolute target paths, any capability
+        "read_target_paths"?: String,      // paths the command reads or enumerates
+        "write_target_paths"?: String,     // paths the command writes, creates, or destroys
+        "exec_target_paths"?: String,      // paths executed as a script
+        "unresolved_target"?: Bool,        // a target hid behind a variable/glob/$()/inline code, or the path-list cap truncated
+
         // Agentic - Multi-Turn Context (optional)
         "conversation_turn"?: Long,
         "multi_turn_detection"?: Bool,
@@ -2332,6 +2422,13 @@ action call_tool appliesTo {
     // --- Tool Operation Classifier ---
     tool_operation_classes?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
 
+    // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \\n); Cedar \`like\` is anchored so patterns start with "*": sub-tree "*\\n/etc/*", bare dir "*\\n/etc\\n*", exact "*\\n/etc/passwd\\n*" ---
+    resolved_target_paths?: String,  // union of resolved absolute target paths, any capability
+    read_target_paths?: String,      // paths the command reads or enumerates
+    write_target_paths?: String,     // paths the command writes, creates, or destroys
+    exec_target_paths?: String,      // paths executed as a script
+    unresolved_target?: Bool,        // a target hid behind a variable/glob/$()/inline code
+
     // --- Session Detection History (cross-turn sticky flags) ---
     session_pii_detected?: Bool,
     session_pii_types?: Set<String>,
@@ -3303,6 +3400,137 @@ export const AGENT_OPS_CONTEXT = {
                 { "key": "max_threat_severity", "type": "number", "required": false, "description": "Aggregate max threat severity across detectors (0=none,1=low,2=medium,3=high,4=critical)." }
             ]
         },
+        {
+            "name": "process_response",
+            "description": "Process a model response (LLM chat completion output) — threat focus: data leakage in output, harmful content, hallucination, indirect injection carried back to the caller. Distinct trigger from process_prompt (ADR 0031) so a policy can be scoped to one direction from its head and prompt-only detectors stay off the egress path.",
+            "context_attributes": [
+                { "key": "role", "type": "string", "required": false, "description": "Caller\'s RBAC role projected from the principal\'s token (AARM R6 / CAP-IDN-011)" },
+                { "key": "privilege_scope", "type": "array", "required": false, "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011)" },
+                { "key": "identity_type", "type": "string", "required": false, "description": "Principal identity class projected from the token: \'human\', \'agent\', \'service\', or \'mcp_server\'" },
+                { "key": "principal", "type": "string", "required": false, "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id)" },
+                { "key": "request_id", "type": "string", "required": true, "description": "Unique identifier for this request, useful for audit trails and debugging" },
+                { "key": "timestamp", "type": "number", "required": true, "description": "Unix timestamp in milliseconds when the request was processed" },
+                { "key": "direction", "type": "string", "required": true, "description": "Content flow direction: \'input\' for user prompts, \'output\' for AI responses" },
+                { "key": "content_type", "type": "string", "required": true, "description": "Type of content being analyzed: \'prompt\', \'response\', \'tool_call\', \'file\', or \'clipboard\'" },
+                { "key": "detector_count", "type": "number", "required": true, "description": "Number of detectors that were executed for this request" },
+                { "key": "source", "type": "string", "required": false, "description": "Traffic origin: \'ide\' | \'cli\' | \'api\' | \'browser\'. Present for Overwatch/code-agent traffic." },
+                { "key": "event", "type": "string", "required": false, "description": "Event type: \'prompt\' | \'tool_call\' | \'file_read\' | \'file_write\' | \'connect_server\'. Present for Overwatch traffic." },
+                { "key": "user_email", "type": "string", "required": false, "description": "Human operator email (IDE sessions)" },
+                { "key": "cwd", "type": "string", "required": false, "description": "Current working directory (IDE sessions)" },
+                { "key": "workspace_root", "type": "string", "required": false, "description": "IDE workspace root path" },
+                { "key": "model_name", "type": "string", "required": false, "description": "LLM model name: \'claude-3-5-sonnet\', \'gpt-4o\', etc. Present for AI Gateway traffic." },
+                { "key": "model_provider", "type": "string", "required": false, "description": "Model provider: \'anthropic\' | \'openai\' | \'google\' | \'meta\'. Present for AI Gateway traffic." },
+                { "key": "injection_score", "type": "number", "required": false, "description": "Combined prompt injection confidence (0-100). MAX of all detector scores." },
+                { "key": "jailbreak_score", "type": "number", "required": false, "description": "Combined jailbreak detection confidence (0-100). MAX of all detector scores." },
+                { "key": "injection_pulse_score", "type": "number", "required": false, "description": "Highflame single-turn classifier score for prompt injection (0-100)." },
+                { "key": "injection_deep_context_score", "type": "number", "required": false, "description": "DeepContext multi-turn analyzer score for prompt injection (0-100)." },
+                { "key": "jailbreak_pulse_score", "type": "number", "required": false, "description": "Highflame single-turn classifier score for jailbreak attempts (0-100)." },
+                { "key": "jailbreak_deep_context_score", "type": "number", "required": false, "description": "DeepContext multi-turn analyzer score for jailbreak attempts (0-100)." },
+                { "key": "injection_type", "type": "string", "required": false, "description": "Type of injection detected: \'prompt\', \'sql\', \'command\', or \'none\'" },
+                { "key": "indirect_injection_score", "type": "number", "required": false, "description": "Indirect prompt injection risk score (0-100) — injection via tool outputs, retrieved documents, or external content." },
+                { "key": "indirect_injection_type", "type": "string", "required": false, "description": "Type of indirect injection detected in content (e.g., instruction override, authority hijack)" },
+                { "key": "secrets_detected", "type": "boolean", "required": false, "description": "Whether any API keys, tokens, passwords, or credentials were detected" },
+                { "key": "secret_count", "type": "number", "required": false, "description": "Total number of secret matches found" },
+                { "key": "secret_types", "type": "array", "required": false, "description": "Array of secret types found (e.g., [\'aws_access_key\', \'github_token\'])" },
+                { "key": "pii_detected", "type": "boolean", "required": false, "description": "Whether personally identifiable information (PII) was found" },
+                { "key": "pii_count", "type": "number", "required": false, "description": "Total number of PII matches found" },
+                { "key": "pii_types", "type": "array", "required": false, "description": "Array of PII types detected (e.g., [\'email\', \'phone\', \'ssn\', \'credit_card\'])" },
+                { "key": "pii_score", "type": "number", "required": false, "description": "PII detection ML classifier confidence (0-100)." },
+                { "key": "highest_severity", "type": "string", "required": false, "description": "Highest severity level: \'critical\', \'high\', \'medium\', \'low\', or \'none\'" },
+                { "key": "threat_count", "type": "number", "required": false, "description": "Total number of threats detected across all detectors" },
+                { "key": "threat_categories", "type": "array", "required": false, "description": "Array of threat category names detected (e.g., [\'injection\', \'pii\', \'secrets\'])" },
+                { "key": "detected_threats", "type": "array", "required": false, "description": "Array of specific threat names detected" },
+                { "key": "violence_score", "type": "number", "required": false, "description": "ML-based score for violent content references (0-100)." },
+                { "key": "hate_speech_score", "type": "number", "required": false, "description": "ML-based score for hate speech or discriminatory language (0-100)." },
+                { "key": "sexual_score", "type": "number", "required": false, "description": "ML-based score for sexual or adult content (0-100)." },
+                { "key": "weapons_score", "type": "number", "required": false, "description": "ML-based score for weapons references (0-100)." },
+                { "key": "crime_score", "type": "number", "required": false, "description": "ML-based score for criminal activity discussions (0-100)." },
+                { "key": "profanity_score", "type": "number", "required": false, "description": "ML-based score for profanity and vulgar language (0-100)." },
+                { "key": "content_topics", "type": "array", "required": false, "description": "Semantic topics detected in content (e.g., [\'controlled_substances\', \'weapons_manufacturing\'])" },
+                { "key": "topic_confidence", "type": "number", "required": false, "description": "Confidence score from topic classifier (0-100)." },
+                { "key": "invisible_chars_detected", "type": "boolean", "required": false, "description": "Whether invisible Unicode characters were detected in the content" },
+                { "key": "invisible_chars_score", "type": "number", "required": false, "description": "Density score for invisible characters (0-100)." },
+                { "key": "command_injection_detected", "type": "boolean", "required": false, "description": "Whether command injection patterns were detected" },
+                { "key": "command_injection_type", "type": "string", "required": false, "description": "Type of command injection: \'reverse_shell\', \'privilege_escalation\', \'code_execution\', \'destructive_command\', or \'data_exfiltration\'" },
+                { "key": "command_injection_score", "type": "number", "required": false, "description": "Confidence score for command injection detection (0-100)." },
+                { "key": "path_traversal_detected", "type": "boolean", "required": false, "description": "Whether path traversal patterns were detected" },
+                { "key": "path_traversal_severity", "type": "string", "required": false, "description": "Severity of path traversal: \'critical\', \'high\', \'medium\', \'low\', or \'none\'" },
+                { "key": "path_traversal_type", "type": "string", "required": false, "description": "Type of path traversal detected" },
+                { "key": "sql_injection_detected", "type": "boolean", "required": false, "description": "Whether SQL injection patterns were detected" },
+                { "key": "sql_injection_type", "type": "string", "required": false, "description": "Type of SQL injection: \'tautology\', \'union_based\', \'destructive\', \'blind\', or \'error_based\'" },
+                { "key": "sql_injection_score", "type": "number", "required": false, "description": "Confidence score for SQL injection detection (0-100)." },
+                { "key": "cross_origin_detected", "type": "boolean", "required": false, "description": "Whether cross-origin escalation patterns were detected" },
+                { "key": "cross_origin_type", "type": "string", "required": false, "description": "Type of cross-origin escalation: \'cross_origin_tool\', \'cross_origin_server\', or \'none\'" },
+                { "key": "cross_origin_score", "type": "number", "required": false, "description": "Risk score for cross-origin escalation (0-100)." },
+                { "key": "encoded_content_detected", "type": "boolean", "required": false, "description": "Whether encoded content was detected (base64, hex, unicode, URL encoding)" },
+                { "key": "encoded_types", "type": "array", "required": false, "description": "Array of encoding types detected (e.g., [\'base64\', \'hex\', \'unicode\', \'url\'])" },
+                { "key": "encoded_count", "type": "number", "required": false, "description": "Number of encoded segments found" },
+                { "key": "encoded_score", "type": "number", "required": false, "description": "Risk score for encoded injection attempts (0-100)." },
+                { "key": "detected_language", "type": "string", "required": false, "description": "ISO language code of the detected language (e.g., \'en\', \'fr\', \'zh\')" },
+                { "key": "is_english", "type": "boolean", "required": false, "description": "Whether the content is in English" },
+                { "key": "language_confidence", "type": "number", "required": false, "description": "Confidence score for language detection (0-100)." },
+                { "key": "detected_script", "type": "string", "required": false, "description": "Writing script detected: \'latin\', \'cyrillic\', \'arabic\', \'cjk\', \'unknown\', etc." },
+                { "key": "is_latin_script", "type": "boolean", "required": false, "description": "Whether the content uses Latin script" },
+                { "key": "script_confidence", "type": "number", "required": false, "description": "Confidence score for script detection (0-100)." },
+                { "key": "hallucination_score", "type": "number", "required": false, "description": "ML-based score for hallucinated or fabricated content (0-100)." },
+                { "key": "factuality_score", "type": "number", "required": false, "description": "ML-based factuality assessment score (0-100)." },
+                { "key": "sentiment_score", "type": "number", "required": false, "description": "Sentiment analysis score." },
+                { "key": "contains_code", "type": "boolean", "required": false, "description": "Whether code snippets were detected in the content" },
+                { "key": "code_languages", "type": "array", "required": false, "description": "Array of programming languages detected in code snippets" },
+                { "key": "code_ratio", "type": "number", "required": false, "description": "Percentage of content that consists of code (0-100)." },
+                { "key": "keyword_matched", "type": "boolean", "required": false, "description": "Whether any configured keywords or phrases were matched" },
+                { "key": "keyword_categories", "type": "array", "required": false, "description": "Array of keyword categories matched (e.g., [\'competitor_names\', \'restricted_topics\'])" },
+                { "key": "keyword_count", "type": "number", "required": false, "description": "Number of keyword matches found" },
+                { "key": "contains_non_ascii", "type": "boolean", "required": false, "description": "Whether non-ASCII characters were detected" },
+                { "key": "phishing_detected", "type": "boolean", "required": false, "description": "Whether phishing patterns were detected" },
+                { "key": "content_safety_score", "type": "number", "required": false, "description": "Aggregate content safety score (0-100)." },
+                { "key": "content_safety_blocked", "type": "boolean", "required": false, "description": "Whether content was flagged for blocking by the content safety system" },
+                { "key": "conversation_turn", "type": "number", "required": false, "description": "Current conversation turn number" },
+                { "key": "multi_turn_detection", "type": "boolean", "required": false, "description": "Whether multi-turn injection patterns were detected" },
+                { "key": "budget_remaining_pct", "type": "number", "required": false, "description": "Remaining token budget as percentage (0-100)." },
+                { "key": "budget_exceeded", "type": "boolean", "required": false, "description": "Whether the token budget has been exceeded" },
+                { "key": "rpm_remaining_pct", "type": "number", "required": false, "description": "Remaining RPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)." },
+                { "key": "rpm_exceeded", "type": "boolean", "required": false, "description": "Whether the RPM limit has been exceeded" },
+                { "key": "tpm_remaining_pct", "type": "number", "required": false, "description": "Remaining TPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)." },
+                { "key": "tpm_exceeded", "type": "boolean", "required": false, "description": "Whether the TPM limit has been exceeded" },
+                { "key": "session_pii_detected", "type": "boolean", "required": false, "description": "Whether PII was detected in any previous turn of the session" },
+                { "key": "session_pii_types", "type": "array", "required": false, "description": "PII types detected across the session (accumulated)" },
+                { "key": "session_secrets_detected", "type": "boolean", "required": false, "description": "Whether secrets were detected in any previous turn of the session" },
+                { "key": "session_secret_types", "type": "array", "required": false, "description": "Secret types detected across the session (accumulated)" },
+                { "key": "session_injection_detected", "type": "boolean", "required": false, "description": "Whether prompt injection was detected in any previous turn of the session" },
+                { "key": "session_command_injection", "type": "boolean", "required": false, "description": "Whether command injection was detected in any previous turn of the session" },
+                { "key": "session_threat_turns", "type": "number", "required": false, "description": "Number of turns in the session where threats were detected" },
+                { "key": "session_max_injection_score", "type": "number", "required": false, "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions" },
+                { "key": "session_max_jailbreak_score", "type": "number", "required": false, "description": "Highest jailbreak detection score seen in any turn of the session (0-100)" },
+                { "key": "session_max_command_injection_score", "type": "number", "required": false, "description": "Highest command injection score seen in any turn of the session (0-100)" },
+                { "key": "session_max_pii_score", "type": "number", "required": false, "description": "Highest PII risk score seen in any turn of the session (0-100)" },
+                { "key": "session_max_secret_score", "type": "number", "required": false, "description": "Highest secret detection score seen in any turn of the session (0-100)" },
+                { "key": "session_cumulative_risk_score", "type": "number", "required": false, "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant" },
+                { "key": "session_max_sensitivity", "type": "string", "required": false, "description": "Highest data-sensitivity tier observed across the session (e.g. \'public\', \'internal\', \'confidential\', \'restricted\')" },
+                { "key": "session_original_request", "type": "string", "required": false, "description": "The session\'s first user request, retained for drift / goal-hijack policies that compare later turns against the original intent" },
+                { "key": "agent_id", "type": "string", "required": false, "description": "Unique identifier of the authenticated AI agent making this request. Empty string for human user requests." },
+                { "key": "agent_type", "type": "string", "required": false, "description": "Type of the authenticated agent: \'orchestrator\', \'autonomous\', \'tool_agent\', or \'human_proxy\'. Empty string for human users." },
+                { "key": "agent_trust_level", "type": "string", "required": false, "description": "Trust level of the authenticated agent: \'first_party\', \'verified_third_party\', or \'unverified\'." },
+                { "key": "agent_framework", "type": "string", "required": false, "description": "Framework or SDK the agent is built with (e.g., \'claude-code\', \'langchain\', \'crewai\', \'autogen\')." },
+                { "key": "agent_publisher", "type": "string", "required": false, "description": "Organization that published the agent (e.g., \'anthropic\', \'internal\', \'acme-corp\')." },
+                { "key": "flow_confidentiality", "type": "string", "required": false, "description": "Confidentiality tier of the data this action carries or targets (ADR 0020): \'public\', \'internal\', \'confidential\', \'restricted\', or \'unknown\'. Shares the ladder with session_max_sensitivity but is a per-value fact, not a session scalar. \'unknown\' MUST NOT be treated as \'public\' — guard with has and let policy DENY/STEP_UP/DEFER per flow_resolution_status." },
+                { "key": "flow_integrity", "type": "string", "required": false, "description": "Integrity/influence tier of the data this action carries (ADR 0020): \'trusted\', \'untrusted\', \'mixed\', or \'unknown\'. Orthogonal to confidentiality: untrusted content may inform a pure analysis but MUST NOT authorize a side-effecting sink. Least-trusted contributor wins on join." },
+                { "key": "flow_data_types", "type": "array", "required": false, "description": "Sensitive data categories present in the value (ADR 0020), e.g. \'pii\', \'secrets\', \'source_code\', \'financial\', \'health\'. Union of all contributing inputs. Set<String>." },
+                { "key": "flow_compartments", "type": "array", "required": false, "description": "Compartments the value belongs to (ADR 0020), e.g. \'tenant:acme\', \'customer:123\', \'project:x\'. Union of all contributing inputs — cross-compartment composition is expressible by cardinality. Set<String>." },
+                { "key": "flow_resolution_status", "type": "string", "required": false, "description": "How the flow label was resolved (ADR 0020): \'known\', \'inferred\', \'unknown\', or \'conflicted\'. Policy authors choose the posture for \'unknown\' per sink (DENY external, STEP_UP, DEFER while a classifier runs, or allow-and-record). Never silently resolves to public." },
+                { "key": "flow_origins", "type": "array", "required": false, "description": "Origin kinds that produced or influenced the value (ADR 0020): \'mcp_tool_result\', \'model\', \'file\', \'database\', \'user\'. Provenance fact for lineage-aware policy. Set<String>." },
+                { "key": "flow_sink", "type": "string", "required": false, "description": "Logical destination this action releases the value to (ADR 0020), e.g. \'external_model\', \'local_model\', \'external_mcp\', \'trusted_mcp\', \'user_secure_output\', \'public_network\', \'file\'. The \'where\' half of a flow decision — pair with flow_confidentiality/flow_integrity." },
+                { "key": "flow_sink_is_external", "type": "boolean", "required": false, "description": "Whether the destination is outside the tenant trust boundary (ADR 0020). Lets a single policy express \'confidential data MUST NOT leave to any external sink\' without enumerating sink ids." },
+                { "key": "flow_sink_effects", "type": "array", "required": false, "description": "Side effects the destination can exercise (ADR 0020), e.g. \'network.send\', \'financial.transfer\', \'filesystem.write\'. Enables \'untrusted content MUST NOT reach a financial.transfer sink\'. Set<String>." },
+                { "key": "principal_clearances", "type": "array", "required": false, "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. \'restricted\', \'pii\'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>." },
+                { "key": "principal_compartments", "type": "array", "required": false, "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. \'tenant:acme\', \'customer:123\'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>." },
+                { "key": "surface", "type": "string", "required": true, "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: \'guardrails\', \'overwatch\', \'ai_gateway\' (\'sentry\' joins at D17 phase 2). The \'Applies to\' narrowing target: test with an ordinary condition (context.surface == \'ai_gateway\'); no \'has\' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later." },
+                { "key": "malicious_package_detected", "type": "boolean", "required": false, "description": "Whether a referenced package carries a known-malicious osv.dev (MAL-) advisory." },
+                { "key": "package_install_detected", "type": "boolean", "required": false, "description": "Whether the request installs or downloads a package (pip/npm/cargo/etc.)." },
+                { "key": "package_check_status", "type": "string", "required": false, "description": "Malicious-package lookup status: empty (ok) or degraded (OSV unavailable, fail-open)." },
+                { "key": "max_threat_severity", "type": "number", "required": false, "description": "Aggregate max threat severity across detectors (0=none,1=low,2=medium,3=high,4=critical)." }
+            ]
+        },
         {
             "name": "call_tool",
             "description": "Execute agentic tool calls, including shell commands, file operations, and MCP tools",
@@ -3376,6 +3604,11 @@ export const AGENT_OPS_CONTEXT = {
                 { "key": "encoded_count", "type": "number", "required": false, "description": "Number of encoded segments found in tool arguments" },
                 { "key": "encoded_score", "type": "number", "required": false, "description": "Risk score for encoded injection in tool arguments (0-100)." },
                 { "key": "tool_operation_classes", "type": "array", "required": false, "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: \'readonly\', \'write_enabling\', \'execute_enabling\', \'network_access\', \'unknown\'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). \'unknown\' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy." },
+                { "key": "resolved_target_paths", "type": "string", "required": false, "description": "Newline-delimited (leading+trailing \\n) union of the statically-resolved absolute target paths a shell command touches, any capability, emitted by the bash AST detector. Cedar like is full-string anchored and every value starts with the \\n delimiter, so patterns must begin with \'*\': anchored sub-tree \"*\\n/etc/*\" (matches only paths under /etc, unlike the loose \"*/etc/*\" which also hits a project etc/ dir at any depth), bare directory \"*\\n/etc\\n*\" (e.g. rm -rf /etc, no trailing slash), exact file \"*\\n/etc/passwd\\n*\". Resolution is purely lexical (cwd-join + path.Clean; quoting, escapes, wrappers, cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated." },
+                { "key": "read_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command reads or enumerates, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with \'*\' (see resolved_target_paths)." },
+                { "key": "write_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command writes, creates, or destroys (redirects, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i), emitted by the bash AST detector. \\n-anchored: e.g. write_target_paths like \"*\\n/etc/cron.d/*\"." },
+                { "key": "exec_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command executes as a script, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with \'*\' (see resolved_target_paths)." },
+                { "key": "unresolved_target", "type": "boolean", "required": false, "description": "True when a shell command\'s target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments." },
                 { "key": "path", "type": "string", "required": false, "description": "File path targeted by the tool call" },
                 { "key": "conversation_turn", "type": "number", "required": false, "description": "Current conversation turn number" },
                 { "key": "multi_turn_detection", "type": "boolean", "required": false, "description": "Whether multi-turn injection patterns were detected across tool calls" },
@@ -3698,6 +3931,11 @@ export const AI_GATEWAY_CONTEXT = {
                 { "key": "tool_is_sensitive", "type": "boolean", "required": false, "description": "Tool sensitivity flag" },
                 { "key": "tool_is_builtin", "type": "boolean", "required": false, "description": "Built-in tool flag" },
                 { "key": "tool_operation_classes", "type": "array", "required": false, "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: \'readonly\', \'write_enabling\', \'execute_enabling\', \'network_access\', \'unknown\'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). \'unknown\' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy." },
+                { "key": "resolved_target_paths", "type": "string", "required": false, "description": "Newline-delimited (leading+trailing \\n) union of the statically-resolved absolute target paths a shell command touches, any capability, emitted by the bash AST detector. Cedar like is full-string anchored and every value starts with the \\n delimiter, so patterns must begin with \'*\': anchored sub-tree \"*\\n/etc/*\" (matches only paths under /etc, unlike the loose \"*/etc/*\" which also hits a project etc/ dir at any depth), bare directory \"*\\n/etc\\n*\" (e.g. rm -rf /etc, no trailing slash), exact file \"*\\n/etc/passwd\\n*\". Resolution is purely lexical (cwd-join + path.Clean; quoting, escapes, wrappers, cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated. NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim." },
+                { "key": "read_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command reads or enumerates, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with \'*\' (see resolved_target_paths). NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim." },
+                { "key": "write_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command writes, creates, or destroys (redirects, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i), emitted by the bash AST detector. \\n-anchored: e.g. write_target_paths like \"*\\n/etc/cron.d/*\". NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim." },
+                { "key": "exec_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command executes as a script, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with \'*\' (see resolved_target_paths). NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim." },
+                { "key": "unresolved_target", "type": "boolean", "required": false, "description": "True when a shell command\'s target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments. NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim." },
                 { "key": "mcp_server_verified", "type": "boolean", "required": false, "description": "Whether server is from verified registry" },
                 { "key": "violence_score", "type": "number", "required": false, "description": "Violence content score (0-100)" },
                 { "key": "weapons_score", "type": "number", "required": false, "description": "Weapons content score (0-100)" },
@@ -3848,6 +4086,57 @@ export const AI_GATEWAY_CONTEXT = {
                 { "key": "tpm_exceeded", "type": "boolean", "required": false, "description": "Whether the TPM limit has been exceeded. Use this to enforce token rate limits via Cedar policy" }
             ]
         },
+        {
+            "name": "process_response",
+            "description": "Process a model response (LLM chat completion output) — threat focus: data leakage in output, harmful content, hallucination, indirect injection carried back to the caller. Distinct trigger from process_prompt (ADR 0031) so a policy can be scoped to one direction from its head and prompt-only detectors stay off the egress path.",
+            "context_attributes": [
+                { "key": "role", "type": "string", "required": false, "description": "Caller\'s RBAC role projected from the principal\'s token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim." },
+                { "key": "privilege_scope", "type": "array", "required": false, "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim." },
+                { "key": "content", "type": "string", "required": true, "description": "Raw content being scanned" },
+                { "key": "mcp_server", "type": "string", "required": false, "description": "MCP server name" },
+                { "key": "threat_count", "type": "number", "required": false, "description": "Total threats detected" },
+                { "key": "highest_severity", "type": "string", "required": false, "description": "Highest threat severity" },
+                { "key": "threat_categories", "type": "array", "required": false, "description": "Threat category names" },
+                { "key": "detected_threats", "type": "array", "required": false, "description": "Detection rule names that matched" },
+                { "key": "max_threat_severity", "type": "number", "required": false, "description": "Numeric severity (0-4)" },
+                { "key": "secrets_detected", "type": "boolean", "required": false, "description": "Whether secrets/credentials detected" },
+                { "key": "secret_types", "type": "array", "required": false, "description": "Types of secrets found" },
+                { "key": "secret_count", "type": "number", "required": false, "description": "Number of distinct secrets" },
+                { "key": "pii_detected", "type": "boolean", "required": false, "description": "Whether PII detected" },
+                { "key": "pii_types", "type": "array", "required": false, "description": "Types of PII detected" },
+                { "key": "pii_count", "type": "number", "required": false, "description": "Number of PII matches" },
+                { "key": "pii_score", "type": "number", "required": false, "description": "PII classifier confidence (0-100)" },
+                { "key": "injection_score", "type": "number", "required": false, "description": "Injection classifier confidence (0-100)" },
+                { "key": "jailbreak_score", "type": "number", "required": false, "description": "Jailbreak classifier confidence (0-100)" },
+                { "key": "violence_score", "type": "number", "required": false, "description": "Violence content score (0-100)" },
+                { "key": "weapons_score", "type": "number", "required": false, "description": "Weapons content score (0-100)" },
+                { "key": "hate_speech_score", "type": "number", "required": false, "description": "Hate speech score (0-100)" },
+                { "key": "crime_score", "type": "number", "required": false, "description": "Crime content score (0-100)" },
+                { "key": "sexual_score", "type": "number", "required": false, "description": "Sexual content score (0-100)" },
+                { "key": "profanity_score", "type": "number", "required": false, "description": "Profanity score (0-100)" },
+                { "key": "invisible_chars_detected", "type": "boolean", "required": false, "description": "Invisible Unicode chars detected" },
+                { "key": "invisible_chars_score", "type": "number", "required": false, "description": "Unicode attack severity (0-100)" },
+                { "key": "model_name", "type": "string", "required": false, "description": "Target model name (e.g., gpt-4, claude-3-opus)" },
+                { "key": "model_provider", "type": "string", "required": false, "description": "Provider name (e.g., openai, anthropic, bedrock)" },
+                { "key": "session_threat_turns", "type": "number", "required": false, "description": "Count of turns with detected threats in this session" },
+                { "key": "session_cumulative_risk_score", "type": "number", "required": false, "description": "Cumulative risk score across session turns" },
+                { "key": "session_injection_detected", "type": "boolean", "required": false, "description": "Injection seen in any prior turn of this session" },
+                { "key": "session_command_injection", "type": "boolean", "required": false, "description": "Command injection seen in any prior turn of this session" },
+                { "key": "session_pii_detected", "type": "boolean", "required": false, "description": "PII seen in any prior turn of this session" },
+                { "key": "session_pii_types", "type": "array", "required": false, "description": "PII types accumulated across session" },
+                { "key": "session_secrets_detected", "type": "boolean", "required": false, "description": "Secrets seen in any prior turn of this session" },
+                { "key": "session_secret_types", "type": "array", "required": false, "description": "Secret types accumulated across session" },
+                { "key": "session_max_injection_score", "type": "number", "required": false, "description": "Max injection score across session turns" },
+                { "key": "session_max_jailbreak_score", "type": "number", "required": false, "description": "Max jailbreak score across session turns" },
+                { "key": "session_max_command_injection_score", "type": "number", "required": false, "description": "Max command-injection score across session turns" },
+                { "key": "session_max_pii_score", "type": "number", "required": false, "description": "Max pii score across session turns" },
+                { "key": "session_max_secret_score", "type": "number", "required": false, "description": "Max secret score across session turns" },
+                { "key": "rpm_remaining_pct", "type": "number", "required": false, "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)" },
+                { "key": "rpm_exceeded", "type": "boolean", "required": false, "description": "Whether the RPM limit has been exceeded. Use this to enforce rate limits via Cedar policy" },
+                { "key": "tpm_remaining_pct", "type": "number", "required": false, "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)" },
+                { "key": "tpm_exceeded", "type": "boolean", "required": false, "description": "Whether the TPM limit has been exceeded. Use this to enforce token rate limits via Cedar policy" }
+            ]
+        },
         {
             "name": "read_file",
             "description": "Read an MCP resource — threat focus: secrets exposure, PII exposure",
@@ -4047,6 +4336,117 @@ export const GUARDRAILS_CONTEXT = {
                 { "key": "agent_publisher", "type": "string", "required": false, "description": "Organization that published the agent (e.g., \'anthropic\', \'internal\', \'acme-corp\'). Use this for organization-level trust policies" }
             ]
         },
+        {
+            "name": "process_response",
+            "description": "Process a model response (LLM chat completion output) — threat focus: data leakage in output, harmful content, hallucination, indirect injection carried back to the caller. Distinct trigger from process_prompt (ADR 0031) so a policy can be scoped to one direction from its head and prompt-only detectors stay off the egress path.",
+            "context_attributes": [
+                { "key": "role", "type": "string", "required": false, "description": "Caller\'s RBAC role projected from the principal\'s token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim." },
+                { "key": "privilege_scope", "type": "array", "required": false, "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim." },
+                { "key": "identity_type", "type": "string", "required": false, "description": "Principal identity class projected from the token: \'human\', \'agent\', or \'service\'. Use to apply identity-class-specific policies" },
+                { "key": "principal", "type": "string", "required": false, "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id). Absent when the token carries no principal claim" },
+                { "key": "request_id", "type": "string", "required": true, "description": "Unique identifier for this request, useful for audit trails and debugging" },
+                { "key": "timestamp", "type": "number", "required": true, "description": "Unix timestamp in milliseconds when the request was processed" },
+                { "key": "direction", "type": "string", "required": true, "description": "Content flow direction: \'input\' for user prompts, \'output\' for AI responses. Use this to apply different policies to inputs vs outputs (e.g., block PII only in outputs)" },
+                { "key": "content_type", "type": "string", "required": true, "description": "Type of content being analyzed: \'prompt\', \'response\', \'tool_call\', \'file\', or \'clipboard\'" },
+                { "key": "detector_count", "type": "number", "required": true, "description": "Number of detectors that were executed for this request" },
+                { "key": "injection_score", "type": "number", "required": false, "description": "Combined prompt injection confidence (0-100). MAX of all detector scores (Pulse + DeepContext). Use injection_pulse_score / injection_deep_context_score for individual detector control" },
+                { "key": "jailbreak_score", "type": "number", "required": false, "description": "Combined jailbreak detection confidence (0-100). MAX of all detector scores (Pulse + DeepContext). Use jailbreak_pulse_score / jailbreak_deep_context_score for individual detector control" },
+                { "key": "injection_pulse_score", "type": "number", "required": false, "description": "Highflame single-turn classifier score for prompt injection (0-100). Raw score from Pulse detector before combination with deep-context. Use for per-detector policy control" },
+                { "key": "injection_deep_context_score", "type": "number", "required": false, "description": "DeepContext multi-turn analyzer score for prompt injection (0-100). Tracks injection patterns across conversation history. Generally higher confidence than single-turn" },
+                { "key": "jailbreak_pulse_score", "type": "number", "required": false, "description": "Highflame single-turn classifier score for jailbreak attempts (0-100). Raw score from Pulse detector before combination with deep-context" },
+                { "key": "jailbreak_deep_context_score", "type": "number", "required": false, "description": "DeepContext multi-turn analyzer score for jailbreak attempts (0-100). Detects jailbreak escalation patterns across conversation turns" },
+                { "key": "injection_type", "type": "string", "required": false, "description": "Type of injection detected: \'prompt\', \'sql\', \'command\', or \'none\'. Use this to apply different policies per injection type" },
+                { "key": "secrets_detected", "type": "boolean", "required": false, "description": "Whether any API keys, tokens, passwords, or credentials were detected in the content. True indicates presence of secrets" },
+                { "key": "secret_count", "type": "number", "required": false, "description": "Total number of secret matches found. Multiple matches may indicate data dumps or accidental credential exposure" },
+                { "key": "secret_types", "type": "array", "required": false, "description": "Array of secret types found (e.g., [\'aws_access_key\', \'github_token\']). Use set operations like .contains() to check for specific types" },
+                { "key": "pii_detected", "type": "boolean", "required": false, "description": "Whether personally identifiable information (PII) was found in the content. Commonly used to block PII in outputs to prevent data leakage" },
+                { "key": "pii_count", "type": "number", "required": false, "description": "Total number of PII matches found (emails, phone numbers, SSNs, etc.)" },
+                { "key": "pii_types", "type": "array", "required": false, "description": "Array of PII types detected (e.g., [\'email\', \'phone\', \'ssn\', \'credit_card\']). Use .contains() to block specific sensitive types" },
+                { "key": "pii_score", "type": "number", "required": false, "description": "PII detection ML classifier confidence (0-100). Catches novel PII patterns including names, addresses, and identifiers that regex rules may miss. Typical threshold: >=80 for high-confidence blocking" },
+                { "key": "highest_severity", "type": "string", "required": false, "description": "Highest severity level across all detection engines: \'critical\', \'high\', \'medium\', \'low\', or \'none\'. Use for severity-based catch-all policies (e.g., block any content flagged as critical)" },
+                { "key": "violence_score", "type": "number", "required": false, "description": "ML-based score for violent content references (0-100). Typical threshold: >90 for critical blocks, >60 for warnings" },
+                { "key": "hate_speech_score", "type": "number", "required": false, "description": "ML-based score for hate speech, discriminatory language, or targeted harassment (0-100). Typical threshold: >75 for blocks" },
+                { "key": "sexual_score", "type": "number", "required": false, "description": "ML-based score for sexual or adult content (0-100). Adjust thresholds based on your application\'s audience" },
+                { "key": "weapons_score", "type": "number", "required": false, "description": "ML-based score for weapons references or violent imagery (0-100)" },
+                { "key": "crime_score", "type": "number", "required": false, "description": "ML-based score for criminal activity discussions (0-100)" },
+                { "key": "profanity_score", "type": "number", "required": false, "description": "ML-based score for profanity and vulgar language (0-100)" },
+                { "key": "content_topics", "type": "array", "required": false, "description": "Semantic topics detected in content (e.g., [\'controlled_substances\', \'weapons_manufacturing\']). Use .contains() to block specific topics per application" },
+                { "key": "topic_confidence", "type": "number", "required": false, "description": "Confidence score from topic classifier (0-100). Use with content_topics to tune sensitivity — higher thresholds reduce false positives" },
+                { "key": "invisible_chars_detected", "type": "boolean", "required": false, "description": "Whether invisible Unicode characters (zero-width joiners, RTL marks, etc.) were detected in the content. Commonly used for prompt injection evasion" },
+                { "key": "invisible_chars_score", "type": "number", "required": false, "description": "Density score for invisible characters in the content (0-100). Higher scores indicate more invisible characters, suggesting evasion attempts" },
+                { "key": "command_injection_detected", "type": "boolean", "required": false, "description": "Whether command injection patterns were detected in the content (reverse shells, privilege escalation, destructive commands)" },
+                { "key": "command_injection_type", "type": "string", "required": false, "description": "Type of command injection: \'reverse_shell\', \'privilege_escalation\', \'code_execution\', \'destructive_command\', or \'data_exfiltration\'" },
+                { "key": "command_injection_score", "type": "number", "required": false, "description": "Confidence score for command injection detection (0-100). Higher scores indicate stronger pattern matches" },
+                { "key": "path_traversal_detected", "type": "boolean", "required": false, "description": "Whether path traversal patterns were detected (e.g., ../../../etc/passwd, URL-encoded variants)" },
+                { "key": "path_traversal_severity", "type": "string", "required": false, "description": "Severity of path traversal: \'critical\' (sensitive system files), \'high\' (deep traversal), \'medium\' (moderate traversal), \'low\', or \'none\'" },
+                { "key": "path_traversal_type", "type": "string", "required": false, "description": "Type of path traversal detected (e.g., \'sensitive_file\', \'deep_traversal\', \'encoded_traversal\')" },
+                { "key": "sql_injection_detected", "type": "boolean", "required": false, "description": "Whether SQL injection patterns were detected (tautologies, UNION-based, destructive queries)" },
+                { "key": "sql_injection_type", "type": "string", "required": false, "description": "Type of SQL injection: \'tautology\', \'union_based\', \'destructive\', \'blind\', or \'error_based\'" },
+                { "key": "sql_injection_score", "type": "number", "required": false, "description": "Confidence score for SQL injection detection (0-100). Typical threshold: >=75 for blocks" },
+                { "key": "cross_origin_detected", "type": "boolean", "required": false, "description": "Whether cross-origin escalation patterns were detected (tool calls or references crossing trust boundaries)" },
+                { "key": "cross_origin_type", "type": "string", "required": false, "description": "Type of cross-origin escalation: \'cross_origin_tool\', \'cross_origin_server\', or \'none\'" },
+                { "key": "cross_origin_score", "type": "number", "required": false, "description": "Risk score for cross-origin escalation (0-100). Higher scores indicate more suspicious cross-boundary activity" },
+                { "key": "package_install_detected", "type": "boolean", "required": false, "description": "Whether the event contains a recognized package install/download command (pip, npm, yarn, pnpm, bun, uv, gem, cargo, go, composer)" },
+                { "key": "packages_checked", "type": "number", "required": false, "description": "Number of unique packages checked against the osv.dev database for this event" },
+                { "key": "malicious_package_detected", "type": "boolean", "required": false, "description": "Whether any referenced package has a known-malicious OSV advisory (OpenSSF MAL- ID). Use to block supply-chain attacks at install time" },
+                { "key": "malicious_package_score", "type": "number", "required": false, "description": "100 when a malicious package was detected, 0 otherwise" },
+                { "key": "malicious_packages", "type": "array", "required": false, "description": "Malicious packages as ecosystem/name[@version] strings (e.g. \'PyPI/evil-pkg@1.0.0\')" },
+                { "key": "package_names", "type": "array", "required": false, "description": "Names of all packages parsed from the install command (without ecosystem prefix), e.g. [\'requests\', \'left-pad\']. Available even when the osv.dev lookup fails." },
+                { "key": "package_ecosystems", "type": "array", "required": false, "description": "Unique package ecosystems seen in this event, e.g. [\'PyPI\', \'npm\']. Useful for policy rules that restrict which ecosystems are permitted." },
+                { "key": "package_advisory_count", "type": "number", "required": false, "description": "Total number of non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected." },
+                { "key": "package_risk_score", "type": "number", "required": false, "description": "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory_count for advisory-only packages; 0 when all packages are clean." },
+                { "key": "package_check_status", "type": "string", "required": false, "description": "Set to \'degraded\' when the osv.dev lookup failed and packages could not be verified (fail-open). Combine with package_install_detected to fail closed" },
+                { "key": "encoded_content_detected", "type": "boolean", "required": false, "description": "Whether encoded content was detected (base64, hex, unicode, URL encoding) that may hide malicious payloads" },
+                { "key": "encoded_types", "type": "array", "required": false, "description": "Array of encoding types detected (e.g., [\'base64\', \'hex\', \'unicode\', \'url\']). Use .contains() to check for specific encoding types" },
+                { "key": "encoded_count", "type": "number", "required": false, "description": "Number of encoded segments found in the content" },
+                { "key": "encoded_score", "type": "number", "required": false, "description": "Risk score for encoded injection attempts (0-100). Considers encoding density and decoded content patterns" },
+                { "key": "detected_language", "type": "string", "required": false, "description": "ISO language code of the detected language (e.g., \'en\', \'fr\', \'zh\'). Use this for language-specific policy enforcement" },
+                { "key": "is_english", "type": "boolean", "required": false, "description": "Whether the content is in English. Useful for applying English-only policies or flagging non-English content" },
+                { "key": "language_confidence", "type": "number", "required": false, "description": "Confidence score for language detection (0-100). Use with detected_language to tune sensitivity" },
+                { "key": "detected_script", "type": "string", "required": false, "description": "Writing script detected in content: \'latin\', \'cyrillic\', \'arabic\', \'cjk\', \'unknown\', etc. Use to detect script-switching attacks" },
+                { "key": "is_latin_script", "type": "boolean", "required": false, "description": "Whether the content uses Latin script. Useful for detecting non-Latin script injection attempts" },
+                { "key": "script_confidence", "type": "number", "required": false, "description": "Confidence score for script detection (0-100)" },
+                { "key": "hallucination_score", "type": "number", "required": false, "description": "ML-based score for hallucinated or fabricated content (0-100). Higher scores indicate higher likelihood of non-factual claims" },
+                { "key": "factuality_score", "type": "number", "required": false, "description": "ML-based factuality assessment score (0-100). Higher scores indicate more factually grounded content" },
+                { "key": "sentiment_score", "type": "number", "required": false, "description": "Sentiment analysis score. Use to detect overly negative or manipulative tone in prompts or responses" },
+                { "key": "contains_code", "type": "boolean", "required": false, "description": "Whether code snippets were detected in the content" },
+                { "key": "code_languages", "type": "array", "required": false, "description": "Array of programming languages detected in code snippets (e.g., [\'python\', \'javascript\'])" },
+                { "key": "code_ratio", "type": "number", "required": false, "description": "Percentage of content that consists of code (0-100). High values may indicate code dumps or automated content" },
+                { "key": "keyword_matched", "type": "boolean", "required": false, "description": "Whether any configured keywords or phrases were matched in the content" },
+                { "key": "keyword_categories", "type": "array", "required": false, "description": "Array of keyword categories matched (e.g., [\'competitor_names\', \'restricted_topics\']). Use .contains() for category-specific policies" },
+                { "key": "keyword_count", "type": "number", "required": false, "description": "Number of keyword matches found in the content" },
+                { "key": "contains_non_ascii", "type": "boolean", "required": false, "description": "Whether non-ASCII characters were detected. May indicate obfuscation or encoding-based evasion attempts" },
+                { "key": "phishing_detected", "type": "boolean", "required": false, "description": "Whether phishing patterns were detected in the content (suspicious URLs, impersonation, credential requests)" },
+                { "key": "content_safety_score", "type": "number", "required": false, "description": "Aggregate content safety score (0-100). Combines multiple safety signals into a single risk indicator" },
+                { "key": "content_safety_blocked", "type": "boolean", "required": false, "description": "Whether content was flagged for blocking by the content safety system" },
+                { "key": "conversation_turn", "type": "number", "required": false, "description": "Current conversation turn number. Use for policies that escalate strictness over long conversations" },
+                { "key": "multi_turn_detection", "type": "boolean", "required": false, "description": "Whether multi-turn injection patterns were detected (attack spread across multiple conversation turns)" },
+                { "key": "rpm_remaining_pct", "type": "number", "required": false, "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)" },
+                { "key": "rpm_exceeded", "type": "boolean", "required": false, "description": "Whether the RPM limit has been exceeded. Use this to enforce rate limits via Cedar policy" },
+                { "key": "tpm_remaining_pct", "type": "number", "required": false, "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)" },
+                { "key": "tpm_exceeded", "type": "boolean", "required": false, "description": "Whether the TPM limit has been exceeded. Use this to enforce token rate limits via Cedar policy" },
+                { "key": "session_pii_detected", "type": "boolean", "required": false, "description": "Whether PII was detected in any previous turn of the session" },
+                { "key": "session_pii_types", "type": "array", "required": false, "description": "PII types detected across the session (accumulated)" },
+                { "key": "session_secrets_detected", "type": "boolean", "required": false, "description": "Whether secrets were detected in any previous turn of the session" },
+                { "key": "session_secret_types", "type": "array", "required": false, "description": "Secret types detected across the session (accumulated)" },
+                { "key": "session_injection_detected", "type": "boolean", "required": false, "description": "Whether prompt injection was detected in any previous turn of the session" },
+                { "key": "session_command_injection", "type": "boolean", "required": false, "description": "Whether command injection was detected in any previous turn of the session" },
+                { "key": "session_threat_turns", "type": "number", "required": false, "description": "Number of turns in the session where threats were detected" },
+                { "key": "session_max_injection_score", "type": "number", "required": false, "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions" },
+                { "key": "session_max_jailbreak_score", "type": "number", "required": false, "description": "Highest jailbreak detection score seen in any turn of the session (0-100)" },
+                { "key": "session_max_command_injection_score", "type": "number", "required": false, "description": "Highest command injection score seen in any turn of the session (0-100)" },
+                { "key": "session_max_pii_score", "type": "number", "required": false, "description": "Highest PII risk score seen in any turn of the session (0-100)" },
+                { "key": "session_max_secret_score", "type": "number", "required": false, "description": "Highest secret detection score seen in any turn of the session (0-100)" },
+                { "key": "session_cumulative_risk_score", "type": "number", "required": false, "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant" },
+                { "key": "session_max_sensitivity", "type": "string", "required": false, "description": "Highest data-sensitivity tier observed across the session (e.g. \'public\', \'internal\', \'confidential\', \'restricted\'). Use for session-level escalation policies" },
+                { "key": "session_original_request", "type": "string", "required": false, "description": "The session\'s first user request, retained for drift / goal-hijack policies that compare later turns against the original intent" },
+                { "key": "agent_id", "type": "string", "required": false, "description": "Unique identifier of the authenticated AI agent making this request (e.g., \'agent_research_v3\'). Empty string for human user requests. Use this to write agent-specific policies" },
+                { "key": "agent_type", "type": "string", "required": false, "description": "Type of the authenticated agent: \'orchestrator\' (coordinates sub-agents), \'autonomous\' (self-directed), \'tool_agent\' (single-purpose tool), or \'human_proxy\' (acts on behalf of a human). Empty string for human users" },
+                { "key": "agent_trust_level", "type": "string", "required": false, "description": "Trust level of the authenticated agent: \'first_party\' (your own agents), \'verified_third_party\' (audited external agents), or \'unverified\' (unknown agents). Use this for tiered access control — e.g., only first_party agents can call dangerous tools" },
+                { "key": "agent_framework", "type": "string", "required": false, "description": "Framework or SDK the agent is built with (e.g., \'claude-code\', \'langchain\', \'crewai\', \'autogen\'). Use this to apply framework-specific policies" },
+                { "key": "agent_publisher", "type": "string", "required": false, "description": "Organization that published the agent (e.g., \'anthropic\', \'internal\', \'acme-corp\'). Use this for organization-level trust policies" }
+            ]
+        },
         {
             "name": "call_tool",
             "description": "Execute agentic tool calls, including shell commands, file operations, and MCP tools",
@@ -4113,6 +4513,11 @@ export const GUARDRAILS_CONTEXT = {
                 { "key": "mcp_input_request_types", "type": "array", "required": false, "description": "Threat shapes found in the input request (e.g. [\'credential_elicitation\', \'sampling_injection\', \'root_probe\']). Use .contains() to block a specific shape" },
                 { "key": "mcp_input_request_methods", "type": "array", "required": false, "description": "MCP methods the server asked the client to perform (e.g. [\'elicitation/create\', \'sampling/createMessage\', \'roots/list\']). Independent of content, so a policy can refuse a capability outright — e.g. mcp_input_request_methods.contains(\"sampling/createMessage\") on an unverified server — rather than only reacting to a payload that was successfully classified" },
                 { "key": "tool_operation_classes", "type": "array", "required": false, "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: \'readonly\', \'write_enabling\', \'execute_enabling\', \'network_access\', \'unknown\'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). \'unknown\' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy." },
+                { "key": "resolved_target_paths", "type": "string", "required": false, "description": "Newline-delimited (leading+trailing \\n) union of the statically-resolved absolute target paths a shell command touches, any capability, emitted by the bash AST detector. Cedar like is full-string anchored and every value starts with the \\n delimiter, so patterns must begin with \'*\': anchored sub-tree \"*\\n/etc/*\" (matches only paths under /etc, unlike the loose \"*/etc/*\" which also hits a project etc/ dir at any depth), bare directory \"*\\n/etc\\n*\" (e.g. rm -rf /etc, no trailing slash), exact file \"*\\n/etc/passwd\\n*\". Resolution is purely lexical (cwd-join + path.Clean; quoting, escapes, wrappers, cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated." },
+                { "key": "read_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command reads or enumerates, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with \'*\' (see resolved_target_paths)." },
+                { "key": "write_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command writes, creates, or destroys (redirects, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i), emitted by the bash AST detector. \\n-anchored: e.g. write_target_paths like \"*\\n/etc/cron.d/*\"." },
+                { "key": "exec_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command executes as a script, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with \'*\' (see resolved_target_paths)." },
+                { "key": "unresolved_target", "type": "boolean", "required": false, "description": "True when a shell command\'s target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments." },
                 { "key": "cross_origin_detected", "type": "boolean", "required": false, "description": "Whether cross-origin escalation patterns were detected in tool calls crossing trust boundaries" },
                 { "key": "cross_origin_type", "type": "string", "required": false, "description": "Type of cross-origin escalation detected in tool call" },
                 { "key": "cross_origin_score", "type": "number", "required": false, "description": "Risk score for cross-origin escalation in tool calls (0-100)" },
@@ -4432,6 +4837,11 @@ export const OVERWATCH_CONTEXT = {
                 { "key": "sequence_risk", "type": "number", "required": false, "description": "Behavioral sequence risk score (0-100)" },
                 { "key": "mcp_server_verified", "type": "boolean", "required": false, "description": "Whether the MCP server is from a verified registry" },
                 { "key": "tool_operation_classes", "type": "array", "required": false, "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: \'readonly\', \'write_enabling\', \'execute_enabling\', \'network_access\', \'unknown\'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). Used by the Bash Operation Classes template. \'unknown\' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy." },
+                { "key": "resolved_target_paths", "type": "string", "required": false, "description": "Newline-delimited (leading+trailing \\n) union of the statically-resolved absolute target paths a shell command touches, any capability, emitted by the bash AST detector. Cedar like is full-string anchored and every value starts with the \\n delimiter, so patterns must begin with \'*\': anchored sub-tree \"*\\n/etc/*\" (matches only paths under /etc, unlike the loose \"*/etc/*\" which also hits a project etc/ dir at any depth), bare directory \"*\\n/etc\\n*\" (e.g. rm -rf /etc, no trailing slash), exact file \"*\\n/etc/passwd\\n*\". Resolution is purely lexical (cwd-join + path.Clean; quoting, escapes, wrappers, cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated." },
+                { "key": "read_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command reads or enumerates, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with \'*\' (see resolved_target_paths)." },
+                { "key": "write_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command writes, creates, or destroys (redirects, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i), emitted by the bash AST detector. \\n-anchored: e.g. write_target_paths like \"*\\n/etc/cron.d/*\"." },
+                { "key": "exec_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command executes as a script, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with \'*\' (see resolved_target_paths)." },
+                { "key": "unresolved_target", "type": "boolean", "required": false, "description": "True when a shell command\'s target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments." },
                 { "key": "package_install_detected", "type": "boolean", "required": false, "description": "True iff a package install/download command was recognized in the tool call arguments." },
                 { "key": "malicious_package_detected", "type": "boolean", "required": false, "description": "True iff any referenced package has a known-malicious (MAL-) OSV advisory." },
                 { "key": "malicious_package_score", "type": "number", "required": false, "description": "100 when a malicious package was detected, 0 otherwise." },