@highflame/policy 2.2.35 → 2.2.37

package/_schemas/agent_ops/schema.cedarschema

@@ -60,13 +60,23 @@ namespace AgentOps {
     // Actions
     // =========================================================================
 
-    /// Process user prompts and AI responses for security threats and content violations
+    /// Process user prompts for security threats and content violations
     action "process_prompt" appliesTo {
         principal: [User, Agent],
         resource: [App, Agent, Session],
         context: ProcessPromptContext
     };
 
+    /// Process model responses for security threats and content violations.
+    /// Distinct trigger from process_prompt (ADR 0031). Declared ahead of a
+    /// caller: no AgentOps producer emits model responses today, so this is
+    /// namespace symmetry with ai_gateway/guardrails until one does.
+    action "process_response" appliesTo {
+        principal: [User, Agent],
+        resource: [App, Agent, Session],
+        context: ProcessResponseContext
+    };
+
     /// Execute tool calls (shell, file operations, MCP tools)
     action "call_tool" appliesTo {
         principal: [User, Agent],
@@ -112,7 +122,15 @@ namespace AgentOps {
     // Context Types (Action-Specific)
     // =========================================================================
 
-    /// Context for process_prompt action (user prompts & AI responses)
+    /// Context for the process_response action.
+    ///
+    /// An alias, not a copy: prompts and responses are inspected by the same
+    /// detector pipeline and carry the same keys — only the trigger differs
+    /// (ADR 0031). Aliasing means a new detector key cannot land on one
+    /// direction and go missing on the other.
+    type ProcessResponseContext = ProcessPromptContext;
+
+    /// Context for process_prompt action (user prompts)
     type ProcessPromptContext = {
         // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
         "role"?: String,
@@ -148,12 +166,12 @@ namespace AgentOps {
         "indirect_injection_score"?: Long, // Indirect injection via tool outputs (0-100)
 
         // Privacy - Secrets (optional)
-        "secrets_detected"?: Boolean,
+        "secrets_detected"?: Bool,
         "secret_count"?: Long,
         "secret_types"?: Set<String>,    // ["aws_access_key", "github_token", ...]
 
         // Privacy - PII (optional)
-        "pii_detected"?: Boolean,
+        "pii_detected"?: Bool,
         "pii_count"?: Long,
         "pii_types"?: Set<String>,       // ["email", "phone", "ssn", "credit_card", ...]
         "pii_score"?: Long,         // PII ML classifier confidence (0-100)
@@ -177,65 +195,65 @@ namespace AgentOps {
         "topic_confidence"?: Long,           // 0-100
 
         // Security - Invisible Character Detection (optional)
-        "invisible_chars_detected"?: Boolean,
+        "invisible_chars_detected"?: Bool,
         "invisible_chars_score"?: Long,      // 0-100
 
         // Security - Pattern Detection (optional)
-        "command_injection_detected"?: Boolean,
+        "command_injection_detected"?: Bool,
         "command_injection_type"?: String,       // "reverse_shell" | "privilege_escalation" | ...
         "command_injection_score"?: Long,        // 0-100
-        "path_traversal_detected"?: Boolean,
+        "path_traversal_detected"?: Bool,
         "path_traversal_severity"?: String,      // "critical" | "high" | "medium" | "low" | "none"
         "path_traversal_type"?: String,
-        "sql_injection_detected"?: Boolean,
+        "sql_injection_detected"?: Bool,
         "sql_injection_type"?: String,           // "tautology" | "union_based" | "destructive" | ...
         "sql_injection_score"?: Long,            // 0-100
 
         // Security - Cross-Origin Escalation (optional)
-        "cross_origin_detected"?: Boolean,
+        "cross_origin_detected"?: Bool,
         "cross_origin_type"?: String,            // "cross_origin_tool" | "cross_origin_server" | "none"
         "cross_origin_score"?: Long,             // 0-100
 
         // Security - Encoded Injection (optional)
-        "encoded_content_detected"?: Boolean,
+        "encoded_content_detected"?: Bool,
         "encoded_types"?: Set<String>,           // ["base64", "hex", "unicode", "url", ...]
         "encoded_count"?: Long,
         "encoded_score"?: Long,                  // 0-100
 
         // Language & Script Detection (optional)
         "detected_language"?: String,            // ISO language code
-        "is_english"?: Boolean,
+        "is_english"?: Bool,
         "language_confidence"?: Long,            // 0-100
         "detected_script"?: String,              // "latin" | "cyrillic" | "arabic" | "unknown" | ...
-        "is_latin_script"?: Boolean,
+        "is_latin_script"?: Bool,
         "script_confidence"?: Long,              // 0-100
 
         // Content Analysis (optional)
         "hallucination_score"?: Long,
         "factuality_score"?: Long,               // 0-100
         "sentiment_score"?: Long,
-        "contains_code"?: Boolean,
+        "contains_code"?: Bool,
         "code_languages"?: Set<String>,
         "code_ratio"?: Long,                     // 0-100
-        "keyword_matched"?: Boolean,
+        "keyword_matched"?: Bool,
         "keyword_categories"?: Set<String>,
         "keyword_count"?: Long,
-        "contains_non_ascii"?: Boolean,
-        "phishing_detected"?: Boolean,
+        "contains_non_ascii"?: Bool,
+        "phishing_detected"?: Bool,
         "content_safety_score"?: Long,           // 0-100
-        "content_safety_blocked"?: Boolean,
+        "content_safety_blocked"?: Bool,
 
         // Agentic - Multi-Turn Context (optional)
         "conversation_turn"?: Long,
-        "multi_turn_detection"?: Boolean,
+        "multi_turn_detection"?: Bool,
 
         // Session Detection History — cross-turn sticky flags (optional)
-        "session_pii_detected"?: Boolean,
+        "session_pii_detected"?: Bool,
         "session_pii_types"?: Set<String>,
-        "session_secrets_detected"?: Boolean,
+        "session_secrets_detected"?: Bool,
         "session_secret_types"?: Set<String>,
-        "session_injection_detected"?: Boolean,
-        "session_command_injection"?: Boolean,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
         "session_threat_turns"?: Long,
         "session_max_injection_score"?: Long,
         "session_max_jailbreak_score"?: Long,
@@ -265,14 +283,14 @@ namespace AgentOps {
         "flow_resolution_status"?: String,       // "known" | "inferred" | "unknown" | "conflicted"
         "flow_origins"?: Set<String>,            // "mcp_tool_result" | "model" | "file" | "database" | "user"
         "flow_sink"?: String,                    // "external_model" | "local_model" | "external_mcp" | "trusted_mcp" | "user_secure_output" | "public_network" | "file"
-        "flow_sink_is_external"?: Boolean,
+        "flow_sink_is_external"?: Bool,
         "flow_sink_effects"?: Set<String>,       // "network.send" | "financial.transfer" | "filesystem.write" | ...
         "principal_clearances"?: Set<String>,    // ADR 0020 D8 — clearances AuthN mints for the principal
         "principal_compartments"?: Set<String>,  // ADR 0020 D8 — compartments the principal is admitted to
 
         // Usage Budget — multi-window token & cost enforcement (optional)
         "budget_remaining_pct"?: Long,
-        "budget_exceeded"?: Boolean,
+        "budget_exceeded"?: Bool,
         "budget_cost_micros_this_turn"?: Long,
         "budget_model"?: String,
         "budget_tokens_pct_session"?: Long,
@@ -280,15 +298,15 @@ namespace AgentOps {
         "budget_tokens_pct_monthly"?: Long,
         "budget_cost_pct_daily"?: Long,
         "budget_cost_pct_monthly"?: Long,
-        "budget_exceeded_session"?: Boolean,
-        "budget_exceeded_daily"?: Boolean,
-        "budget_exceeded_monthly"?: Boolean,
+        "budget_exceeded_session"?: Bool,
+        "budget_exceeded_daily"?: Bool,
+        "budget_exceeded_monthly"?: Bool,
 
         // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
         "rpm_remaining_pct"?: Long,
-        "rpm_exceeded"?: Boolean,
+        "rpm_exceeded"?: Bool,
         "tpm_remaining_pct"?: Long,
-        "tpm_exceeded"?: Boolean,
+        "tpm_exceeded"?: Bool,
 
         // Agent Identity — authenticated agent principal metadata (optional)
         "agent_id"?: String,
@@ -300,8 +318,8 @@ namespace AgentOps {
         // Supply-chain / package safety + aggregate threat severity (optional —
         // ADR 0012 unified port). Projected by Shield's malicious-package and
         // threat-severity detectors; every read is `has`-guarded in policy.
-        "malicious_package_detected"?: Boolean,
-        "package_install_detected"?: Boolean,
+        "malicious_package_detected"?: Bool,
+        "package_install_detected"?: Bool,
         "package_check_status"?: String,
         "max_threat_severity"?: Long,
 
@@ -328,9 +346,9 @@ namespace AgentOps {
         // Tool Risk (optional)
         "tool_name"?: String,
         "tool_risk_score"?: Long,        // 0-100
-        "tool_is_sensitive"?: Boolean,
+        "tool_is_sensitive"?: Bool,
         "tool_category"?: String,        // "safe" | "sensitive" | "dangerous"
-        "tool_is_builtin"?: Boolean,
+        "tool_is_builtin"?: Bool,
 
         // AARM R3 (CAP-ENF-007) — Action Parameter Validation
         "action_params"?: {
@@ -343,29 +361,29 @@ namespace AgentOps {
             "target"?: String,
             "query"?: String,
         },
-        "param_type_violation"?: Boolean,
+        "param_type_violation"?: Bool,
         "param_type_violations"?: Set<String>,
 
         // MCP context (optional)
         "mcp_server"?: String,
         "mcp_tool"?: String,
-        "mcp_server_verified"?: Boolean,
+        "mcp_server_verified"?: Bool,
 
         // Agentic - Behavioral Patterns (optional)
-        "suspicious_pattern"?: Boolean,
+        "suspicious_pattern"?: Bool,
         "pattern_type"?: String,         // "data_exfiltration" | "secret_exfiltration" | ...
         "sequence_risk"?: Long,          // 0-100
 
         // Agentic - Loop Detection (optional)
-        "loop_detected"?: Boolean,
+        "loop_detected"?: Bool,
         "loop_count"?: Long,
         "loop_tool"?: String,
 
         // Security checks on tool arguments (optional)
-        "secrets_detected"?: Boolean,
+        "secrets_detected"?: Bool,
         "secret_count"?: Long,
         "secret_types"?: Set<String>,
-        "pii_detected"?: Boolean,
+        "pii_detected"?: Bool,
         "pii_types"?: Set<String>,
         "pii_count"?: Long,
         "pii_score"?: Long,
@@ -380,58 +398,65 @@ namespace AgentOps {
         "topic_confidence"?: Long,           // 0-100
 
         // Security - Pattern Detection (optional)
-        "command_injection_detected"?: Boolean,
+        "command_injection_detected"?: Bool,
         "command_injection_type"?: String,
         "command_injection_score"?: Long,
-        "path_traversal_detected"?: Boolean,
+        "path_traversal_detected"?: Bool,
         "path_traversal_severity"?: String,
         "path_traversal_type"?: String,
-        "sql_injection_detected"?: Boolean,
+        "sql_injection_detected"?: Bool,
         "sql_injection_type"?: String,
         "sql_injection_score"?: Long,
 
         // Security - Cross-Origin Escalation (optional)
-        "cross_origin_detected"?: Boolean,
+        "cross_origin_detected"?: Bool,
         "cross_origin_type"?: String,
         "cross_origin_score"?: Long,
 
         // Security - Invisible Character Detection (optional)
-        "invisible_chars_detected"?: Boolean,
+        "invisible_chars_detected"?: Bool,
         "invisible_chars_score"?: Long,
 
         // Security - Encoded Injection (optional)
-        "encoded_content_detected"?: Boolean,
+        "encoded_content_detected"?: Bool,
         "encoded_types"?: Set<String>,
         "encoded_count"?: Long,
         "encoded_score"?: Long,
 
         // Agentic - Agent Security (optional)
-        "tool_poisoning_detected"?: Boolean,
+        "tool_poisoning_detected"?: Bool,
         "tool_poisoning_score"?: Long,
         "tool_poisoning_type"?: String,
-        "rug_pull_detected"?: Boolean,
+        "rug_pull_detected"?: Bool,
         "rug_pull_score"?: Long,
         "rug_pull_type"?: String,
 
         // Agentic - MCP Risk (optional)
-        "mcp_config_risk"?: Boolean,
+        "mcp_config_risk"?: Bool,
         "mcp_risk_type"?: String,
         "mcp_risk_score"?: Long,
 
         // Tool Operation Classifier (optional)
         "tool_operation_classes"?: Set<String>,
 
+        // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \n); Cedar `like` is anchored so patterns start with "*": sub-tree "*\n/etc/*", bare dir "*\n/etc\n*", exact "*\n/etc/passwd\n*" ---
+        "resolved_target_paths"?: String,  // union of resolved absolute target paths, any capability
+        "read_target_paths"?: String,      // paths the command reads or enumerates
+        "write_target_paths"?: String,     // paths the command writes, creates, or destroys
+        "exec_target_paths"?: String,      // paths executed as a script
+        "unresolved_target"?: Bool,        // a target hid behind a variable/glob/$()/inline code, or the path-list cap truncated
+
         // Agentic - Multi-Turn Context (optional)
         "conversation_turn"?: Long,
-        "multi_turn_detection"?: Boolean,
+        "multi_turn_detection"?: Bool,
 
         // Session Detection History — cross-turn sticky flags (optional)
-        "session_pii_detected"?: Boolean,
+        "session_pii_detected"?: Bool,
         "session_pii_types"?: Set<String>,
-        "session_secrets_detected"?: Boolean,
+        "session_secrets_detected"?: Bool,
         "session_secret_types"?: Set<String>,
-        "session_injection_detected"?: Boolean,
-        "session_command_injection"?: Boolean,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
         "session_threat_turns"?: Long,
         "session_max_injection_score"?: Long,
         "session_max_jailbreak_score"?: Long,
@@ -461,14 +486,14 @@ namespace AgentOps {
         "flow_resolution_status"?: String,       // "known" | "inferred" | "unknown" | "conflicted"
         "flow_origins"?: Set<String>,            // "mcp_tool_result" | "model" | "file" | "database" | "user"
         "flow_sink"?: String,                    // "external_model" | "local_model" | "external_mcp" | "trusted_mcp" | "user_secure_output" | "public_network" | "file"
-        "flow_sink_is_external"?: Boolean,
+        "flow_sink_is_external"?: Bool,
         "flow_sink_effects"?: Set<String>,       // "network.send" | "financial.transfer" | "filesystem.write" | ...
         "principal_clearances"?: Set<String>,    // ADR 0020 D8 — clearances AuthN mints for the principal
         "principal_compartments"?: Set<String>,  // ADR 0020 D8 — compartments the principal is admitted to
 
         // Usage Budget (optional)
         "budget_remaining_pct"?: Long,
-        "budget_exceeded"?: Boolean,
+        "budget_exceeded"?: Bool,
         "budget_cost_micros_this_turn"?: Long,
         "budget_model"?: String,
         "budget_tokens_pct_session"?: Long,
@@ -476,15 +501,15 @@ namespace AgentOps {
         "budget_tokens_pct_monthly"?: Long,
         "budget_cost_pct_daily"?: Long,
         "budget_cost_pct_monthly"?: Long,
-        "budget_exceeded_session"?: Boolean,
-        "budget_exceeded_daily"?: Boolean,
-        "budget_exceeded_monthly"?: Boolean,
+        "budget_exceeded_session"?: Bool,
+        "budget_exceeded_daily"?: Bool,
+        "budget_exceeded_monthly"?: Bool,
 
         // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
         "rpm_remaining_pct"?: Long,
-        "rpm_exceeded"?: Boolean,
+        "rpm_exceeded"?: Bool,
         "tpm_remaining_pct"?: Long,
-        "tpm_exceeded"?: Boolean,
+        "tpm_exceeded"?: Bool,
 
         // Aggregated threat summary (optional)
         "highest_severity"?: String,
@@ -504,8 +529,8 @@ namespace AgentOps {
         // Supply-chain / package safety + aggregate threat severity (optional —
         // ADR 0012 unified port). Projected by Shield's malicious-package and
         // threat-severity detectors; every read is `has`-guarded in policy.
-        "malicious_package_detected"?: Boolean,
-        "package_install_detected"?: Boolean,
+        "malicious_package_detected"?: Bool,
+        "package_install_detected"?: Bool,
         "package_check_status"?: String,
         "max_threat_severity"?: Long,
 
@@ -533,14 +558,14 @@ namespace AgentOps {
         "path"?: String,
 
         // Security checks on file content (optional)
-        "secrets_detected"?: Boolean,
+        "secrets_detected"?: Bool,
         "secret_count"?: Long,
         "secret_types"?: Set<String>,
-        "pii_detected"?: Boolean,
+        "pii_detected"?: Bool,
         "pii_types"?: Set<String>,
 
         // Security - Path Traversal (optional)
-        "path_traversal_detected"?: Boolean,
+        "path_traversal_detected"?: Bool,
         "path_traversal_severity"?: String,
         "path_traversal_type"?: String,
 
@@ -550,12 +575,12 @@ namespace AgentOps {
         "detected_threats"?: Set<String>,
 
         // Session Detection History (optional)
-        "session_pii_detected"?: Boolean,
+        "session_pii_detected"?: Bool,
         "session_pii_types"?: Set<String>,
-        "session_secrets_detected"?: Boolean,
+        "session_secrets_detected"?: Bool,
         "session_secret_types"?: Set<String>,
-        "session_injection_detected"?: Boolean,
-        "session_command_injection"?: Boolean,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
         "session_threat_turns"?: Long,
         "session_max_injection_score"?: Long,
         "session_max_jailbreak_score"?: Long,
@@ -585,14 +610,14 @@ namespace AgentOps {
         "flow_resolution_status"?: String,       // "known" | "inferred" | "unknown" | "conflicted"
         "flow_origins"?: Set<String>,            // "mcp_tool_result" | "model" | "file" | "database" | "user"
         "flow_sink"?: String,                    // "external_model" | "local_model" | "external_mcp" | "trusted_mcp" | "user_secure_output" | "public_network" | "file"
-        "flow_sink_is_external"?: Boolean,
+        "flow_sink_is_external"?: Bool,
         "flow_sink_effects"?: Set<String>,       // "network.send" | "financial.transfer" | "filesystem.write" | ...
         "principal_clearances"?: Set<String>,    // ADR 0020 D8 — clearances AuthN mints for the principal
         "principal_compartments"?: Set<String>,  // ADR 0020 D8 — compartments the principal is admitted to
 
         // Usage Budget (optional)
         "budget_remaining_pct"?: Long,
-        "budget_exceeded"?: Boolean,
+        "budget_exceeded"?: Bool,
         "budget_cost_micros_this_turn"?: Long,
         "budget_model"?: String,
         "budget_tokens_pct_session"?: Long,
@@ -600,15 +625,15 @@ namespace AgentOps {
         "budget_tokens_pct_monthly"?: Long,
         "budget_cost_pct_daily"?: Long,
         "budget_cost_pct_monthly"?: Long,
-        "budget_exceeded_session"?: Boolean,
-        "budget_exceeded_daily"?: Boolean,
-        "budget_exceeded_monthly"?: Boolean,
+        "budget_exceeded_session"?: Bool,
+        "budget_exceeded_daily"?: Bool,
+        "budget_exceeded_monthly"?: Bool,
 
         // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
         "rpm_remaining_pct"?: Long,
-        "rpm_exceeded"?: Boolean,
+        "rpm_exceeded"?: Bool,
         "tpm_remaining_pct"?: Long,
-        "tpm_exceeded"?: Boolean,
+        "tpm_exceeded"?: Bool,
 
         // Agent Identity (optional)
         "agent_id"?: String,
@@ -641,18 +666,18 @@ namespace AgentOps {
         "path"?: String,
 
         // Security - Invisible Character Detection in write content (optional)
-        "invisible_chars_detected"?: Boolean,
+        "invisible_chars_detected"?: Bool,
         "invisible_chars_score"?: Long,
 
         // Security checks on content being written (optional)
-        "secrets_detected"?: Boolean,
+        "secrets_detected"?: Bool,
         "secret_count"?: Long,
         "secret_types"?: Set<String>,
-        "pii_detected"?: Boolean,
+        "pii_detected"?: Bool,
         "pii_types"?: Set<String>,
 
         // Security - Path Traversal (optional)
-        "path_traversal_detected"?: Boolean,
+        "path_traversal_detected"?: Bool,
         "path_traversal_severity"?: String,
         "path_traversal_type"?: String,
 
@@ -662,12 +687,12 @@ namespace AgentOps {
         "detected_threats"?: Set<String>,
 
         // Session Detection History (optional)
-        "session_pii_detected"?: Boolean,
+        "session_pii_detected"?: Bool,
         "session_pii_types"?: Set<String>,
-        "session_secrets_detected"?: Boolean,
+        "session_secrets_detected"?: Bool,
         "session_secret_types"?: Set<String>,
-        "session_injection_detected"?: Boolean,
-        "session_command_injection"?: Boolean,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
         "session_threat_turns"?: Long,
         "session_max_injection_score"?: Long,
         "session_max_jailbreak_score"?: Long,
@@ -697,14 +722,14 @@ namespace AgentOps {
         "flow_resolution_status"?: String,       // "known" | "inferred" | "unknown" | "conflicted"
         "flow_origins"?: Set<String>,            // "mcp_tool_result" | "model" | "file" | "database" | "user"
         "flow_sink"?: String,                    // "external_model" | "local_model" | "external_mcp" | "trusted_mcp" | "user_secure_output" | "public_network" | "file"
-        "flow_sink_is_external"?: Boolean,
+        "flow_sink_is_external"?: Bool,
         "flow_sink_effects"?: Set<String>,       // "network.send" | "financial.transfer" | "filesystem.write" | ...
         "principal_clearances"?: Set<String>,    // ADR 0020 D8 — clearances AuthN mints for the principal
         "principal_compartments"?: Set<String>,  // ADR 0020 D8 — compartments the principal is admitted to
 
         // Usage Budget (optional)
         "budget_remaining_pct"?: Long,
-        "budget_exceeded"?: Boolean,
+        "budget_exceeded"?: Bool,
         "budget_cost_micros_this_turn"?: Long,
         "budget_model"?: String,
         "budget_tokens_pct_session"?: Long,
@@ -712,15 +737,15 @@ namespace AgentOps {
         "budget_tokens_pct_monthly"?: Long,
         "budget_cost_pct_daily"?: Long,
         "budget_cost_pct_monthly"?: Long,
-        "budget_exceeded_session"?: Boolean,
-        "budget_exceeded_daily"?: Boolean,
-        "budget_exceeded_monthly"?: Boolean,
+        "budget_exceeded_session"?: Bool,
+        "budget_exceeded_daily"?: Bool,
+        "budget_exceeded_monthly"?: Bool,
 
         // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
         "rpm_remaining_pct"?: Long,
-        "rpm_exceeded"?: Boolean,
+        "rpm_exceeded"?: Bool,
         "tpm_remaining_pct"?: Long,
-        "tpm_exceeded"?: Boolean,
+        "tpm_exceeded"?: Bool,
 
         // Agent Identity (optional)
         "agent_id"?: String,
@@ -751,20 +776,20 @@ namespace AgentOps {
 
         // MCP context (optional)
         "mcp_server"?: String,
-        "mcp_server_verified"?: Boolean,
+        "mcp_server_verified"?: Bool,
 
         // Agentic - Agent Security (optional)
-        "tool_poisoning_detected"?: Boolean,
+        "tool_poisoning_detected"?: Bool,
         "tool_poisoning_score"?: Long,
         "tool_poisoning_type"?: String,
 
         // Agentic - MCP Risk (optional)
-        "mcp_config_risk"?: Boolean,
+        "mcp_config_risk"?: Bool,
         "mcp_risk_type"?: String,
         "mcp_risk_score"?: Long,
 
         // Security - Cross-Origin Escalation (optional)
-        "cross_origin_detected"?: Boolean,
+        "cross_origin_detected"?: Bool,
         "cross_origin_type"?: String,
         "cross_origin_score"?: Long,
 
@@ -774,12 +799,12 @@ namespace AgentOps {
         "detected_threats"?: Set<String>,
 
         // Session Detection History (optional)
-        "session_pii_detected"?: Boolean,
+        "session_pii_detected"?: Bool,
         "session_pii_types"?: Set<String>,
-        "session_secrets_detected"?: Boolean,
+        "session_secrets_detected"?: Bool,
         "session_secret_types"?: Set<String>,
-        "session_injection_detected"?: Boolean,
-        "session_command_injection"?: Boolean,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
         "session_threat_turns"?: Long,
         "session_max_injection_score"?: Long,
         "session_max_jailbreak_score"?: Long,
@@ -809,14 +834,14 @@ namespace AgentOps {
         "flow_resolution_status"?: String,       // "known" | "inferred" | "unknown" | "conflicted"
         "flow_origins"?: Set<String>,            // "mcp_tool_result" | "model" | "file" | "database" | "user"
         "flow_sink"?: String,                    // "external_model" | "local_model" | "external_mcp" | "trusted_mcp" | "user_secure_output" | "public_network" | "file"
-        "flow_sink_is_external"?: Boolean,
+        "flow_sink_is_external"?: Bool,
         "flow_sink_effects"?: Set<String>,       // "network.send" | "financial.transfer" | "filesystem.write" | ...
         "principal_clearances"?: Set<String>,    // ADR 0020 D8 — clearances AuthN mints for the principal
         "principal_compartments"?: Set<String>,  // ADR 0020 D8 — compartments the principal is admitted to
 
         // Usage Budget (optional)
         "budget_remaining_pct"?: Long,
-        "budget_exceeded"?: Boolean,
+        "budget_exceeded"?: Bool,
         "budget_cost_micros_this_turn"?: Long,
         "budget_model"?: String,
         "budget_tokens_pct_session"?: Long,
@@ -824,15 +849,15 @@ namespace AgentOps {
         "budget_tokens_pct_monthly"?: Long,
         "budget_cost_pct_daily"?: Long,
         "budget_cost_pct_monthly"?: Long,
-        "budget_exceeded_session"?: Boolean,
-        "budget_exceeded_daily"?: Boolean,
-        "budget_exceeded_monthly"?: Boolean,
+        "budget_exceeded_session"?: Bool,
+        "budget_exceeded_daily"?: Bool,
+        "budget_exceeded_monthly"?: Bool,
 
         // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
         "rpm_remaining_pct"?: Long,
-        "rpm_exceeded"?: Boolean,
+        "rpm_exceeded"?: Bool,
         "tpm_remaining_pct"?: Long,
-        "tpm_exceeded"?: Boolean,
+        "tpm_exceeded"?: Bool,
 
         // Agent Identity (optional)
         "agent_id"?: String,
@@ -844,8 +869,8 @@ namespace AgentOps {
         // Supply-chain / package safety + aggregate threat severity (optional —
         // ADR 0012 unified port). Projected by Shield's malicious-package and
         // threat-severity detectors; every read is `has`-guarded in policy.
-        "malicious_package_detected"?: Boolean,
-        "package_install_detected"?: Boolean,
+        "malicious_package_detected"?: Bool,
+        "package_install_detected"?: Bool,
         "package_check_status"?: String,
         "max_threat_severity"?: Long,
 
@@ -891,7 +916,7 @@ namespace AgentOps {
         // requested (i.e. whenever egress_hosts is non-empty), so a "no network"
         // profile can gate on this single boolean. egress_hosts then narrows the
         // host allowlist for profiles that DO permit egress.
-        "network_egress"?: Boolean,
+        "network_egress"?: Bool,
         "egress_hosts"?: Set<String>,          // Host allowlist for egress, e.g. {"pypi.org"}
         "exec_allowlist"?: Set<String>,        // Executables the sandbox may run, e.g. {"python", "python3"}
         // Curated mechanism toggles (ADR 0017 D1.3) — authorization facts only;

package/_schemas/agent_ops/templates/ported/agent-security/agent_identity_a2a_cross_origin.cedar

@@ -24,13 +24,14 @@
 
 @id("agent-identity.a2a-block-cross-origin-critical")
 @name("Block critical cross-origin from any agent")
-@description("Blocks process_prompt and call_tool when cross_origin_detected is true and cross_origin_score >= 80.")
+@description("Blocks process_prompt, process_response, and call_tool when cross_origin_detected is true and cross_origin_score >= 80.")
 @severity("critical")
 @tags("category:agent-identity,threat:supply-chain,detection:ml,owasp:llm08")
 @reject_message("Request blocked: high-confidence cross-origin trust-boundary violation detected — confused-deputy attack.")
 forbid (
     principal is AgentOps::Agent,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -41,13 +42,14 @@ when {
 
 @id("agent-identity.a2a-block-cross-origin-unverified")
 @name("Block cross-origin from unverified agents")
-@description("Blocks process_prompt and call_tool when agent_trust_level is \"unverified\", cross_origin_detected is true, and cross_origin_score >= 60.")
+@description("Blocks process_prompt, process_response, and call_tool when agent_trust_level is \"unverified\", cross_origin_detected is true, and cross_origin_score >= 60.")
 @severity("high")
 @tags("category:agent-identity,threat:supply-chain,scope:per-agent,detection:ml,owasp:asi03")
 @reject_message("Request blocked: unverified agent attempted cross-origin activity — no trust attestation across trust domains.")
 forbid (
     principal is AgentOps::Agent,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {