@highflame/policy 2.2.35 → 2.2.37

package/_schemas/ai_gateway/context.json

@@ -187,6 +187,36 @@
           "required": false,
           "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). 'unknown' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy."
         },
+        {
+          "key": "resolved_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited (leading+trailing \\n) union of the statically-resolved absolute target paths a shell command touches, any capability, emitted by the bash AST detector. Cedar like is full-string anchored and every value starts with the \\n delimiter, so patterns must begin with '*': anchored sub-tree \"*\\n/etc/*\" (matches only paths under /etc, unlike the loose \"*/etc/*\" which also hits a project etc/ dir at any depth), bare directory \"*\\n/etc\\n*\" (e.g. rm -rf /etc, no trailing slash), exact file \"*\\n/etc/passwd\\n*\". Resolution is purely lexical (cwd-join + path.Clean; quoting, escapes, wrappers, cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated. NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim."
+        },
+        {
+          "key": "read_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command reads or enumerates, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths). NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim."
+        },
+        {
+          "key": "write_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command writes, creates, or destroys (redirects, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i), emitted by the bash AST detector. \\n-anchored: e.g. write_target_paths like \"*\\n/etc/cron.d/*\". NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim."
+        },
+        {
+          "key": "exec_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command executes as a script, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths). NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim."
+        },
+        {
+          "key": "unresolved_target",
+          "type": "boolean",
+          "required": false,
+          "description": "True when a shell command's target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments. NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim."
+        },
         {
           "key": "mcp_server_verified",
           "type": "boolean",
@@ -1027,6 +1057,284 @@
         }
       ]
     },
+    {
+      "name": "process_response",
+      "description": "Process a model response (LLM chat completion output) — threat focus: data leakage in output, harmful content, hallucination, indirect injection carried back to the caller. Distinct trigger from process_prompt (ADR 0031) so a policy can be scoped to one direction from its head and prompt-only detectors stay off the egress path.",
+      "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
+        {
+          "key": "content",
+          "type": "string",
+          "required": true,
+          "description": "Raw content being scanned"
+        },
+        {
+          "key": "mcp_server",
+          "type": "string",
+          "required": false,
+          "description": "MCP server name"
+        },
+        {
+          "key": "threat_count",
+          "type": "number",
+          "required": false,
+          "description": "Total threats detected"
+        },
+        {
+          "key": "highest_severity",
+          "type": "string",
+          "required": false,
+          "description": "Highest threat severity"
+        },
+        {
+          "key": "threat_categories",
+          "type": "array",
+          "required": false,
+          "description": "Threat category names"
+        },
+        {
+          "key": "detected_threats",
+          "type": "array",
+          "required": false,
+          "description": "Detection rule names that matched"
+        },
+        {
+          "key": "max_threat_severity",
+          "type": "number",
+          "required": false,
+          "description": "Numeric severity (0-4)"
+        },
+        {
+          "key": "secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether secrets/credentials detected"
+        },
+        {
+          "key": "secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Types of secrets found"
+        },
+        {
+          "key": "secret_count",
+          "type": "number",
+          "required": false,
+          "description": "Number of distinct secrets"
+        },
+        {
+          "key": "pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether PII detected"
+        },
+        {
+          "key": "pii_types",
+          "type": "array",
+          "required": false,
+          "description": "Types of PII detected"
+        },
+        {
+          "key": "pii_count",
+          "type": "number",
+          "required": false,
+          "description": "Number of PII matches"
+        },
+        {
+          "key": "pii_score",
+          "type": "number",
+          "required": false,
+          "description": "PII classifier confidence (0-100)"
+        },
+        {
+          "key": "injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Injection classifier confidence (0-100)"
+        },
+        {
+          "key": "jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Jailbreak classifier confidence (0-100)"
+        },
+        {
+          "key": "violence_score",
+          "type": "number",
+          "required": false,
+          "description": "Violence content score (0-100)"
+        },
+        {
+          "key": "weapons_score",
+          "type": "number",
+          "required": false,
+          "description": "Weapons content score (0-100)"
+        },
+        {
+          "key": "hate_speech_score",
+          "type": "number",
+          "required": false,
+          "description": "Hate speech score (0-100)"
+        },
+        {
+          "key": "crime_score",
+          "type": "number",
+          "required": false,
+          "description": "Crime content score (0-100)"
+        },
+        {
+          "key": "sexual_score",
+          "type": "number",
+          "required": false,
+          "description": "Sexual content score (0-100)"
+        },
+        {
+          "key": "profanity_score",
+          "type": "number",
+          "required": false,
+          "description": "Profanity score (0-100)"
+        },
+        {
+          "key": "invisible_chars_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Invisible Unicode chars detected"
+        },
+        {
+          "key": "invisible_chars_score",
+          "type": "number",
+          "required": false,
+          "description": "Unicode attack severity (0-100)"
+        },
+        {
+          "key": "model_name",
+          "type": "string",
+          "required": false,
+          "description": "Target model name (e.g., gpt-4, claude-3-opus)"
+        },
+        {
+          "key": "model_provider",
+          "type": "string",
+          "required": false,
+          "description": "Provider name (e.g., openai, anthropic, bedrock)"
+        },
+        {
+          "key": "session_threat_turns",
+          "type": "number",
+          "required": false,
+          "description": "Count of turns with detected threats in this session"
+        },
+        {
+          "key": "session_cumulative_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Cumulative risk score across session turns"
+        },
+        {
+          "key": "session_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Injection seen in any prior turn of this session"
+        },
+        {
+          "key": "session_command_injection",
+          "type": "boolean",
+          "required": false,
+          "description": "Command injection seen in any prior turn of this session"
+        },
+        {
+          "key": "session_pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "PII seen in any prior turn of this session"
+        },
+        {
+          "key": "session_pii_types",
+          "type": "array",
+          "required": false,
+          "description": "PII types accumulated across session"
+        },
+        {
+          "key": "session_secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Secrets seen in any prior turn of this session"
+        },
+        {
+          "key": "session_secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Secret types accumulated across session"
+        },
+        {
+          "key": "session_max_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Max injection score across session turns"
+        },
+        {
+          "key": "session_max_jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Max jailbreak score across session turns"
+        },
+        {
+          "key": "session_max_command_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Max command-injection score across session turns"
+        },
+        {
+          "key": "session_max_pii_score",
+          "type": "number",
+          "required": false,
+          "description": "Max pii score across session turns"
+        },
+        {
+          "key": "session_max_secret_score",
+          "type": "number",
+          "required": false,
+          "description": "Max secret score across session turns"
+        },
+        {
+          "key": "rpm_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
+        },
+        {
+          "key": "rpm_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the RPM limit has been exceeded. Use this to enforce rate limits via Cedar policy"
+        },
+        {
+          "key": "tpm_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
+        },
+        {
+          "key": "tpm_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the TPM limit has been exceeded. Use this to enforce token rate limits via Cedar policy"
+        }
+      ]
+    },
     {
       "name": "read_file",
       "description": "Read an MCP resource — threat focus: secrets exposure, PII exposure",

package/_schemas/ai_gateway/schema.cedarschema

@@ -60,6 +60,13 @@ entity Server in [Project];
 /// MCP prompt -- resource for process_prompt action
 entity LlmPrompt in [Project];
 
+/// Model response -- resource for process_response action.
+/// Parented to Project like every other resource: Shield injects
+/// `when { resource in <Ns>::Project::"<id>" }` into every synced rule
+/// (shield#428), so a resource outside the project hierarchy would make
+/// every policy written against it unsatisfiable.
+entity LlmResponse in [Project];
+
 /// File/resource path -- resource for read_file/write_file actions
 entity FilePath in [Project];
 
@@ -122,6 +129,13 @@ action call_tool appliesTo {
     // --- Tool Operation Classifier ---
     tool_operation_classes?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
 
+    // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \n); Cedar `like` is anchored so patterns start with "*": sub-tree "*\n/etc/*", bare dir "*\n/etc\n*", exact "*\n/etc/passwd\n*" ---
+    resolved_target_paths?: String,  // union of resolved absolute target paths, any capability
+    read_target_paths?: String,      // paths the command reads or enumerates
+    write_target_paths?: String,     // paths the command writes, creates, or destroys
+    exec_target_paths?: String,      // paths executed as a script
+    unresolved_target?: Bool,        // a target hid behind a variable/glob/$()/inline code, or the path-list cap truncated
+
     // --- MCP Trust ---
     mcp_server_verified?: Bool,       // Whether server is from verified registry
 
@@ -260,12 +274,13 @@ action connect_server appliesTo {
   },
 };
 
-// Process a prompt (MCP prompts/get or LLM chat completions)
-// Threat focus: injection, jailbreak, secrets, PII, content safety
-action process_prompt appliesTo {
-  principal: [User, MCP_Client],
-  resource: [LlmPrompt],
-  context: {
+// Shared content-inspection context.
+//
+// Prompts and responses are inspected by the same detector pipeline and so
+// carry the same context keys; only the TRIGGER differs (ADR 0031). Declaring
+// the shape once means a new detector key cannot land on one direction and go
+// missing on the other — the drift class shield#393 / shield#387 were about.
+type ContentInspectionContext = {
     // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
     role?: String,
     privilege_scope?: Set<String>,
@@ -344,7 +359,29 @@ action process_prompt appliesTo {
     rpm_exceeded?: Bool,
     tpm_remaining_pct?: Long,
     tpm_exceeded?: Bool,
-  },
+};
+
+// Process a prompt (MCP prompts/get or LLM chat completions)
+// Threat focus: injection, jailbreak, secrets, PII, content safety
+action process_prompt appliesTo {
+  principal: [User, MCP_Client],
+  resource: [LlmPrompt],
+  context: ContentInspectionContext,
+};
+
+// Process a model response (LLM chat completion output, streamed or buffered)
+// Threat focus: data leakage in output, harmful content, hallucination,
+// indirect injection carried back to the caller.
+//
+// Distinct from process_prompt so that (a) a policy can be scoped to one
+// direction from its head alone and (b) Shield's action-scoped detector
+// scheduling (INV-DET-001) can keep prompt-only detectors off the egress
+// path — before this action existed, a prompt-scoped dlp/model_armor/webhook
+// rule shipped response bodies downstream. See ADR 0031.
+action process_response appliesTo {
+  principal: [User, MCP_Client],
+  resource: [LlmResponse],
+  context: ContentInspectionContext,
 };
 
 // Read an MCP resource (resources/read, resources/list)

package/_schemas/ai_gateway/templates/defaults/agent_security.cedar

@@ -13,7 +13,6 @@
 //   - mcp_server_verified:       Bool
 //   - mcp_config_risk:           Bool
 //   - mcp_risk_score:            Long (0-100)
-//   - threat_count:              Long
 //
 // Compliance:
 //   - OWASP LLM01, OWASP ASI01, OWASP ASI02, OWASP ASI04
@@ -115,21 +114,11 @@ when {
 // Section 4: MCP supply chain & trust
 // ---------------------------------------------------------------------------
 
-@id("agent-security.block-unverified-threats")
-@name("Block unverified server threats")
-@description("Blocks call_tool when mcp_server_verified is false and threat_count >= 1.")
-@severity("high")
-@tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:asi04")
-@reject_message("Tool execution blocked: the MCP server is unverified and security threats were detected.")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has mcp_server_verified && context.mcp_server_verified == false &&
-    context has threat_count && context.threat_count >= 1
-};
+// The agent-security.block-unverified-threats rule (unverified server AND
+// threat_count >= 1) was removed: AIGateway does not run threat aggregation,
+// so threat_count is never in its projected context and the rule could never
+// fire (highflame-shield#429). A working "unverified server + any detection"
+// rule needs a key the product actually projects; restore only with one.
 
 @id("agent-security.block-mcp-config-risk")
 @name("Block risky MCP server configs")

package/_schemas/ai_gateway/templates/defaults/pii.cedar

@@ -22,7 +22,8 @@
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -43,7 +44,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -58,7 +60,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -79,7 +82,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -102,7 +106,8 @@ when {
 @reject_message("Content blocked: tax identifier (ITIN or EIN) patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -122,7 +127,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -152,7 +158,8 @@ when {
 @reject_message("Content blocked: cryptocurrency wallet address patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {