@highflame/policy 2.2.35 → 2.2.37

package/_schemas/guardrails/schema.cedarschema

@@ -55,13 +55,24 @@ namespace Guardrails {
     // Actions
     // =========================================================================
 
-    /// Process user prompts and AI responses for security threats and content violations
+    /// Process user prompts for security threats and content violations
     action "process_prompt" appliesTo {
         principal: [User, Agent],
         resource: [App, Agent, Session],
         context: ProcessPromptContext
     };
 
+    /// Process model responses for security threats and content violations.
+    /// Distinct trigger from process_prompt (ADR 0031) so a policy can be
+    /// scoped to one direction from its head, and so Shield's action-scoped
+    /// detector scheduling (INV-DET-001) keeps prompt-only detectors off the
+    /// egress path.
+    action "process_response" appliesTo {
+        principal: [User, Agent],
+        resource: [App, Agent, Session],
+        context: ProcessResponseContext
+    };
+
     /// Execute tool calls (shell, file operations, MCP tools)
     action "call_tool" appliesTo {
         principal: [User, Agent],
@@ -94,7 +105,17 @@ namespace Guardrails {
     // Context Types (Action-Specific)
     // =========================================================================
 
-    /// Context for process_prompt action (user prompts & AI responses)
+    /// Context for the process_response action.
+    ///
+    /// An alias, not a copy: prompts and responses are inspected by the same
+    /// detector pipeline and carry the same keys — only the trigger differs
+    /// (ADR 0031). Aliasing means a new detector key cannot land on one
+    /// direction and go missing on the other, and it guarantees no policy
+    /// loses a context key at the cutover, since this is byte-for-byte the
+    /// shape responses were already evaluated against under process_prompt.
+    type ProcessResponseContext = ProcessPromptContext;
+
+    /// Context for process_prompt action (user prompts)
     type ProcessPromptContext = {
         // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
         "role"?: String,
@@ -405,6 +426,13 @@ namespace Guardrails {
         // Tool Operation Classifier (optional) — populated by AST-based classifiers (bash, python, etc.)
         "tool_operation_classes"?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
 
+        // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \n); Cedar `like` is anchored so patterns start with "*": sub-tree "*\n/etc/*", bare dir "*\n/etc\n*", exact "*\n/etc/passwd\n*" ---
+        "resolved_target_paths"?: String,  // union of resolved absolute target paths, any capability
+        "read_target_paths"?: String,      // paths the command reads or enumerates
+        "write_target_paths"?: String,     // paths the command writes, creates, or destroys
+        "exec_target_paths"?: String,      // paths executed as a script
+        "unresolved_target"?: Bool,        // a target hid behind a variable/glob/$()/inline code, or the path-list cap truncated
+
         // Agentic - Multi-Turn Context (optional)
         "conversation_turn"?: Long,
         "multi_turn_detection"?: Bool,

package/_schemas/guardrails/templates/defaults/agent_identity.cedar

@@ -87,13 +87,13 @@ when {
 
 @id("agent-identity.block-autonomous-injection")
 @name("Block injection on autonomous agents")
-@description("Blocks process_prompt when agent_type is \"autonomous\" and injection_score >= 51.")
+@description("Blocks process_prompt and process_response when agent_type is \"autonomous\" and injection_score >= 51.")
 @severity("high")
-@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,owasp:llm01")
+@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,surface:process-response,owasp:llm01")
 @reject_message("Prompt blocked: lower injection threshold applies to autonomous agents and was exceeded.")
 forbid (
     principal is Guardrails::Agent,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {

package/_schemas/guardrails/templates/defaults/injection.cedar

@@ -21,13 +21,14 @@
 
 @id("security.block-injection-ml")
 @name("Block injection (ML)")
-@description("Blocks process_prompt and call_tool when injection_score >= 86.")
+@description("Blocks process_prompt, process_response, and call_tool when injection_score >= 86.")
 @severity("high")
 @tags("category:security,threat:injection,detection:ml,owasp:llm01,mitre:atlas-t0051")
 @reject_message("Prompt blocked: the ML classifier detected prompt injection with high confidence.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool"],
     resource
 )
 when {
@@ -36,13 +37,13 @@ when {
 
 @id("security.block-jailbreak-ml")
 @name("Block jailbreak (ML)")
-@description("Blocks process_prompt when jailbreak_score >= 81.")
+@description("Blocks process_prompt and process_response when jailbreak_score >= 81.")
 @severity("high")
 @tags("category:security,threat:jailbreak,detection:ml,owasp:llm02,mitre:atlas-t0054")
 @reject_message("Prompt blocked: the ML classifier detected a jailbreak attempt with high confidence.")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -51,13 +52,13 @@ when {
 
 @id("security.block-injection-combined")
 @name("Block injection + jailbreak (combined)")
-@description("Blocks process_prompt when injection_score >= 61 and jailbreak_score >= 61.")
+@description("Blocks process_prompt and process_response when injection_score >= 61 and jailbreak_score >= 61.")
 @severity("high")
 @tags("category:security,threat:injection,threat:jailbreak,detection:ml")
 @reject_message("Prompt blocked: moderate injection and jailbreak signals were detected together.")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -67,13 +68,13 @@ when {
 
 @id("security.block-invisible-chars")
 @name("Block invisible-character injection")
-@description("Blocks process_prompt when invisible_chars_detected is true and invisible_chars_score >= 51.")
+@description("Blocks process_prompt and process_response when invisible_chars_detected is true and invisible_chars_score >= 51.")
 @severity("high")
 @tags("category:security,threat:invisible-chars,threat:injection,detection:pattern")
 @reject_message("Prompt blocked: invisible Unicode characters often used for injection were detected.")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {

package/_schemas/guardrails/templates/defaults/pii.cedar

@@ -22,7 +22,8 @@
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -43,7 +44,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -58,7 +60,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -79,7 +82,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -102,7 +106,8 @@ when {
 @reject_message("Content blocked: tax identifier (ITIN or EIN) patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -122,7 +127,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -152,7 +158,8 @@ when {
 @reject_message("Content blocked: cryptocurrency wallet address patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {

package/_schemas/guardrails/templates/defaults/pii_model.cedar

@@ -22,7 +22,8 @@
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -37,7 +38,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -52,7 +54,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -67,7 +70,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -82,7 +86,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {

package/_schemas/guardrails/templates/defaults/secrets.cedar

@@ -18,7 +18,7 @@
 
 @id("data-protection.block-secrets")
 @name("Block secrets")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secrets_detected is true.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secrets_detected is true.")
 @severity("critical")
 @tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
 @reject_message("Request blocked: secrets or credentials were detected in the content.")
@@ -26,6 +26,7 @@ forbid (
     principal,
     action in [
         Guardrails::Action::"process_prompt",
+        Guardrails::Action::"process_response",
         Guardrails::Action::"call_tool",
         Guardrails::Action::"read_file",
         Guardrails::Action::"write_file"
@@ -38,7 +39,7 @@ when {
 
 @id("data-protection.block-secrets-bulk")
 @name("Block secrets (bulk)")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secret_count >= 3.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secret_count >= 3.")
 @severity("critical")
 @tags("category:data-protection,threat:secrets,threat:exfiltration,detection:aggregate,owasp:llm06")
 @reject_message("Request blocked: multiple distinct secrets were detected — possible credential dump.")
@@ -46,6 +47,7 @@ forbid (
     principal,
     action in [
         Guardrails::Action::"process_prompt",
+        Guardrails::Action::"process_response",
         Guardrails::Action::"call_tool",
         Guardrails::Action::"read_file",
         Guardrails::Action::"write_file"

package/_schemas/guardrails/templates/defaults/security_patterns.cedar

@@ -23,7 +23,7 @@
 
 @id("security.block-path-traversal")
 @name("Block path traversal")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")
 @severity("high")
 @tags("category:security,threat:path-traversal,detection:pattern,mitre:t1005")
 @reject_message("Request blocked: path traversal pattern detected — sensitive system files or deep directory traversal.")
@@ -31,6 +31,7 @@ forbid (
     principal,
     action in [
         Guardrails::Action::"process_prompt",
+        Guardrails::Action::"process_response",
         Guardrails::Action::"call_tool",
         Guardrails::Action::"read_file",
         Guardrails::Action::"write_file"
@@ -45,13 +46,14 @@ when {
 
 @id("security.block-sql-injection")
 @name("Block SQL injection")
-@description("Blocks process_prompt and call_tool when sql_injection_detected is true and sql_injection_score >= 75.")
+@description("Blocks process_prompt, process_response, and call_tool when sql_injection_detected is true and sql_injection_score >= 75.")
 @severity("high")
 @tags("category:security,threat:sql-injection,detection:pattern")
 @reject_message("Request blocked: SQL injection pattern detected — tautology, UNION attack, or destructive query.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool"],
     resource
 )
 when {

package/_schemas/guardrails/templates/defaults/semantic.cedar

@@ -18,13 +18,13 @@
 
 @id("trust-safety.block-dangerous-topics")
 @name("Block dangerous topics")
-@description("Blocks process_prompt when content_topics contains weapons or explosives categories.")
+@description("Blocks process_prompt and process_response when content_topics contains weapons or explosives categories.")
 @severity("critical")
 @tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: content classified under a dangerous topic (weapons, explosives, illegal synthesis).")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -38,13 +38,13 @@ when {
 
 @id("trust-safety.block-controlled-substances")
 @name("Block controlled substances")
-@description("Blocks process_prompt when content_topics contains controlled substances or precursor chemicals.")
+@description("Blocks process_prompt and process_response when content_topics contains controlled substances or precursor chemicals.")
 @severity("high")
 @tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: content discusses controlled substances or precursor chemicals.")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -58,13 +58,13 @@ when {
 
 @id("trust-safety.block-restricted-topics")
 @name("Block high-confidence restricted topics")
-@description("Blocks process_prompt when topic_confidence >= 81 and content_topics contains a restricted category.")
+@description("Blocks process_prompt and process_response when topic_confidence >= 81 and content_topics contains a restricted category.")
 @severity("high")
 @tags("category:trust-safety,threat:harmful,detection:ml")
 @reject_message("Prompt blocked: content high-confidence classified into a restricted topic (illegal activity, fraud, social engineering).")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {

package/_schemas/guardrails/templates/defaults/toxicity.cedar

@@ -23,13 +23,13 @@
 
 @id("trust-safety.block-toxicity-critical")
 @name("Block critical toxicity")
-@description("Blocks process_prompt when any toxicity score is >= 91.")
+@description("Blocks process_prompt and process_response when any toxicity score is >= 91.")
 @severity("critical")
 @tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act,compliance:iso-42001")
 @reject_message("Prompt blocked: critical-severity toxic content detected.")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -43,13 +43,13 @@ when {
 
 @id("trust-safety.block-hate-speech")
 @name("Block hate speech")
-@description("Blocks process_prompt when hate_speech_score >= 76.")
+@description("Blocks process_prompt and process_response when hate_speech_score >= 76.")
 @severity("high")
 @tags("category:trust-safety,threat:hate-speech,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: hate speech detected.")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -58,13 +58,13 @@ when {
 
 @id("trust-safety.block-toxicity-combined")
 @name("Block combined toxicity")
-@description("Blocks process_prompt when any two toxicity scores are >= 61.")
+@description("Blocks process_prompt and process_response when any two toxicity scores are >= 61.")
 @severity("high")
 @tags("category:trust-safety,threat:harmful,detection:aggregate")
 @reject_message("Prompt blocked: multiple moderate toxicity signals were detected together.")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {

package/_schemas/guardrails/templates/profiles/a2a_security/cross_origin.cedar

@@ -24,13 +24,14 @@
 
 @id("agent-identity.a2a-block-cross-origin-critical")
 @name("Block critical cross-origin from any agent")
-@description("Blocks process_prompt and call_tool when cross_origin_detected is true and cross_origin_score >= 80.")
+@description("Blocks process_prompt, process_response, and call_tool when cross_origin_detected is true and cross_origin_score >= 80.")
 @severity("critical")
 @tags("category:agent-identity,threat:supply-chain,detection:ml,owasp:llm08")
 @reject_message("Request blocked: high-confidence cross-origin trust-boundary violation detected — confused-deputy attack.")
 forbid (
     principal is Guardrails::Agent,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool"],
     resource
 )
 when {
@@ -41,13 +42,14 @@ when {
 
 @id("agent-identity.a2a-block-cross-origin-unverified")
 @name("Block cross-origin from unverified agents")
-@description("Blocks process_prompt and call_tool when agent_trust_level is \"unverified\", cross_origin_detected is true, and cross_origin_score >= 60.")
+@description("Blocks process_prompt, process_response, and call_tool when agent_trust_level is \"unverified\", cross_origin_detected is true, and cross_origin_score >= 60.")
 @severity("high")
 @tags("category:agent-identity,threat:supply-chain,scope:per-agent,detection:ml,owasp:asi03")
 @reject_message("Request blocked: unverified agent attempted cross-origin activity — no trust attestation across trust domains.")
 forbid (
     principal is Guardrails::Agent,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool"],
     resource
 )
 when {

package/_schemas/guardrails/templates/profiles/a2a_security/escalation_detection.cedar

@@ -27,13 +27,14 @@
 
 @id("agent-identity.a2a-block-session-injection-peak")
 @name("Block agents at high session injection peak")
-@description("Blocks call_tool and process_prompt when agent_trust_level is not \"first_party\" and session_max_injection_score >= 70.")
+@description("Blocks call_tool and process_prompt and process_response when agent_trust_level is not \"first_party\" and session_max_injection_score >= 70.")
 @severity("critical")
 @tags("category:agent-identity,threat:injection,scope:per-agent,detection:aggregate,owasp:llm01")
 @reject_message("Request blocked: this session previously crossed the injection peak threshold; non-first-party agents are restricted.")
 forbid (
     principal is Guardrails::Agent,
-    action in [Guardrails::Action::"call_tool", Guardrails::Action::"process_prompt"],
+    action in [Guardrails::Action::"call_tool", Guardrails::Action::"process_prompt",
+ Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -43,13 +44,13 @@ when {
 
 @id("agent-identity.a2a-block-session-jailbreak-peak")
 @name("Block agents at high session jailbreak peak")
-@description("Blocks process_prompt when agent_trust_level is not \"first_party\" and session_max_jailbreak_score >= 70.")
+@description("Blocks process_prompt and process_response when agent_trust_level is not \"first_party\" and session_max_jailbreak_score >= 70.")
 @severity("critical")
 @tags("category:agent-identity,threat:jailbreak,scope:per-agent,detection:aggregate,owasp:llm02")
 @reject_message("Request blocked: this session previously crossed the jailbreak peak threshold; non-first-party agents are restricted.")
 forbid (
     principal is Guardrails::Agent,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {

package/_schemas/guardrails/templates/profiles/a2a_security/inter_agent_injection.cedar

@@ -66,13 +66,13 @@ when {
 
 @id("agent-identity.a2a-block-deep-context-injection")
 @name("Block multi-turn progressive injection")
-@description("Blocks process_prompt when agent_trust_level is not \"first_party\", multi_turn_detection is true, and injection_deep_context_score >= 60.")
+@description("Blocks process_prompt and process_response when agent_trust_level is not \"first_party\", multi_turn_detection is true, and injection_deep_context_score >= 60.")
 @severity("high")
-@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,owasp:llm01")
+@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,surface:process-response,owasp:llm01")
 @reject_message("Prompt blocked: multi-turn progressive injection detected by the deep-context model across conversation history.")
 forbid (
     principal is Guardrails::Agent,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -83,13 +83,13 @@ when {
 
 @id("agent-identity.a2a-block-deep-context-jailbreak")
 @name("Block multi-turn progressive jailbreak")
-@description("Blocks process_prompt when agent_trust_level is not \"first_party\", multi_turn_detection is true, and jailbreak_deep_context_score >= 60.")
+@description("Blocks process_prompt and process_response when agent_trust_level is not \"first_party\", multi_turn_detection is true, and jailbreak_deep_context_score >= 60.")
 @severity("high")
-@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,owasp:llm02")
+@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,surface:process-response,owasp:llm02")
 @reject_message("Prompt blocked: multi-turn progressive jailbreak detected by the deep-context model across conversation history.")
 forbid (
     principal is Guardrails::Agent,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -104,13 +104,14 @@ when {
 
 @id("agent-identity.a2a-block-encoded-injection")
 @name("Block encoded payload delivery between agents")
-@description("Blocks process_prompt and call_tool when agent_id is non-empty, encoded_content_detected is true, and encoded_score >= 60.")
+@description("Blocks process_prompt, process_response, and call_tool when agent_id is non-empty, encoded_content_detected is true, and encoded_score >= 60.")
 @severity("high")
 @tags("category:agent-identity,threat:encoded-payload,detection:pattern,owasp:llm01")
 @reject_message("Request blocked: encoded payload detected in agent communication — agents should exchange plaintext, not encoded content.")
 forbid (
     principal is Guardrails::Agent,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool"],
     resource
 )
 when {