@highflame/policy 2.2.36 → 2.2.37

package/dist/agent_ops-entities.gen.js

@@ -7,7 +7,7 @@
 export const AGENT_OPS_ENTITIES = {
     principals: ['Agent', 'User'],
     resources: ['Agent', 'App', 'Session'],
-    actions: ['call_tool', 'connect_server', 'process_prompt', 'provision_sandbox', 'read_file', 'write_file'],
+    actions: ['call_tool', 'connect_server', 'process_prompt', 'process_response', 'provision_sandbox', 'read_file', 'write_file'],
 };
 /**
  * Per-action entity mapping for AgentOps.
@@ -26,6 +26,10 @@ export const AGENT_OPS_ACTION_ENTITIES = {
         principals: ['Agent', 'User'],
         resources: ['Agent', 'App', 'Session'],
     },
+    'process_response': {
+        principals: ['Agent', 'User'],
+        resources: ['Agent', 'App', 'Session'],
+    },
     'provision_sandbox': {
         principals: ['Agent', 'User'],
         resources: ['Agent', 'Session'],

package/dist/ai_gateway-defaults.gen.js

@@ -32,21 +32,20 @@ permit (
 const AI_GATEWAY_SEMANTIC_DEFAULTS_CEDAR = `// =============================================================================
 // Semantic Threat Detection (Default)
 // =============================================================================
-// Blocks prompt injection, jailbreak attempts, and high-severity threats in
-// MCP tool calls and LLM prompts. Uses both detection-engine rule triggers and
-// ML classifier confidence scores.
+// Blocks prompt injection and jailbreak attempts in MCP tool calls and LLM
+// prompts via ML classifier confidence scores.
 //
-// Detection layers:
-//   - Rule triggers (detected_threats), always available
-//   - ML classifier scores (injection_score, jailbreak_score), require API token
-//   - Severity aggregation (highest_severity, threat_count), catch-all rules
+// The detected_threats rule-trigger clauses and the highest_severity /
+// threat_count severity-aggregation clauses this template used to carry were
+// removed: AIGateway does not run threat aggregation, so its projected context
+// never contains those keys and the rules could never fire
+// (highflame-shield#429). The ML-score rules below are the working coverage
+// for the same threats. Restore aggregate rules only if the product gains
+// aggregation.
 //
 // Context keys consumed:
-//   - detected_threats:  Set<String>
 //   - injection_score:   Long (0-100)
 //   - jailbreak_score:   Long (0-100)
-//   - highest_severity:  String
-//   - threat_count:      Long
 //
 // Compliance:
 //   - OWASP LLM01, OWASP LLM02
@@ -60,21 +59,6 @@ const AI_GATEWAY_SEMANTIC_DEFAULTS_CEDAR = `// =================================
 // Section 1: Prompt injection
 // ---------------------------------------------------------------------------
 
-@id("semantic.block-injection-rule")
-@name("Block injection (rule)")
-@description("Blocks call_tool when detected_threats contains \\"prompt_injection\\".")
-@severity("critical")
-@tags("category:semantic,threat:injection,detection:rule,surface:call-tool,owasp:llm01,mitre:atlas-t0051,posture:baseline")
-@reject_message("Tool execution blocked: prompt injection patterns detected (OWASP LLM01).")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("prompt_injection")
-};
-
 @id("semantic.block-injection-ml")
 @name("Block injection (ML)")
 @description("Blocks call_tool when injection_score >= 75.")
@@ -94,21 +78,6 @@ when {
 // Section 2: Jailbreak
 // ---------------------------------------------------------------------------
 
-@id("semantic.block-jailbreak-rule")
-@name("Block jailbreak (rule)")
-@description("Blocks call_tool when detected_threats contains \\"jailbreak\\".")
-@severity("critical")
-@tags("category:semantic,threat:jailbreak,detection:rule,surface:call-tool,owasp:llm02,mitre:atlas-t0054,posture:baseline")
-@reject_message("Tool execution blocked: jailbreak patterns detected (OWASP LLM02).")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("jailbreak")
-};
-
 @id("semantic.block-jailbreak-ml")
 @name("Block jailbreak (ML)")
 @description("Blocks call_tool when jailbreak_score >= 75.")
@@ -123,58 +92,19 @@ forbid (
 when {
     context has jailbreak_score && context.jailbreak_score >= 75
 };
-
-// ---------------------------------------------------------------------------
-// Section 3: Severity aggregation
-// ---------------------------------------------------------------------------
-
-@id("semantic.block-critical")
-@name("Block critical threats")
-@description("Blocks all MCP operations when highest_severity equals \\"critical\\".")
-@severity("critical")
-@tags("category:semantic,detection:aggregate,posture:catch-all")
-@reject_message("MCP operation blocked: a critical-severity threat was detected.")
-forbid (
-    principal,
-    action,
-    resource
-)
-when {
-    context has highest_severity && context.highest_severity == "critical"
-};
-
-@id("semantic.block-multi-threat")
-@name("Block multi-threat tool calls")
-@description("Blocks call_tool when threat_count >= 3.")
-@severity("high")
-@tags("category:semantic,detection:aggregate,surface:call-tool,posture:catch-all")
-@reject_message("Tool execution blocked: multiple concurrent security threats were detected.")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has threat_count && context.threat_count >= 3
-};
 `;
 const AI_GATEWAY_TOOLS_DEFAULTS_CEDAR = `// =============================================================================
 // Tool Permissioning (Default)
 // =============================================================================
-// Blocks MCP tool calls based on risk scoring, threat detection, and tool
-// classification.
+// Blocks MCP tool calls based on risk scoring and tool classification.
 //
 // Detection layers:
 //   - Computed risk score (tool_risk_score)
 //   - Detector category labels (tool_category, tool_is_sensitive)
-//   - Threat aggregation (threat_count, max_threat_severity)
 //
 // Context keys consumed:
 //   - tool_risk_score:      Long (0-100)
 //   - tool_category:        String
-//   - tool_is_sensitive:    Bool
-//   - threat_count:         Long
-//   - max_threat_severity:  Long (0-4)
 //
 // Compliance:
 //   - OWASP LLM06, OWASP ASI02
@@ -213,41 +143,15 @@ when {
     context has tool_category && context.tool_category == "dangerous"
 };
 
-@id("tools.block-sensitive-with-threats")
-@name("Block sensitive tools with threats")
-@description("Blocks call_tool when tool_is_sensitive is true and threat_count >= 1.")
-@severity("high")
-@tags("category:tools,detection:aggregate,surface:call-tool,owasp:llm06")
-@reject_message("Tool execution blocked: a sensitive tool was called while threats were detected.")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has tool_is_sensitive && context.tool_is_sensitive == true &&
-    context has threat_count && context.threat_count >= 1
-};
-
-@id("tools.block-high-severity")
-@name("Block high-severity tool calls")
-@description("Blocks call_tool when threat_count >= 1 and max_threat_severity >= 3.")
-@severity("high")
-@tags("category:tools,detection:aggregate,surface:call-tool")
-@reject_message("Tool execution blocked: high or critical severity threats were detected.")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has threat_count && context has max_threat_severity &&
-    context.threat_count >= 1 && context.max_threat_severity >= 3
-};
-
 // The command-injection rule was removed while that detector is disabled, so
 // this template cannot instantiate a rule that can never fire. See
 // highflame-shield#386; restore it when the detector is re-enabled.
+
+// The threat_count / max_threat_severity aggregate rules
+// (tools.block-sensitive-with-threats, tools.block-high-severity) were removed
+// for the same reason: AIGateway does not run threat aggregation, so its
+// projected context never contains those keys and the rules could never fire
+// (highflame-shield#429). Restore them only if the product gains aggregation.
 `;
 const AI_GATEWAY_AGENT_SECURITY_DEFAULTS_CEDAR = `// =============================================================================
 // Agent Security (Default)
@@ -264,7 +168,6 @@ const AI_GATEWAY_AGENT_SECURITY_DEFAULTS_CEDAR = `// ===========================
 //   - mcp_server_verified:       Bool
 //   - mcp_config_risk:           Bool
 //   - mcp_risk_score:            Long (0-100)
-//   - threat_count:              Long
 //
 // Compliance:
 //   - OWASP LLM01, OWASP ASI01, OWASP ASI02, OWASP ASI04
@@ -366,21 +269,11 @@ when {
 // Section 4: MCP supply chain & trust
 // ---------------------------------------------------------------------------
 
-@id("agent-security.block-unverified-threats")
-@name("Block unverified server threats")
-@description("Blocks call_tool when mcp_server_verified is false and threat_count >= 1.")
-@severity("high")
-@tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:asi04")
-@reject_message("Tool execution blocked: the MCP server is unverified and security threats were detected.")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has mcp_server_verified && context.mcp_server_verified == false &&
-    context has threat_count && context.threat_count >= 1
-};
+// The agent-security.block-unverified-threats rule (unverified server AND
+// threat_count >= 1) was removed: AIGateway does not run threat aggregation,
+// so threat_count is never in its projected context and the rule could never
+// fire (highflame-shield#429). A working "unverified server + any detection"
+// rule needs a key the product actually projects; restore only with one.
 
 @id("agent-security.block-mcp-config-risk")
 @name("Block risky MCP server configs")
@@ -595,13 +488,13 @@ const AI_GATEWAY_DATA_PROTECTION_SECRETS_CEDAR = `// ===========================
 
 @id("data-protection.block-secrets")
 @name("Block secrets in prompts")
-@description("Blocks process_prompt when secrets_detected is true.")
+@description("Blocks process_prompt and process_response when secrets_detected is true.")
 @severity("critical")
-@tags("category:data-protection,threat:secrets,detection:rule,surface:process-prompt,owasp:llm06")
+@tags("category:data-protection,threat:secrets,detection:rule,surface:process-prompt,surface:process-response,owasp:llm06")
 @reject_message("Prompt blocked: secrets or credentials were detected — remove sensitive data and retry.")
 forbid (
     principal,
-    action == AIGateway::Action::"process_prompt",
+    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"process_response"],
     resource
 )
 when {
@@ -647,7 +540,8 @@ const AI_GATEWAY_PRIVACY_DEFAULTS_CEDAR = `// ==================================
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -668,7 +562,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -683,7 +578,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -704,7 +600,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -727,7 +624,8 @@ when {
 @reject_message("Content blocked: tax identifier (ITIN or EIN) patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -747,7 +645,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -777,7 +676,8 @@ when {
 @reject_message("Content blocked: cryptocurrency wallet address patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -812,7 +712,8 @@ const AI_GATEWAY_PRIVACY_PII_MODEL_CEDAR = `// =================================
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -827,7 +728,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -842,7 +744,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -857,7 +760,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -872,7 +776,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -903,7 +808,8 @@ const AI_GATEWAY_PRIVACY_ADVANCED_PII_CEDAR = `// ==============================
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -925,7 +831,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -944,7 +851,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -966,7 +874,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -990,7 +899,8 @@ when {
 @reject_message("Content blocked: tax identifier (ITIN or EIN) patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -1010,7 +920,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -1041,7 +952,8 @@ when {
 @reject_message("Content blocked: cryptocurrency wallet address patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -1060,7 +972,8 @@ when {
 @reject_message("Content blocked: personal name patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -1079,7 +992,8 @@ when {
 @reject_message("Content blocked: email address patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -1098,7 +1012,8 @@ when {
 @reject_message("Content blocked: phone number patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -1117,7 +1032,8 @@ when {
 @reject_message("Content blocked: date or time patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -1139,7 +1055,8 @@ when {
 @reject_message("Content blocked: URL patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -1158,7 +1075,8 @@ when {
 @reject_message("Content blocked: street address or location patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -1179,7 +1097,8 @@ when {
 @reject_message("Content blocked: organization name patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -1198,7 +1117,8 @@ when {
 @reject_message("Content blocked: occupation patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -1217,7 +1137,8 @@ when {
 @reject_message("Content blocked: username patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -1236,7 +1157,8 @@ when {
 @reject_message("Content blocked: employee or customer identifier patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -1257,7 +1179,8 @@ when {
 @reject_message("Content blocked: device or network identifier patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -1284,7 +1207,8 @@ when {
 @reject_message("Content blocked: vehicle identifier (VIN or plate) patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -1304,7 +1228,8 @@ when {
 @reject_message("Content blocked: salary or financial amount patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -1325,7 +1250,8 @@ when {
 @reject_message("Content blocked: sensitive attribute (ethnicity, religion, etc.) patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {

package/dist/ai_gateway-entities.gen.js

@@ -6,8 +6,8 @@
  */
 export const AI_GATEWAY_ENTITIES = {
     principals: ['MCP_Client', 'User'],
-    resources: ['FilePath', 'LlmPrompt', 'Server', 'Tool'],
-    actions: ['call_tool', 'connect_server', 'process_prompt', 'read_file', 'write_file'],
+    resources: ['FilePath', 'LlmPrompt', 'LlmResponse', 'Server', 'Tool'],
+    actions: ['call_tool', 'connect_server', 'process_prompt', 'process_response', 'read_file', 'write_file'],
 };
 /**
  * Per-action entity mapping for AiGateway.
@@ -26,6 +26,10 @@ export const AI_GATEWAY_ACTION_ENTITIES = {
         principals: ['MCP_Client', 'User'],
         resources: ['LlmPrompt'],
     },
+    'process_response': {
+        principals: ['MCP_Client', 'User'],
+        resources: ['LlmResponse'],
+    },
     'read_file': {
         principals: ['MCP_Client', 'User'],
         resources: ['FilePath'],