@highflame/policy 2.2.36 → 2.2.37

package/_schemas/agent_ops/templates/ported/data-protection/privacy_advanced_pii.cedar

@@ -22,7 +22,8 @@
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -44,7 +45,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -63,7 +65,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -85,7 +88,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -109,7 +113,8 @@ when {
 @reject_message("Content blocked: tax identifier (ITIN or EIN) patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -129,7 +134,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -160,7 +166,8 @@ when {
 @reject_message("Content blocked: cryptocurrency wallet address patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -179,7 +186,8 @@ when {
 @reject_message("Content blocked: personal name patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -198,7 +206,8 @@ when {
 @reject_message("Content blocked: email address patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -217,7 +226,8 @@ when {
 @reject_message("Content blocked: phone number patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -236,7 +246,8 @@ when {
 @reject_message("Content blocked: date or time patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -258,7 +269,8 @@ when {
 @reject_message("Content blocked: URL patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -277,7 +289,8 @@ when {
 @reject_message("Content blocked: street address or location patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -298,7 +311,8 @@ when {
 @reject_message("Content blocked: organization name patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -317,7 +331,8 @@ when {
 @reject_message("Content blocked: occupation patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -336,7 +351,8 @@ when {
 @reject_message("Content blocked: username patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -355,7 +371,8 @@ when {
 @reject_message("Content blocked: employee or customer identifier patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -376,7 +393,8 @@ when {
 @reject_message("Content blocked: device or network identifier patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -403,7 +421,8 @@ when {
 @reject_message("Content blocked: vehicle identifier (VIN or plate) patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -423,7 +442,8 @@ when {
 @reject_message("Content blocked: salary or financial amount patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -444,7 +464,8 @@ when {
 @reject_message("Content blocked: sensitive attribute (ethnicity, religion, etc.) patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {

package/_schemas/agent_ops/templates/ported/data-protection/privacy_defaults.cedar

@@ -22,7 +22,8 @@
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -43,7 +44,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -58,7 +60,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -79,7 +82,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -102,7 +106,8 @@ when {
 @reject_message("Content blocked: tax identifier (ITIN or EIN) patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -122,7 +127,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -152,7 +158,8 @@ when {
 @reject_message("Content blocked: cryptocurrency wallet address patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {

package/_schemas/agent_ops/templates/ported/data-protection/privacy_pii_model.cedar

@@ -22,7 +22,8 @@
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -37,7 +38,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -52,7 +54,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -67,7 +70,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -82,7 +86,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {

package/_schemas/agent_ops/templates/ported/organization/organization_team_permissions.cedar

@@ -28,11 +28,12 @@ permit (
 
 @id("organization.allow-support-project-read")
 @name("Permit support project read-only access")
-@description("Permits process_prompt and read_file actions on resources scoped to Project::\"support-project\".")
+@description("Permits process_prompt, process_response, and read_file actions on resources scoped to Project::\"support-project\".")
 @severity("medium")
 @tags("category:organization,scope:per-tool,posture:deny-default")
 permit (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"read_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"read_file"],
     resource in AgentOps::Project::"support-project"
 );

package/_schemas/agent_ops/templates/ported/threat-detection/security_advanced_block_critical_severity.cedar

@@ -16,13 +16,13 @@
 
 @id("security.advanced-block-critical-severity")
 @name("Block critical-severity threats")
-@description("Blocks process_prompt when highest_severity equals \"critical\".")
+@description("Blocks process_prompt and process_response when highest_severity equals \"critical\".")
 @severity("critical")
-@tags("category:security,detection:aggregate,surface:process-prompt,posture:catch-all,compliance:nist-si-3")
+@tags("category:security,detection:aggregate,surface:process-prompt,surface:process-response,posture:catch-all,compliance:nist-si-3")
 @reject_message("Prompt blocked: a critical-severity threat was reported by at least one detector.")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {

package/_schemas/agent_ops/templates/ported/threat-detection/security_chat_assistant.cedar

@@ -18,13 +18,14 @@
 
 @id("security.chat-block-injection")
 @name("Block injection (chat profile)")
-@description("Blocks process_prompt and call_tool when injection_score >= 71 (lower threshold for public chat).")
+@description("Blocks process_prompt, process_response, and call_tool when injection_score >= 71 (lower threshold for public chat).")
 @severity("high")
 @tags("category:security,threat:injection,detection:ml,owasp:llm01")
 @reject_message("Prompt blocked: prompt injection detected with high confidence (chat profile).")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -33,13 +34,13 @@ when {
 
 @id("security.chat-block-jailbreak")
 @name("Block jailbreak (chat profile)")
-@description("Blocks process_prompt when jailbreak_score >= 66 (lower threshold for public chat).")
+@description("Blocks process_prompt and process_response when jailbreak_score >= 66 (lower threshold for public chat).")
 @severity("high")
 @tags("category:security,threat:jailbreak,detection:ml,owasp:llm02")
 @reject_message("Prompt blocked: jailbreak attempt detected with high confidence (chat profile).")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {

package/_schemas/agent_ops/templates/ported/threat-detection/security_data_pipeline_block_injection.cedar

@@ -17,13 +17,14 @@
 
 @id("security.data-pipeline-block-injection")
 @name("Block pipeline injection (data-pipeline profile)")
-@description("Blocks process_prompt and call_tool when injection_score >= 66 (lower threshold for data pipelines).")
+@description("Blocks process_prompt, process_response, and call_tool when injection_score >= 66 (lower threshold for data pipelines).")
 @severity("high")
 @tags("category:security,threat:injection,detection:ml,owasp:llm01")
 @reject_message("Request blocked: prompt injection detected at the data-pipeline threshold — RAG inputs are high-risk for indirect injection.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {

package/_schemas/agent_ops/templates/ported/threat-detection/security_injection.cedar

@@ -21,13 +21,14 @@
 
 @id("security.block-injection-ml")
 @name("Block injection (ML)")
-@description("Blocks process_prompt and call_tool when injection_score >= 86.")
+@description("Blocks process_prompt, process_response, and call_tool when injection_score >= 86.")
 @severity("high")
 @tags("category:security,threat:injection,detection:ml,owasp:llm01,mitre:atlas-t0051")
 @reject_message("Prompt blocked: the ML classifier detected prompt injection with high confidence.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -36,13 +37,13 @@ when {
 
 @id("security.block-jailbreak-ml")
 @name("Block jailbreak (ML)")
-@description("Blocks process_prompt when jailbreak_score >= 81.")
+@description("Blocks process_prompt and process_response when jailbreak_score >= 81.")
 @severity("high")
 @tags("category:security,threat:jailbreak,detection:ml,owasp:llm02,mitre:atlas-t0054")
 @reject_message("Prompt blocked: the ML classifier detected a jailbreak attempt with high confidence.")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -51,13 +52,13 @@ when {
 
 @id("security.block-injection-combined")
 @name("Block injection + jailbreak (combined)")
-@description("Blocks process_prompt when injection_score >= 61 and jailbreak_score >= 61.")
+@description("Blocks process_prompt and process_response when injection_score >= 61 and jailbreak_score >= 61.")
 @severity("high")
 @tags("category:security,threat:injection,threat:jailbreak,detection:ml")
 @reject_message("Prompt blocked: moderate injection and jailbreak signals were detected together.")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -67,13 +68,13 @@ when {
 
 @id("security.block-invisible-chars")
 @name("Block invisible-character injection")
-@description("Blocks process_prompt when invisible_chars_detected is true and invisible_chars_score >= 51.")
+@description("Blocks process_prompt and process_response when invisible_chars_detected is true and invisible_chars_score >= 51.")
 @severity("high")
 @tags("category:security,threat:invisible-chars,threat:injection,detection:pattern")
 @reject_message("Prompt blocked: invisible Unicode characters often used for injection were detected.")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {

package/_schemas/agent_ops/templates/ported/threat-detection/security_patterns.cedar

@@ -23,7 +23,7 @@
 
 @id("security.block-path-traversal")
 @name("Block path traversal")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")
 @severity("high")
 @tags("category:security,threat:path-traversal,detection:pattern,mitre:t1005")
 @reject_message("Request blocked: path traversal pattern detected — sensitive system files or deep directory traversal.")
@@ -31,6 +31,7 @@ forbid (
     principal,
     action in [
         AgentOps::Action::"process_prompt",
+        AgentOps::Action::"process_response",
         AgentOps::Action::"call_tool",
         AgentOps::Action::"read_file",
         AgentOps::Action::"write_file"
@@ -45,13 +46,14 @@ when {
 
 @id("security.block-sql-injection")
 @name("Block SQL injection")
-@description("Blocks process_prompt and call_tool when sql_injection_detected is true and sql_injection_score >= 75.")
+@description("Blocks process_prompt, process_response, and call_tool when sql_injection_detected is true and sql_injection_score >= 75.")
 @severity("high")
 @tags("category:security,threat:sql-injection,detection:pattern")
 @reject_message("Request blocked: SQL injection pattern detected — tautology, UNION attack, or destructive query.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {

package/_schemas/agent_ops/templates/ported/threat-detection/semantic_defaults.cedar

@@ -51,13 +51,13 @@ when {
 
 @id("semantic.block-sql-injection-prompt")
 @name("Block SQL injection in prompts")
-@description("Blocks process_prompt when detected_threats contains \"sql_injection\".")
+@description("Blocks process_prompt and process_response when detected_threats contains \"sql_injection\".")
 @severity("high")
-@tags("category:semantic,threat:sql-injection,detection:pattern,surface:process-prompt")
+@tags("category:semantic,threat:sql-injection,detection:pattern,surface:process-prompt,surface:process-response")
 @reject_message("Prompt blocked: SQL injection pattern detected.")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -100,13 +100,14 @@ when {
 
 @id("semantic.block-injection-ml")
 @name("Block injection (ML)")
-@description("Blocks process_prompt and call_tool when injection_score >= 75.")
+@description("Blocks process_prompt, process_response, and call_tool when injection_score >= 75.")
 @severity("critical")
 @tags("category:semantic,threat:injection,detection:ml,owasp:llm01,mitre:atlas-t0051")
 @reject_message("Request blocked: prompt injection detected by ML classifier with high confidence.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -115,13 +116,14 @@ when {
 
 @id("semantic.block-jailbreak-ml")
 @name("Block jailbreak (ML)")
-@description("Blocks process_prompt and call_tool when jailbreak_score >= 75.")
+@description("Blocks process_prompt, process_response, and call_tool when jailbreak_score >= 75.")
 @severity("critical")
 @tags("category:semantic,threat:jailbreak,detection:ml,owasp:llm02,mitre:atlas-t0054")
 @reject_message("Request blocked: jailbreak attempt detected by ML classifier with high confidence.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {