@highflame/policy 2.2.36 → 2.2.37

package/_schemas/ai_gateway/context.json

@@ -1057,6 +1057,284 @@
         }
       ]
     },
+    {
+      "name": "process_response",
+      "description": "Process a model response (LLM chat completion output) — threat focus: data leakage in output, harmful content, hallucination, indirect injection carried back to the caller. Distinct trigger from process_prompt (ADR 0031) so a policy can be scoped to one direction from its head and prompt-only detectors stay off the egress path.",
+      "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
+        {
+          "key": "content",
+          "type": "string",
+          "required": true,
+          "description": "Raw content being scanned"
+        },
+        {
+          "key": "mcp_server",
+          "type": "string",
+          "required": false,
+          "description": "MCP server name"
+        },
+        {
+          "key": "threat_count",
+          "type": "number",
+          "required": false,
+          "description": "Total threats detected"
+        },
+        {
+          "key": "highest_severity",
+          "type": "string",
+          "required": false,
+          "description": "Highest threat severity"
+        },
+        {
+          "key": "threat_categories",
+          "type": "array",
+          "required": false,
+          "description": "Threat category names"
+        },
+        {
+          "key": "detected_threats",
+          "type": "array",
+          "required": false,
+          "description": "Detection rule names that matched"
+        },
+        {
+          "key": "max_threat_severity",
+          "type": "number",
+          "required": false,
+          "description": "Numeric severity (0-4)"
+        },
+        {
+          "key": "secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether secrets/credentials detected"
+        },
+        {
+          "key": "secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Types of secrets found"
+        },
+        {
+          "key": "secret_count",
+          "type": "number",
+          "required": false,
+          "description": "Number of distinct secrets"
+        },
+        {
+          "key": "pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether PII detected"
+        },
+        {
+          "key": "pii_types",
+          "type": "array",
+          "required": false,
+          "description": "Types of PII detected"
+        },
+        {
+          "key": "pii_count",
+          "type": "number",
+          "required": false,
+          "description": "Number of PII matches"
+        },
+        {
+          "key": "pii_score",
+          "type": "number",
+          "required": false,
+          "description": "PII classifier confidence (0-100)"
+        },
+        {
+          "key": "injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Injection classifier confidence (0-100)"
+        },
+        {
+          "key": "jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Jailbreak classifier confidence (0-100)"
+        },
+        {
+          "key": "violence_score",
+          "type": "number",
+          "required": false,
+          "description": "Violence content score (0-100)"
+        },
+        {
+          "key": "weapons_score",
+          "type": "number",
+          "required": false,
+          "description": "Weapons content score (0-100)"
+        },
+        {
+          "key": "hate_speech_score",
+          "type": "number",
+          "required": false,
+          "description": "Hate speech score (0-100)"
+        },
+        {
+          "key": "crime_score",
+          "type": "number",
+          "required": false,
+          "description": "Crime content score (0-100)"
+        },
+        {
+          "key": "sexual_score",
+          "type": "number",
+          "required": false,
+          "description": "Sexual content score (0-100)"
+        },
+        {
+          "key": "profanity_score",
+          "type": "number",
+          "required": false,
+          "description": "Profanity score (0-100)"
+        },
+        {
+          "key": "invisible_chars_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Invisible Unicode chars detected"
+        },
+        {
+          "key": "invisible_chars_score",
+          "type": "number",
+          "required": false,
+          "description": "Unicode attack severity (0-100)"
+        },
+        {
+          "key": "model_name",
+          "type": "string",
+          "required": false,
+          "description": "Target model name (e.g., gpt-4, claude-3-opus)"
+        },
+        {
+          "key": "model_provider",
+          "type": "string",
+          "required": false,
+          "description": "Provider name (e.g., openai, anthropic, bedrock)"
+        },
+        {
+          "key": "session_threat_turns",
+          "type": "number",
+          "required": false,
+          "description": "Count of turns with detected threats in this session"
+        },
+        {
+          "key": "session_cumulative_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Cumulative risk score across session turns"
+        },
+        {
+          "key": "session_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Injection seen in any prior turn of this session"
+        },
+        {
+          "key": "session_command_injection",
+          "type": "boolean",
+          "required": false,
+          "description": "Command injection seen in any prior turn of this session"
+        },
+        {
+          "key": "session_pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "PII seen in any prior turn of this session"
+        },
+        {
+          "key": "session_pii_types",
+          "type": "array",
+          "required": false,
+          "description": "PII types accumulated across session"
+        },
+        {
+          "key": "session_secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Secrets seen in any prior turn of this session"
+        },
+        {
+          "key": "session_secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Secret types accumulated across session"
+        },
+        {
+          "key": "session_max_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Max injection score across session turns"
+        },
+        {
+          "key": "session_max_jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Max jailbreak score across session turns"
+        },
+        {
+          "key": "session_max_command_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Max command-injection score across session turns"
+        },
+        {
+          "key": "session_max_pii_score",
+          "type": "number",
+          "required": false,
+          "description": "Max pii score across session turns"
+        },
+        {
+          "key": "session_max_secret_score",
+          "type": "number",
+          "required": false,
+          "description": "Max secret score across session turns"
+        },
+        {
+          "key": "rpm_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
+        },
+        {
+          "key": "rpm_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the RPM limit has been exceeded. Use this to enforce rate limits via Cedar policy"
+        },
+        {
+          "key": "tpm_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
+        },
+        {
+          "key": "tpm_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the TPM limit has been exceeded. Use this to enforce token rate limits via Cedar policy"
+        }
+      ]
+    },
     {
       "name": "read_file",
       "description": "Read an MCP resource — threat focus: secrets exposure, PII exposure",

package/_schemas/ai_gateway/schema.cedarschema

@@ -60,6 +60,13 @@ entity Server in [Project];
 /// MCP prompt -- resource for process_prompt action
 entity LlmPrompt in [Project];
 
+/// Model response -- resource for process_response action.
+/// Parented to Project like every other resource: Shield injects
+/// `when { resource in <Ns>::Project::"<id>" }` into every synced rule
+/// (shield#428), so a resource outside the project hierarchy would make
+/// every policy written against it unsatisfiable.
+entity LlmResponse in [Project];
+
 /// File/resource path -- resource for read_file/write_file actions
 entity FilePath in [Project];
 
@@ -267,12 +274,13 @@ action connect_server appliesTo {
   },
 };
 
-// Process a prompt (MCP prompts/get or LLM chat completions)
-// Threat focus: injection, jailbreak, secrets, PII, content safety
-action process_prompt appliesTo {
-  principal: [User, MCP_Client],
-  resource: [LlmPrompt],
-  context: {
+// Shared content-inspection context.
+//
+// Prompts and responses are inspected by the same detector pipeline and so
+// carry the same context keys; only the TRIGGER differs (ADR 0031). Declaring
+// the shape once means a new detector key cannot land on one direction and go
+// missing on the other — the drift class shield#393 / shield#387 were about.
+type ContentInspectionContext = {
     // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
     role?: String,
     privilege_scope?: Set<String>,
@@ -351,7 +359,29 @@ action process_prompt appliesTo {
     rpm_exceeded?: Bool,
     tpm_remaining_pct?: Long,
     tpm_exceeded?: Bool,
-  },
+};
+
+// Process a prompt (MCP prompts/get or LLM chat completions)
+// Threat focus: injection, jailbreak, secrets, PII, content safety
+action process_prompt appliesTo {
+  principal: [User, MCP_Client],
+  resource: [LlmPrompt],
+  context: ContentInspectionContext,
+};
+
+// Process a model response (LLM chat completion output, streamed or buffered)
+// Threat focus: data leakage in output, harmful content, hallucination,
+// indirect injection carried back to the caller.
+//
+// Distinct from process_prompt so that (a) a policy can be scoped to one
+// direction from its head alone and (b) Shield's action-scoped detector
+// scheduling (INV-DET-001) can keep prompt-only detectors off the egress
+// path — before this action existed, a prompt-scoped dlp/model_armor/webhook
+// rule shipped response bodies downstream. See ADR 0031.
+action process_response appliesTo {
+  principal: [User, MCP_Client],
+  resource: [LlmResponse],
+  context: ContentInspectionContext,
 };
 
 // Read an MCP resource (resources/read, resources/list)

package/_schemas/ai_gateway/templates/defaults/agent_security.cedar

@@ -13,7 +13,6 @@
 //   - mcp_server_verified:       Bool
 //   - mcp_config_risk:           Bool
 //   - mcp_risk_score:            Long (0-100)
-//   - threat_count:              Long
 //
 // Compliance:
 //   - OWASP LLM01, OWASP ASI01, OWASP ASI02, OWASP ASI04
@@ -115,21 +114,11 @@ when {
 // Section 4: MCP supply chain & trust
 // ---------------------------------------------------------------------------
 
-@id("agent-security.block-unverified-threats")
-@name("Block unverified server threats")
-@description("Blocks call_tool when mcp_server_verified is false and threat_count >= 1.")
-@severity("high")
-@tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:asi04")
-@reject_message("Tool execution blocked: the MCP server is unverified and security threats were detected.")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has mcp_server_verified && context.mcp_server_verified == false &&
-    context has threat_count && context.threat_count >= 1
-};
+// The agent-security.block-unverified-threats rule (unverified server AND
+// threat_count >= 1) was removed: AIGateway does not run threat aggregation,
+// so threat_count is never in its projected context and the rule could never
+// fire (highflame-shield#429). A working "unverified server + any detection"
+// rule needs a key the product actually projects; restore only with one.
 
 @id("agent-security.block-mcp-config-risk")
 @name("Block risky MCP server configs")

package/_schemas/ai_gateway/templates/defaults/pii.cedar

@@ -22,7 +22,8 @@
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -43,7 +44,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -58,7 +60,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -79,7 +82,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -102,7 +106,8 @@ when {
 @reject_message("Content blocked: tax identifier (ITIN or EIN) patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -122,7 +127,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -152,7 +158,8 @@ when {
 @reject_message("Content blocked: cryptocurrency wallet address patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {

package/_schemas/ai_gateway/templates/defaults/pii_advanced.cedar

@@ -22,7 +22,8 @@
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -44,7 +45,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -63,7 +65,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -85,7 +88,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -109,7 +113,8 @@ when {
 @reject_message("Content blocked: tax identifier (ITIN or EIN) patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -129,7 +134,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -160,7 +166,8 @@ when {
 @reject_message("Content blocked: cryptocurrency wallet address patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -179,7 +186,8 @@ when {
 @reject_message("Content blocked: personal name patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -198,7 +206,8 @@ when {
 @reject_message("Content blocked: email address patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -217,7 +226,8 @@ when {
 @reject_message("Content blocked: phone number patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -236,7 +246,8 @@ when {
 @reject_message("Content blocked: date or time patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -258,7 +269,8 @@ when {
 @reject_message("Content blocked: URL patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -277,7 +289,8 @@ when {
 @reject_message("Content blocked: street address or location patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -298,7 +311,8 @@ when {
 @reject_message("Content blocked: organization name patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -317,7 +331,8 @@ when {
 @reject_message("Content blocked: occupation patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -336,7 +351,8 @@ when {
 @reject_message("Content blocked: username patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -355,7 +371,8 @@ when {
 @reject_message("Content blocked: employee or customer identifier patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -376,7 +393,8 @@ when {
 @reject_message("Content blocked: device or network identifier patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -403,7 +421,8 @@ when {
 @reject_message("Content blocked: vehicle identifier (VIN or plate) patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -423,7 +442,8 @@ when {
 @reject_message("Content blocked: salary or financial amount patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -444,7 +464,8 @@ when {
 @reject_message("Content blocked: sensitive attribute (ethnicity, religion, etc.) patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {