@highflame/policy 2.2.36 → 2.2.37

package/_schemas/guardrails/context.json

@@ -674,6 +674,677 @@
         }
       ]
     },
+    {
+      "name": "process_response",
+      "description": "Process a model response (LLM chat completion output) — threat focus: data leakage in output, harmful content, hallucination, indirect injection carried back to the caller. Distinct trigger from process_prompt (ADR 0031) so a policy can be scoped to one direction from its head and prompt-only detectors stay off the egress path.",
+      "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011), e.g. finance_lead. Absent when the token carries no role claim."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
+        },
+        {
+          "key": "identity_type",
+          "type": "string",
+          "required": false,
+          "description": "Principal identity class projected from the token: 'human', 'agent', or 'service'. Use to apply identity-class-specific policies"
+        },
+        {
+          "key": "principal",
+          "type": "string",
+          "required": false,
+          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id). Absent when the token carries no principal claim"
+        },
+        {
+          "key": "request_id",
+          "type": "string",
+          "required": true,
+          "description": "Unique identifier for this request, useful for audit trails and debugging"
+        },
+        {
+          "key": "timestamp",
+          "type": "number",
+          "required": true,
+          "description": "Unix timestamp in milliseconds when the request was processed"
+        },
+        {
+          "key": "direction",
+          "type": "string",
+          "required": true,
+          "description": "Content flow direction: 'input' for user prompts, 'output' for AI responses. Use this to apply different policies to inputs vs outputs (e.g., block PII only in outputs)"
+        },
+        {
+          "key": "content_type",
+          "type": "string",
+          "required": true,
+          "description": "Type of content being analyzed: 'prompt', 'response', 'tool_call', 'file', or 'clipboard'"
+        },
+        {
+          "key": "detector_count",
+          "type": "number",
+          "required": true,
+          "description": "Number of detectors that were executed for this request"
+        },
+        {
+          "key": "injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Combined prompt injection confidence (0-100). MAX of all detector scores (Pulse + DeepContext). Use injection_pulse_score / injection_deep_context_score for individual detector control",
+          "range": "0-100"
+        },
+        {
+          "key": "jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Combined jailbreak detection confidence (0-100). MAX of all detector scores (Pulse + DeepContext). Use jailbreak_pulse_score / jailbreak_deep_context_score for individual detector control",
+          "range": "0-100"
+        },
+        {
+          "key": "injection_pulse_score",
+          "type": "number",
+          "required": false,
+          "description": "Highflame single-turn classifier score for prompt injection (0-100). Raw score from Pulse detector before combination with deep-context. Use for per-detector policy control",
+          "range": "0-100"
+        },
+        {
+          "key": "injection_deep_context_score",
+          "type": "number",
+          "required": false,
+          "description": "DeepContext multi-turn analyzer score for prompt injection (0-100). Tracks injection patterns across conversation history. Generally higher confidence than single-turn",
+          "range": "0-100"
+        },
+        {
+          "key": "jailbreak_pulse_score",
+          "type": "number",
+          "required": false,
+          "description": "Highflame single-turn classifier score for jailbreak attempts (0-100). Raw score from Pulse detector before combination with deep-context",
+          "range": "0-100"
+        },
+        {
+          "key": "jailbreak_deep_context_score",
+          "type": "number",
+          "required": false,
+          "description": "DeepContext multi-turn analyzer score for jailbreak attempts (0-100). Detects jailbreak escalation patterns across conversation turns",
+          "range": "0-100"
+        },
+        {
+          "key": "injection_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of injection detected: 'prompt', 'sql', 'command', or 'none'. Use this to apply different policies per injection type"
+        },
+        {
+          "key": "secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether any API keys, tokens, passwords, or credentials were detected in the content. True indicates presence of secrets"
+        },
+        {
+          "key": "secret_count",
+          "type": "number",
+          "required": false,
+          "description": "Total number of secret matches found. Multiple matches may indicate data dumps or accidental credential exposure"
+        },
+        {
+          "key": "secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Array of secret types found (e.g., ['aws_access_key', 'github_token']). Use set operations like .contains() to check for specific types"
+        },
+        {
+          "key": "pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether personally identifiable information (PII) was found in the content. Commonly used to block PII in outputs to prevent data leakage"
+        },
+        {
+          "key": "pii_count",
+          "type": "number",
+          "required": false,
+          "description": "Total number of PII matches found (emails, phone numbers, SSNs, etc.)"
+        },
+        {
+          "key": "pii_types",
+          "type": "array",
+          "required": false,
+          "description": "Array of PII types detected (e.g., ['email', 'phone', 'ssn', 'credit_card']). Use .contains() to block specific sensitive types"
+        },
+        {
+          "key": "pii_score",
+          "type": "number",
+          "required": false,
+          "description": "PII detection ML classifier confidence (0-100). Catches novel PII patterns including names, addresses, and identifiers that regex rules may miss. Typical threshold: >=80 for high-confidence blocking",
+          "range": "0-100"
+        },
+        {
+          "key": "highest_severity",
+          "type": "string",
+          "required": false,
+          "description": "Highest severity level across all detection engines: 'critical', 'high', 'medium', 'low', or 'none'. Use for severity-based catch-all policies (e.g., block any content flagged as critical)"
+        },
+        {
+          "key": "violence_score",
+          "type": "number",
+          "required": false,
+          "description": "ML-based score for violent content references (0-100). Typical threshold: >90 for critical blocks, >60 for warnings",
+          "range": "0-100"
+        },
+        {
+          "key": "hate_speech_score",
+          "type": "number",
+          "required": false,
+          "description": "ML-based score for hate speech, discriminatory language, or targeted harassment (0-100). Typical threshold: >75 for blocks",
+          "range": "0-100"
+        },
+        {
+          "key": "sexual_score",
+          "type": "number",
+          "required": false,
+          "description": "ML-based score for sexual or adult content (0-100). Adjust thresholds based on your application's audience",
+          "range": "0-100"
+        },
+        {
+          "key": "weapons_score",
+          "type": "number",
+          "required": false,
+          "description": "ML-based score for weapons references or violent imagery (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "crime_score",
+          "type": "number",
+          "required": false,
+          "description": "ML-based score for criminal activity discussions (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "profanity_score",
+          "type": "number",
+          "required": false,
+          "description": "ML-based score for profanity and vulgar language (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "content_topics",
+          "type": "array",
+          "required": false,
+          "description": "Semantic topics detected in content (e.g., ['controlled_substances', 'weapons_manufacturing']). Use .contains() to block specific topics per application"
+        },
+        {
+          "key": "topic_confidence",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score from topic classifier (0-100). Use with content_topics to tune sensitivity — higher thresholds reduce false positives",
+          "range": "0-100"
+        },
+        {
+          "key": "invisible_chars_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether invisible Unicode characters (zero-width joiners, RTL marks, etc.) were detected in the content. Commonly used for prompt injection evasion"
+        },
+        {
+          "key": "invisible_chars_score",
+          "type": "number",
+          "required": false,
+          "description": "Density score for invisible characters in the content (0-100). Higher scores indicate more invisible characters, suggesting evasion attempts",
+          "range": "0-100"
+        },
+        {
+          "key": "command_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether command injection patterns were detected in the content (reverse shells, privilege escalation, destructive commands)"
+        },
+        {
+          "key": "command_injection_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of command injection: 'reverse_shell', 'privilege_escalation', 'code_execution', 'destructive_command', or 'data_exfiltration'"
+        },
+        {
+          "key": "command_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score for command injection detection (0-100). Higher scores indicate stronger pattern matches",
+          "range": "0-100"
+        },
+        {
+          "key": "path_traversal_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether path traversal patterns were detected (e.g., ../../../etc/passwd, URL-encoded variants)"
+        },
+        {
+          "key": "path_traversal_severity",
+          "type": "string",
+          "required": false,
+          "description": "Severity of path traversal: 'critical' (sensitive system files), 'high' (deep traversal), 'medium' (moderate traversal), 'low', or 'none'"
+        },
+        {
+          "key": "path_traversal_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of path traversal detected (e.g., 'sensitive_file', 'deep_traversal', 'encoded_traversal')"
+        },
+        {
+          "key": "sql_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether SQL injection patterns were detected (tautologies, UNION-based, destructive queries)"
+        },
+        {
+          "key": "sql_injection_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of SQL injection: 'tautology', 'union_based', 'destructive', 'blind', or 'error_based'"
+        },
+        {
+          "key": "sql_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score for SQL injection detection (0-100). Typical threshold: >=75 for blocks",
+          "range": "0-100"
+        },
+        {
+          "key": "cross_origin_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether cross-origin escalation patterns were detected (tool calls or references crossing trust boundaries)"
+        },
+        {
+          "key": "cross_origin_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of cross-origin escalation: 'cross_origin_tool', 'cross_origin_server', or 'none'"
+        },
+        {
+          "key": "cross_origin_score",
+          "type": "number",
+          "required": false,
+          "description": "Risk score for cross-origin escalation (0-100). Higher scores indicate more suspicious cross-boundary activity",
+          "range": "0-100"
+        },
+        {
+          "key": "package_install_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the event contains a recognized package install/download command (pip, npm, yarn, pnpm, bun, uv, gem, cargo, go, composer)"
+        },
+        {
+          "key": "packages_checked",
+          "type": "number",
+          "required": false,
+          "description": "Number of unique packages checked against the osv.dev database for this event"
+        },
+        {
+          "key": "malicious_package_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether any referenced package has a known-malicious OSV advisory (OpenSSF MAL- ID). Use to block supply-chain attacks at install time"
+        },
+        {
+          "key": "malicious_package_score",
+          "type": "number",
+          "required": false,
+          "description": "100 when a malicious package was detected, 0 otherwise",
+          "range": "0-100"
+        },
+        {
+          "key": "malicious_packages",
+          "type": "array",
+          "required": false,
+          "description": "Malicious packages as ecosystem/name[@version] strings (e.g. 'PyPI/evil-pkg@1.0.0')"
+        },
+        {
+          "key": "package_names",
+          "type": "array",
+          "required": false,
+          "description": "Names of all packages parsed from the install command (without ecosystem prefix), e.g. ['requests', 'left-pad']. Available even when the osv.dev lookup fails."
+        },
+        {
+          "key": "package_ecosystems",
+          "type": "array",
+          "required": false,
+          "description": "Unique package ecosystems seen in this event, e.g. ['PyPI', 'npm']. Useful for policy rules that restrict which ecosystems are permitted."
+        },
+        {
+          "key": "package_advisory_count",
+          "type": "number",
+          "required": false,
+          "description": "Total number of non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected."
+        },
+        {
+          "key": "package_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory_count for advisory-only packages; 0 when all packages are clean.",
+          "range": "0-100"
+        },
+        {
+          "key": "package_check_status",
+          "type": "string",
+          "required": false,
+          "description": "Set to 'degraded' when the osv.dev lookup failed and packages could not be verified (fail-open). Combine with package_install_detected to fail closed"
+        },
+        {
+          "key": "encoded_content_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether encoded content was detected (base64, hex, unicode, URL encoding) that may hide malicious payloads"
+        },
+        {
+          "key": "encoded_types",
+          "type": "array",
+          "required": false,
+          "description": "Array of encoding types detected (e.g., ['base64', 'hex', 'unicode', 'url']). Use .contains() to check for specific encoding types"
+        },
+        {
+          "key": "encoded_count",
+          "type": "number",
+          "required": false,
+          "description": "Number of encoded segments found in the content"
+        },
+        {
+          "key": "encoded_score",
+          "type": "number",
+          "required": false,
+          "description": "Risk score for encoded injection attempts (0-100). Considers encoding density and decoded content patterns",
+          "range": "0-100"
+        },
+        {
+          "key": "detected_language",
+          "type": "string",
+          "required": false,
+          "description": "ISO language code of the detected language (e.g., 'en', 'fr', 'zh'). Use this for language-specific policy enforcement"
+        },
+        {
+          "key": "is_english",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the content is in English. Useful for applying English-only policies or flagging non-English content"
+        },
+        {
+          "key": "language_confidence",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score for language detection (0-100). Use with detected_language to tune sensitivity",
+          "range": "0-100"
+        },
+        {
+          "key": "detected_script",
+          "type": "string",
+          "required": false,
+          "description": "Writing script detected in content: 'latin', 'cyrillic', 'arabic', 'cjk', 'unknown', etc. Use to detect script-switching attacks"
+        },
+        {
+          "key": "is_latin_script",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the content uses Latin script. Useful for detecting non-Latin script injection attempts"
+        },
+        {
+          "key": "script_confidence",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score for script detection (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "hallucination_score",
+          "type": "number",
+          "required": false,
+          "description": "ML-based score for hallucinated or fabricated content (0-100). Higher scores indicate higher likelihood of non-factual claims",
+          "range": "0-100"
+        },
+        {
+          "key": "factuality_score",
+          "type": "number",
+          "required": false,
+          "description": "ML-based factuality assessment score (0-100). Higher scores indicate more factually grounded content",
+          "range": "0-100"
+        },
+        {
+          "key": "sentiment_score",
+          "type": "number",
+          "required": false,
+          "description": "Sentiment analysis score. Use to detect overly negative or manipulative tone in prompts or responses",
+          "range": "0-100"
+        },
+        {
+          "key": "contains_code",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether code snippets were detected in the content"
+        },
+        {
+          "key": "code_languages",
+          "type": "array",
+          "required": false,
+          "description": "Array of programming languages detected in code snippets (e.g., ['python', 'javascript'])"
+        },
+        {
+          "key": "code_ratio",
+          "type": "number",
+          "required": false,
+          "description": "Percentage of content that consists of code (0-100). High values may indicate code dumps or automated content",
+          "range": "0-100"
+        },
+        {
+          "key": "keyword_matched",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether any configured keywords or phrases were matched in the content"
+        },
+        {
+          "key": "keyword_categories",
+          "type": "array",
+          "required": false,
+          "description": "Array of keyword categories matched (e.g., ['competitor_names', 'restricted_topics']). Use .contains() for category-specific policies"
+        },
+        {
+          "key": "keyword_count",
+          "type": "number",
+          "required": false,
+          "description": "Number of keyword matches found in the content"
+        },
+        {
+          "key": "contains_non_ascii",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether non-ASCII characters were detected. May indicate obfuscation or encoding-based evasion attempts"
+        },
+        {
+          "key": "phishing_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether phishing patterns were detected in the content (suspicious URLs, impersonation, credential requests)"
+        },
+        {
+          "key": "content_safety_score",
+          "type": "number",
+          "required": false,
+          "description": "Aggregate content safety score (0-100). Combines multiple safety signals into a single risk indicator",
+          "range": "0-100"
+        },
+        {
+          "key": "content_safety_blocked",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether content was flagged for blocking by the content safety system"
+        },
+        {
+          "key": "conversation_turn",
+          "type": "number",
+          "required": false,
+          "description": "Current conversation turn number. Use for policies that escalate strictness over long conversations"
+        },
+        {
+          "key": "multi_turn_detection",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether multi-turn injection patterns were detected (attack spread across multiple conversation turns)"
+        },
+        {
+          "key": "rpm_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
+        },
+        {
+          "key": "rpm_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the RPM limit has been exceeded. Use this to enforce rate limits via Cedar policy"
+        },
+        {
+          "key": "tpm_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
+        },
+        {
+          "key": "tpm_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the TPM limit has been exceeded. Use this to enforce token rate limits via Cedar policy"
+        },
+        {
+          "key": "session_pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether PII was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_pii_types",
+          "type": "array",
+          "required": false,
+          "description": "PII types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether secrets were detected in any previous turn of the session"
+        },
+        {
+          "key": "session_secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Secret types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether prompt injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_command_injection",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether command injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_threat_turns",
+          "type": "number",
+          "required": false,
+          "description": "Number of turns in the session where threats were detected"
+        },
+        {
+          "key": "session_max_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_command_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest command injection score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_pii_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest PII risk score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_secret_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest secret detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_cumulative_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
+        },
+        {
+          "key": "session_max_sensitivity",
+          "type": "string",
+          "required": false,
+          "description": "Highest data-sensitivity tier observed across the session (e.g. 'public', 'internal', 'confidential', 'restricted'). Use for session-level escalation policies"
+        },
+        {
+          "key": "session_original_request",
+          "type": "string",
+          "required": false,
+          "description": "The session's first user request, retained for drift / goal-hijack policies that compare later turns against the original intent"
+        },
+        {
+          "key": "agent_id",
+          "type": "string",
+          "required": false,
+          "description": "Unique identifier of the authenticated AI agent making this request (e.g., 'agent_research_v3'). Empty string for human user requests. Use this to write agent-specific policies"
+        },
+        {
+          "key": "agent_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of the authenticated agent: 'orchestrator' (coordinates sub-agents), 'autonomous' (self-directed), 'tool_agent' (single-purpose tool), or 'human_proxy' (acts on behalf of a human). Empty string for human users"
+        },
+        {
+          "key": "agent_trust_level",
+          "type": "string",
+          "required": false,
+          "description": "Trust level of the authenticated agent: 'first_party' (your own agents), 'verified_third_party' (audited external agents), or 'unverified' (unknown agents). Use this for tiered access control — e.g., only first_party agents can call dangerous tools"
+        },
+        {
+          "key": "agent_framework",
+          "type": "string",
+          "required": false,
+          "description": "Framework or SDK the agent is built with (e.g., 'claude-code', 'langchain', 'crewai', 'autogen'). Use this to apply framework-specific policies"
+        },
+        {
+          "key": "agent_publisher",
+          "type": "string",
+          "required": false,
+          "description": "Organization that published the agent (e.g., 'anthropic', 'internal', 'acme-corp'). Use this for organization-level trust policies"
+        }
+      ]
+    },
     {
       "name": "call_tool",
       "description": "Execute agentic tool calls, including shell commands, file operations, and MCP tools",