@highflame/policy 2.2.36 → 2.2.37

package/_schemas/guardrails/templates/profiles/advanced_detection/pii.cedar

@@ -22,7 +22,8 @@
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -44,7 +45,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -63,7 +65,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -85,7 +88,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -109,7 +113,8 @@ when {
 @reject_message("Content blocked: tax identifier (ITIN or EIN) patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -129,7 +134,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -160,7 +166,8 @@ when {
 @reject_message("Content blocked: cryptocurrency wallet address patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -179,7 +186,8 @@ when {
 @reject_message("Content blocked: personal name patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -198,7 +206,8 @@ when {
 @reject_message("Content blocked: email address patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -217,7 +226,8 @@ when {
 @reject_message("Content blocked: phone number patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -236,7 +246,8 @@ when {
 @reject_message("Content blocked: date or time patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -258,7 +269,8 @@ when {
 @reject_message("Content blocked: URL patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -277,7 +289,8 @@ when {
 @reject_message("Content blocked: street address or location patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -298,7 +311,8 @@ when {
 @reject_message("Content blocked: organization name patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -317,7 +331,8 @@ when {
 @reject_message("Content blocked: occupation patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -336,7 +351,8 @@ when {
 @reject_message("Content blocked: username patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -355,7 +371,8 @@ when {
 @reject_message("Content blocked: employee or customer identifier patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -376,7 +393,8 @@ when {
 @reject_message("Content blocked: device or network identifier patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -403,7 +421,8 @@ when {
 @reject_message("Content blocked: vehicle identifier (VIN or plate) patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -423,7 +442,8 @@ when {
 @reject_message("Content blocked: salary or financial amount patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -444,7 +464,8 @@ when {
 @reject_message("Content blocked: sensitive attribute (ethnicity, religion, etc.) patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {

package/_schemas/guardrails/templates/profiles/advanced_detection/secrets.cedar

@@ -18,7 +18,7 @@
 
 @id("data-protection.advanced-block-high-risk-secrets")
 @name("Block high-risk credential types")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secret_types contains a cloud, GitHub, SSH, or database credential.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secret_types contains a cloud, GitHub, SSH, or database credential.")
 @severity("critical")
 @tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
 @reject_message("Content blocked: high-risk credentials detected (cloud keys, GitHub tokens, SSH keys, or database URLs).")
@@ -26,6 +26,7 @@ forbid (
     principal,
     action in [
         Guardrails::Action::"process_prompt",
+        Guardrails::Action::"process_response",
         Guardrails::Action::"call_tool",
         Guardrails::Action::"read_file",
         Guardrails::Action::"write_file"
@@ -48,7 +49,7 @@ when {
 
 @id("data-protection.advanced-block-api-tokens")
 @name("Block API keys and bearer tokens")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secret_types contains api_key, bearer_token, jwt_token, or OAuth credentials.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secret_types contains api_key, bearer_token, jwt_token, or OAuth credentials.")
 @severity("high")
 @tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
 @reject_message("Content blocked: API keys, bearer tokens, or OAuth credentials detected.")
@@ -56,6 +57,7 @@ forbid (
     principal,
     action in [
         Guardrails::Action::"process_prompt",
+        Guardrails::Action::"process_response",
         Guardrails::Action::"call_tool",
         Guardrails::Action::"read_file",
         Guardrails::Action::"write_file"

package/_schemas/guardrails/templates/profiles/chat_assistant/security.cedar

@@ -18,13 +18,14 @@
 
 @id("security.chat-block-injection")
 @name("Block injection (chat profile)")
-@description("Blocks process_prompt and call_tool when injection_score >= 71 (lower threshold for public chat).")
+@description("Blocks process_prompt, process_response, and call_tool when injection_score >= 71 (lower threshold for public chat).")
 @severity("high")
 @tags("category:security,threat:injection,detection:ml,owasp:llm01")
 @reject_message("Prompt blocked: prompt injection detected with high confidence (chat profile).")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool"],
     resource
 )
 when {
@@ -33,13 +34,13 @@ when {
 
 @id("security.chat-block-jailbreak")
 @name("Block jailbreak (chat profile)")
-@description("Blocks process_prompt when jailbreak_score >= 66 (lower threshold for public chat).")
+@description("Blocks process_prompt and process_response when jailbreak_score >= 66 (lower threshold for public chat).")
 @severity("high")
 @tags("category:security,threat:jailbreak,detection:ml,owasp:llm02")
 @reject_message("Prompt blocked: jailbreak attempt detected with high confidence (chat profile).")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {

package/_schemas/guardrails/templates/profiles/chat_assistant/trust_safety.cedar

@@ -19,13 +19,13 @@
 
 @id("trust-safety.chat-block-toxicity")
 @name("Block toxicity (chat profile)")
-@description("Blocks process_prompt when any toxicity score is >= 71 (lower threshold for public chat).")
+@description("Blocks process_prompt and process_response when any toxicity score is >= 71 (lower threshold for public chat).")
 @severity("critical")
 @tags("category:trust-safety,threat:harmful,threat:hate-speech,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: toxic content detected at the chat-profile threshold.")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -37,13 +37,14 @@ when {
 
 @id("trust-safety.chat-block-restricted-topics")
 @name("Block restricted topics (chat profile)")
-@description("Blocks process_prompt and call_tool when topic_confidence >= 71 and content_topics contains a restricted category.")
+@description("Blocks process_prompt, process_response, and call_tool when topic_confidence >= 71 and content_topics contains a restricted category.")
 @severity("high")
 @tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: content discusses a topic restricted for chat assistants.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool"],
     resource
 )
 when {

package/_schemas/guardrails/templates/profiles/data_pipeline/data_protection.cedar

@@ -17,7 +17,7 @@
 
 @id("data-protection.data-pipeline-block-secrets")
 @name("Block secrets in data pipeline")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secrets_detected is true.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secrets_detected is true.")
 @severity("critical")
 @tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
 @reject_message("Request blocked: secrets detected in a data pipeline — any credential exposure is unacceptable here.")
@@ -25,6 +25,7 @@ forbid (
     principal,
     action in [
         Guardrails::Action::"process_prompt",
+        Guardrails::Action::"process_response",
         Guardrails::Action::"call_tool",
         Guardrails::Action::"read_file",
         Guardrails::Action::"write_file"

package/_schemas/guardrails/templates/profiles/data_pipeline/security.cedar

@@ -17,13 +17,14 @@
 
 @id("security.data-pipeline-block-injection")
 @name("Block pipeline injection (data-pipeline profile)")
-@description("Blocks process_prompt and call_tool when injection_score >= 66 (lower threshold for data pipelines).")
+@description("Blocks process_prompt, process_response, and call_tool when injection_score >= 66 (lower threshold for data pipelines).")
 @severity("high")
 @tags("category:security,threat:injection,detection:ml,owasp:llm01")
 @reject_message("Request blocked: prompt injection detected at the data-pipeline threshold — RAG inputs are high-risk for indirect injection.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool"],
     resource
 )
 when {

package/_schemas/guardrails/templates/profiles/multi_agent/agent_trust.cedar

@@ -93,13 +93,13 @@ when {
 
 @id("agent-identity.multi-agent-autonomous-injection")
 @name("Block injection on autonomous agents (stricter)")
-@description("Blocks process_prompt when agent_type is \"autonomous\" and injection_score >= 51.")
+@description("Blocks process_prompt and process_response when agent_type is \"autonomous\" and injection_score >= 51.")
 @severity("high")
-@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,owasp:llm01")
+@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,surface:process-response,owasp:llm01")
 @reject_message("Prompt blocked: lower injection threshold applies to autonomous agents and was exceeded.")
 forbid (
     principal is Guardrails::Agent,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -109,13 +109,13 @@ when {
 
 @id("agent-identity.multi-agent-autonomous-jailbreak")
 @name("Block jailbreak on autonomous agents (stricter)")
-@description("Blocks process_prompt when agent_type is \"autonomous\" and jailbreak_score >= 51.")
+@description("Blocks process_prompt and process_response when agent_type is \"autonomous\" and jailbreak_score >= 51.")
 @severity("high")
-@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,owasp:llm02")
+@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,surface:process-response,owasp:llm02")
 @reject_message("Prompt blocked: lower jailbreak threshold applies to autonomous agents and was exceeded.")
 forbid (
     principal is Guardrails::Agent,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {

package/_schemas/guardrails/templates/templates.json

@@ -482,15 +482,6 @@
         "compliance:hipaa"
       ]
     },
-    {
-      "id": "security.advanced-block-critical-severity",
-      "name": "Advanced Detection — Threat Severity",
-      "description": "Catch-all that blocks any content flagged as critical severity by any detector.",
-      "category": "security",
-      "file": "profiles/advanced_detection/threat_severity.cedar",
-      "severity": "critical",
-      "tags": ["category:security", "detection:aggregate", "posture:catch-all"]
-    },
     {
       "id": "agent-security.param-validation",
       "name": "Action Parameter Validation",