@highflame/policy 2.2.36 → 2.2.38

package/dist/agent_ops-defaults.gen.js

@@ -519,7 +519,7 @@ const AGENT_OPS_DATA_PROTECTION_DEFAULTS_CEDAR = `// ===========================
 
 @id("data-protection.block-secrets")
 @name("Block secrets")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secrets_detected is true.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secrets_detected is true.")
 @severity("critical")
 @tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
 @reject_message("Request blocked: secrets or credentials were detected in the content.")
@@ -527,6 +527,7 @@ forbid (
     principal,
     action in [
         AgentOps::Action::"process_prompt",
+        AgentOps::Action::"process_response",
         AgentOps::Action::"call_tool",
         AgentOps::Action::"read_file",
         AgentOps::Action::"write_file"
@@ -539,7 +540,7 @@ when {
 
 @id("data-protection.block-secrets-bulk")
 @name("Block secrets (bulk)")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secret_count >= 3.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secret_count >= 3.")
 @severity("critical")
 @tags("category:data-protection,threat:secrets,threat:exfiltration,detection:aggregate,owasp:llm06")
 @reject_message("Request blocked: multiple distinct secrets were detected — possible credential dump.")
@@ -547,6 +548,7 @@ forbid (
     principal,
     action in [
         AgentOps::Action::"process_prompt",
+        AgentOps::Action::"process_response",
         AgentOps::Action::"call_tool",
         AgentOps::Action::"read_file",
         AgentOps::Action::"write_file"
@@ -580,13 +582,14 @@ const AGENT_OPS_SECURITY_INJECTION_CEDAR = `// =================================
 
 @id("security.block-injection-ml")
 @name("Block injection (ML)")
-@description("Blocks process_prompt and call_tool when injection_score >= 86.")
+@description("Blocks process_prompt, process_response, and call_tool when injection_score >= 86.")
 @severity("high")
 @tags("category:security,threat:injection,detection:ml,owasp:llm01,mitre:atlas-t0051")
 @reject_message("Prompt blocked: the ML classifier detected prompt injection with high confidence.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -595,13 +598,13 @@ when {
 
 @id("security.block-jailbreak-ml")
 @name("Block jailbreak (ML)")
-@description("Blocks process_prompt when jailbreak_score >= 81.")
+@description("Blocks process_prompt and process_response when jailbreak_score >= 81.")
 @severity("high")
 @tags("category:security,threat:jailbreak,detection:ml,owasp:llm02,mitre:atlas-t0054")
 @reject_message("Prompt blocked: the ML classifier detected a jailbreak attempt with high confidence.")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -610,13 +613,13 @@ when {
 
 @id("security.block-injection-combined")
 @name("Block injection + jailbreak (combined)")
-@description("Blocks process_prompt when injection_score >= 61 and jailbreak_score >= 61.")
+@description("Blocks process_prompt and process_response when injection_score >= 61 and jailbreak_score >= 61.")
 @severity("high")
 @tags("category:security,threat:injection,threat:jailbreak,detection:ml")
 @reject_message("Prompt blocked: moderate injection and jailbreak signals were detected together.")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -626,13 +629,13 @@ when {
 
 @id("security.block-invisible-chars")
 @name("Block invisible-character injection")
-@description("Blocks process_prompt when invisible_chars_detected is true and invisible_chars_score >= 51.")
+@description("Blocks process_prompt and process_response when invisible_chars_detected is true and invisible_chars_score >= 51.")
 @severity("high")
 @tags("category:security,threat:invisible-chars,threat:injection,detection:pattern")
 @reject_message("Prompt blocked: invisible Unicode characters often used for injection were detected.")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -664,7 +667,8 @@ const AGENT_OPS_PRIVACY_DEFAULTS_CEDAR = `// ===================================
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -685,7 +689,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -700,7 +705,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -721,7 +727,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -744,7 +751,8 @@ when {
 @reject_message("Content blocked: tax identifier (ITIN or EIN) patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -764,7 +772,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -794,7 +803,8 @@ when {
 @reject_message("Content blocked: cryptocurrency wallet address patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -829,7 +839,8 @@ const AGENT_OPS_PRIVACY_PII_MODEL_CEDAR = `// ==================================
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -844,7 +855,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -859,7 +871,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -874,7 +887,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -889,7 +903,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -921,13 +936,13 @@ const AGENT_OPS_TRUST_SAFETY_TOXICITY_CEDAR = `// ==============================
 
 @id("trust-safety.block-toxicity-critical")
 @name("Block critical toxicity")
-@description("Blocks process_prompt when any toxicity score is >= 91.")
+@description("Blocks process_prompt and process_response when any toxicity score is >= 91.")
 @severity("critical")
 @tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act,compliance:iso-42001")
 @reject_message("Prompt blocked: critical-severity toxic content detected.")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -941,13 +956,13 @@ when {
 
 @id("trust-safety.block-toxicity-combined")
 @name("Block combined toxicity")
-@description("Blocks process_prompt when any two toxicity scores are >= 61.")
+@description("Blocks process_prompt and process_response when any two toxicity scores are >= 61.")
 @severity("high")
 @tags("category:trust-safety,threat:harmful,detection:aggregate")
 @reject_message("Prompt blocked: multiple moderate toxicity signals were detected together.")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -1285,7 +1300,7 @@ const AGENT_OPS_SECURITY_PATTERNS_CEDAR = `// ==================================
 
 @id("security.block-path-traversal")
 @name("Block path traversal")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")
 @severity("high")
 @tags("category:security,threat:path-traversal,detection:pattern,mitre:t1005")
 @reject_message("Request blocked: path traversal pattern detected — sensitive system files or deep directory traversal.")
@@ -1293,6 +1308,7 @@ forbid (
     principal,
     action in [
         AgentOps::Action::"process_prompt",
+        AgentOps::Action::"process_response",
         AgentOps::Action::"call_tool",
         AgentOps::Action::"read_file",
         AgentOps::Action::"write_file"
@@ -1307,13 +1323,14 @@ when {
 
 @id("security.block-sql-injection")
 @name("Block SQL injection")
-@description("Blocks process_prompt and call_tool when sql_injection_detected is true and sql_injection_score >= 75.")
+@description("Blocks process_prompt, process_response, and call_tool when sql_injection_detected is true and sql_injection_score >= 75.")
 @severity("high")
 @tags("category:security,threat:sql-injection,detection:pattern")
 @reject_message("Request blocked: SQL injection pattern detected — tautology, UNION attack, or destructive query.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -1341,13 +1358,13 @@ const AGENT_OPS_TRUST_SAFETY_SEMANTIC_CEDAR = `// ==============================
 
 @id("trust-safety.block-dangerous-topics")
 @name("Block dangerous topics")
-@description("Blocks process_prompt when content_topics contains weapons or explosives categories.")
+@description("Blocks process_prompt and process_response when content_topics contains weapons or explosives categories.")
 @severity("critical")
 @tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: content classified under a dangerous topic (weapons, explosives, illegal synthesis).")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -1361,13 +1378,13 @@ when {
 
 @id("trust-safety.block-controlled-substances")
 @name("Block controlled substances")
-@description("Blocks process_prompt when content_topics contains controlled substances or precursor chemicals.")
+@description("Blocks process_prompt and process_response when content_topics contains controlled substances or precursor chemicals.")
 @severity("high")
 @tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: content discusses controlled substances or precursor chemicals.")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -1381,13 +1398,13 @@ when {
 
 @id("trust-safety.block-restricted-topics")
 @name("Block high-confidence restricted topics")
-@description("Blocks process_prompt when topic_confidence >= 81 and content_topics contains a restricted category.")
+@description("Blocks process_prompt and process_response when topic_confidence >= 81 and content_topics contains a restricted category.")
 @severity("high")
 @tags("category:trust-safety,threat:harmful,detection:ml")
 @reject_message("Prompt blocked: content high-confidence classified into a restricted topic (illegal activity, fraud, social engineering).")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -1489,13 +1506,13 @@ when {
 
 @id("agent-identity.block-autonomous-injection")
 @name("Block injection on autonomous agents")
-@description("Blocks process_prompt when agent_type is \\"autonomous\\" and injection_score >= 51.")
+@description("Blocks process_prompt and process_response when agent_type is \\"autonomous\\" and injection_score >= 51.")
 @severity("high")
-@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,owasp:llm01")
+@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,surface:process-response,owasp:llm01")
 @reject_message("Prompt blocked: lower injection threshold applies to autonomous agents and was exceeded.")
 forbid (
     principal is AgentOps::Agent,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -1689,13 +1706,14 @@ const AGENT_OPS_SECURITY_CHAT_ASSISTANT_CEDAR = `// ============================
 
 @id("security.chat-block-injection")
 @name("Block injection (chat profile)")
-@description("Blocks process_prompt and call_tool when injection_score >= 71 (lower threshold for public chat).")
+@description("Blocks process_prompt, process_response, and call_tool when injection_score >= 71 (lower threshold for public chat).")
 @severity("high")
 @tags("category:security,threat:injection,detection:ml,owasp:llm01")
 @reject_message("Prompt blocked: prompt injection detected with high confidence (chat profile).")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -1704,13 +1722,13 @@ when {
 
 @id("security.chat-block-jailbreak")
 @name("Block jailbreak (chat profile)")
-@description("Blocks process_prompt when jailbreak_score >= 66 (lower threshold for public chat).")
+@description("Blocks process_prompt and process_response when jailbreak_score >= 66 (lower threshold for public chat).")
 @severity("high")
 @tags("category:security,threat:jailbreak,detection:ml,owasp:llm02")
 @reject_message("Prompt blocked: jailbreak attempt detected with high confidence (chat profile).")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -1738,13 +1756,13 @@ const AGENT_OPS_TRUST_SAFETY_CHAT_ASSISTANT_CEDAR = `// ========================
 
 @id("trust-safety.chat-block-toxicity")
 @name("Block toxicity (chat profile)")
-@description("Blocks process_prompt when any toxicity score is >= 71 (lower threshold for public chat).")
+@description("Blocks process_prompt and process_response when any toxicity score is >= 71 (lower threshold for public chat).")
 @severity("critical")
 @tags("category:trust-safety,threat:harmful,threat:hate-speech,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: toxic content detected at the chat-profile threshold.")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -1756,13 +1774,14 @@ when {
 
 @id("trust-safety.chat-block-restricted-topics")
 @name("Block restricted topics (chat profile)")
-@description("Blocks process_prompt and call_tool when topic_confidence >= 71 and content_topics contains a restricted category.")
+@description("Blocks process_prompt, process_response, and call_tool when topic_confidence >= 71 and content_topics contains a restricted category.")
 @severity("high")
 @tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: content discusses a topic restricted for chat assistants.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -2272,7 +2291,7 @@ const AGENT_OPS_DATA_PROTECTION_DATA_PIPELINE_CEDAR = `// ======================
 
 @id("data-protection.data-pipeline-block-secrets")
 @name("Block secrets in data pipeline")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secrets_detected is true.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secrets_detected is true.")
 @severity("critical")
 @tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
 @reject_message("Request blocked: secrets detected in a data pipeline — any credential exposure is unacceptable here.")
@@ -2280,6 +2299,7 @@ forbid (
     principal,
     action in [
         AgentOps::Action::"process_prompt",
+        AgentOps::Action::"process_response",
         AgentOps::Action::"call_tool",
         AgentOps::Action::"read_file",
         AgentOps::Action::"write_file"
@@ -2325,13 +2345,14 @@ const AGENT_OPS_SECURITY_DATA_PIPELINE_BLOCK_INJECTION_CEDAR = `// =============
 
 @id("security.data-pipeline-block-injection")
 @name("Block pipeline injection (data-pipeline profile)")
-@description("Blocks process_prompt and call_tool when injection_score >= 66 (lower threshold for data pipelines).")
+@description("Blocks process_prompt, process_response, and call_tool when injection_score >= 66 (lower threshold for data pipelines).")
 @severity("high")
 @tags("category:security,threat:injection,detection:ml,owasp:llm01")
 @reject_message("Request blocked: prompt injection detected at the data-pipeline threshold — RAG inputs are high-risk for indirect injection.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -2479,13 +2500,13 @@ when {
 
 @id("agent-identity.multi-agent-autonomous-injection")
 @name("Block injection on autonomous agents (stricter)")
-@description("Blocks process_prompt when agent_type is \\"autonomous\\" and injection_score >= 51.")
+@description("Blocks process_prompt and process_response when agent_type is \\"autonomous\\" and injection_score >= 51.")
 @severity("high")
-@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,owasp:llm01")
+@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,surface:process-response,owasp:llm01")
 @reject_message("Prompt blocked: lower injection threshold applies to autonomous agents and was exceeded.")
 forbid (
     principal is AgentOps::Agent,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -2495,13 +2516,13 @@ when {
 
 @id("agent-identity.multi-agent-autonomous-jailbreak")
 @name("Block jailbreak on autonomous agents (stricter)")
-@description("Blocks process_prompt when agent_type is \\"autonomous\\" and jailbreak_score >= 51.")
+@description("Blocks process_prompt and process_response when agent_type is \\"autonomous\\" and jailbreak_score >= 51.")
 @severity("high")
-@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,owasp:llm02")
+@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,surface:process-response,owasp:llm02")
 @reject_message("Prompt blocked: lower jailbreak threshold applies to autonomous agents and was exceeded.")
 forbid (
     principal is AgentOps::Agent,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -2705,13 +2726,14 @@ const AGENT_OPS_AGENT_IDENTITY_A2A_CROSS_ORIGIN_CEDAR = `// ====================
 
 @id("agent-identity.a2a-block-cross-origin-critical")
 @name("Block critical cross-origin from any agent")
-@description("Blocks process_prompt and call_tool when cross_origin_detected is true and cross_origin_score >= 80.")
+@description("Blocks process_prompt, process_response, and call_tool when cross_origin_detected is true and cross_origin_score >= 80.")
 @severity("critical")
 @tags("category:agent-identity,threat:supply-chain,detection:ml,owasp:llm08")
 @reject_message("Request blocked: high-confidence cross-origin trust-boundary violation detected — confused-deputy attack.")
 forbid (
     principal is AgentOps::Agent,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -2722,13 +2744,14 @@ when {
 
 @id("agent-identity.a2a-block-cross-origin-unverified")
 @name("Block cross-origin from unverified agents")
-@description("Blocks process_prompt and call_tool when agent_trust_level is \\"unverified\\", cross_origin_detected is true, and cross_origin_score >= 60.")
+@description("Blocks process_prompt, process_response, and call_tool when agent_trust_level is \\"unverified\\", cross_origin_detected is true, and cross_origin_score >= 60.")
 @severity("high")
 @tags("category:agent-identity,threat:supply-chain,scope:per-agent,detection:ml,owasp:asi03")
 @reject_message("Request blocked: unverified agent attempted cross-origin activity — no trust attestation across trust domains.")
 forbid (
     principal is AgentOps::Agent,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -2840,13 +2863,13 @@ when {
 
 @id("agent-identity.a2a-block-deep-context-injection")
 @name("Block multi-turn progressive injection")
-@description("Blocks process_prompt when agent_trust_level is not \\"first_party\\", multi_turn_detection is true, and injection_deep_context_score >= 60.")
+@description("Blocks process_prompt and process_response when agent_trust_level is not \\"first_party\\", multi_turn_detection is true, and injection_deep_context_score >= 60.")
 @severity("high")
-@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,owasp:llm01")
+@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,surface:process-response,owasp:llm01")
 @reject_message("Prompt blocked: multi-turn progressive injection detected by the deep-context model across conversation history.")
 forbid (
     principal is AgentOps::Agent,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -2857,13 +2880,13 @@ when {
 
 @id("agent-identity.a2a-block-deep-context-jailbreak")
 @name("Block multi-turn progressive jailbreak")
-@description("Blocks process_prompt when agent_trust_level is not \\"first_party\\", multi_turn_detection is true, and jailbreak_deep_context_score >= 60.")
+@description("Blocks process_prompt and process_response when agent_trust_level is not \\"first_party\\", multi_turn_detection is true, and jailbreak_deep_context_score >= 60.")
 @severity("high")
-@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,owasp:llm02")
+@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,surface:process-response,owasp:llm02")
 @reject_message("Prompt blocked: multi-turn progressive jailbreak detected by the deep-context model across conversation history.")
 forbid (
     principal is AgentOps::Agent,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -2878,13 +2901,14 @@ when {
 
 @id("agent-identity.a2a-block-encoded-injection")
 @name("Block encoded payload delivery between agents")
-@description("Blocks process_prompt and call_tool when agent_id is non-empty, encoded_content_detected is true, and encoded_score >= 60.")
+@description("Blocks process_prompt, process_response, and call_tool when agent_id is non-empty, encoded_content_detected is true, and encoded_score >= 60.")
 @severity("high")
 @tags("category:agent-identity,threat:encoded-payload,detection:pattern,owasp:llm01")
 @reject_message("Request blocked: encoded payload detected in agent communication — agents should exchange plaintext, not encoded content.")
 forbid (
     principal is AgentOps::Agent,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -3126,13 +3150,14 @@ const AGENT_OPS_AGENT_IDENTITY_A2A_ESCALATION_CEDAR = `// ======================
 
 @id("agent-identity.a2a-block-session-injection-peak")
 @name("Block agents at high session injection peak")
-@description("Blocks call_tool and process_prompt when agent_trust_level is not \\"first_party\\" and session_max_injection_score >= 70.")
+@description("Blocks call_tool and process_prompt and process_response when agent_trust_level is not \\"first_party\\" and session_max_injection_score >= 70.")
 @severity("critical")
 @tags("category:agent-identity,threat:injection,scope:per-agent,detection:aggregate,owasp:llm01")
 @reject_message("Request blocked: this session previously crossed the injection peak threshold; non-first-party agents are restricted.")
 forbid (
     principal is AgentOps::Agent,
-    action in [AgentOps::Action::"call_tool", AgentOps::Action::"process_prompt"],
+    action in [AgentOps::Action::"call_tool", AgentOps::Action::"process_prompt",
+ AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -3142,13 +3167,13 @@ when {
 
 @id("agent-identity.a2a-block-session-jailbreak-peak")
 @name("Block agents at high session jailbreak peak")
-@description("Blocks process_prompt when agent_trust_level is not \\"first_party\\" and session_max_jailbreak_score >= 70.")
+@description("Blocks process_prompt and process_response when agent_trust_level is not \\"first_party\\" and session_max_jailbreak_score >= 70.")
 @severity("critical")
 @tags("category:agent-identity,threat:jailbreak,scope:per-agent,detection:aggregate,owasp:llm02")
 @reject_message("Request blocked: this session previously crossed the jailbreak peak threshold; non-first-party agents are restricted.")
 forbid (
     principal is AgentOps::Agent,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -3217,7 +3242,7 @@ const AGENT_OPS_DATA_PROTECTION_ADVANCED_SECRETS_CEDAR = `// ===================
 
 @id("data-protection.advanced-block-high-risk-secrets")
 @name("Block high-risk credential types")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secret_types contains a cloud, GitHub, SSH, or database credential.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secret_types contains a cloud, GitHub, SSH, or database credential.")
 @severity("critical")
 @tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
 @reject_message("Content blocked: high-risk credentials detected (cloud keys, GitHub tokens, SSH keys, or database URLs).")
@@ -3225,6 +3250,7 @@ forbid (
     principal,
     action in [
         AgentOps::Action::"process_prompt",
+        AgentOps::Action::"process_response",
         AgentOps::Action::"call_tool",
         AgentOps::Action::"read_file",
         AgentOps::Action::"write_file"
@@ -3247,7 +3273,7 @@ when {
 
 @id("data-protection.advanced-block-api-tokens")
 @name("Block API keys and bearer tokens")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secret_types contains api_key, bearer_token, jwt_token, or OAuth credentials.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secret_types contains api_key, bearer_token, jwt_token, or OAuth credentials.")
 @severity("high")
 @tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
 @reject_message("Content blocked: API keys, bearer tokens, or OAuth credentials detected.")
@@ -3255,6 +3281,7 @@ forbid (
     principal,
     action in [
         AgentOps::Action::"process_prompt",
+        AgentOps::Action::"process_response",
         AgentOps::Action::"call_tool",
         AgentOps::Action::"read_file",
         AgentOps::Action::"write_file"
@@ -3296,7 +3323,8 @@ const AGENT_OPS_PRIVACY_ADVANCED_PII_CEDAR = `// ===============================
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3318,7 +3346,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3337,7 +3366,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3359,7 +3389,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3383,7 +3414,8 @@ when {
 @reject_message("Content blocked: tax identifier (ITIN or EIN) patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3403,7 +3435,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3434,7 +3467,8 @@ when {
 @reject_message("Content blocked: cryptocurrency wallet address patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3453,7 +3487,8 @@ when {
 @reject_message("Content blocked: personal name patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3472,7 +3507,8 @@ when {
 @reject_message("Content blocked: email address patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3491,7 +3527,8 @@ when {
 @reject_message("Content blocked: phone number patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3510,7 +3547,8 @@ when {
 @reject_message("Content blocked: date or time patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3532,7 +3570,8 @@ when {
 @reject_message("Content blocked: URL patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3551,7 +3590,8 @@ when {
 @reject_message("Content blocked: street address or location patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3572,7 +3612,8 @@ when {
 @reject_message("Content blocked: organization name patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3591,7 +3632,8 @@ when {
 @reject_message("Content blocked: occupation patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3610,7 +3652,8 @@ when {
 @reject_message("Content blocked: username patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3629,7 +3672,8 @@ when {
 @reject_message("Content blocked: employee or customer identifier patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3650,7 +3694,8 @@ when {
 @reject_message("Content blocked: device or network identifier patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3677,7 +3722,8 @@ when {
 @reject_message("Content blocked: vehicle identifier (VIN or plate) patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3697,7 +3743,8 @@ when {
 @reject_message("Content blocked: salary or financial amount patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3718,7 +3765,8 @@ when {
 @reject_message("Content blocked: sensitive attribute (ethnicity, religion, etc.) patterns detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool", AgentOps::Action::"read_file", AgentOps::Action::"write_file"],
     resource
 )
 when {
@@ -3756,13 +3804,13 @@ const AGENT_OPS_SECURITY_ADVANCED_BLOCK_CRITICAL_SEVERITY_CEDAR = `// ==========
 
 @id("security.advanced-block-critical-severity")
 @name("Block critical-severity threats")
-@description("Blocks process_prompt when highest_severity equals \\"critical\\".")
+@description("Blocks process_prompt and process_response when highest_severity equals \\"critical\\".")
 @severity("critical")
-@tags("category:security,detection:aggregate,surface:process-prompt,posture:catch-all,compliance:nist-si-3")
+@tags("category:security,detection:aggregate,surface:process-prompt,surface:process-response,posture:catch-all,compliance:nist-si-3")
 @reject_message("Prompt blocked: a critical-severity threat was reported by at least one detector.")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -3942,13 +3990,13 @@ when {
 
 @id("semantic.block-sql-injection-prompt")
 @name("Block SQL injection in prompts")
-@description("Blocks process_prompt when detected_threats contains \\"sql_injection\\".")
+@description("Blocks process_prompt and process_response when detected_threats contains \\"sql_injection\\".")
 @severity("high")
-@tags("category:semantic,threat:sql-injection,detection:pattern,surface:process-prompt")
+@tags("category:semantic,threat:sql-injection,detection:pattern,surface:process-prompt,surface:process-response")
 @reject_message("Prompt blocked: SQL injection pattern detected.")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -3991,13 +4039,14 @@ when {
 
 @id("semantic.block-injection-ml")
 @name("Block injection (ML)")
-@description("Blocks process_prompt and call_tool when injection_score >= 75.")
+@description("Blocks process_prompt, process_response, and call_tool when injection_score >= 75.")
 @severity("critical")
 @tags("category:semantic,threat:injection,detection:ml,owasp:llm01,mitre:atlas-t0051")
 @reject_message("Request blocked: prompt injection detected by ML classifier with high confidence.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -4006,13 +4055,14 @@ when {
 
 @id("semantic.block-jailbreak-ml")
 @name("Block jailbreak (ML)")
-@description("Blocks process_prompt and call_tool when jailbreak_score >= 75.")
+@description("Blocks process_prompt, process_response, and call_tool when jailbreak_score >= 75.")
 @severity("critical")
 @tags("category:semantic,threat:jailbreak,detection:ml,owasp:llm02,mitre:atlas-t0054")
 @reject_message("Request blocked: jailbreak attempt detected by ML classifier with high confidence.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -4043,13 +4093,14 @@ const AGENT_OPS_TRUST_SAFETY_DEFAULTS_CEDAR = `// ==============================
 
 @id("trust-safety.block-violence")
 @name("Block violent content")
-@description("Blocks process_prompt and call_tool when violence_score >= 80.")
+@description("Blocks process_prompt, process_response, and call_tool when violence_score >= 80.")
 @severity("critical")
 @tags("category:trust-safety,threat:violence,detection:ml,compliance:nist-si-4,compliance:iso-42001")
 @reject_message("Content blocked: violent content detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -4058,13 +4109,14 @@ when {
 
 @id("trust-safety.block-weapons")
 @name("Block weapons content")
-@description("Blocks process_prompt and call_tool when weapons_score >= 80.")
+@description("Blocks process_prompt, process_response, and call_tool when weapons_score >= 80.")
 @severity("critical")
 @tags("category:trust-safety,threat:weapons,detection:ml,compliance:nist-si-4")
 @reject_message("Content blocked: weapons-related content detected (manufacturing, procurement, or specifications).")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -4073,13 +4125,14 @@ when {
 
 @id("trust-safety.block-hate-speech")
 @name("Block hate speech")
-@description("Blocks process_prompt and call_tool when hate_speech_score >= 75.")
+@description("Blocks process_prompt, process_response, and call_tool when hate_speech_score >= 75.")
 @severity("critical")
 @tags("category:trust-safety,threat:hate-speech,detection:ml,compliance:nist-si-4,compliance:eu-ai-act")
 @reject_message("Content blocked: hate speech or discriminatory content detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -4088,13 +4141,14 @@ when {
 
 @id("trust-safety.block-crime")
 @name("Block criminal content")
-@description("Blocks process_prompt and call_tool when crime_score >= 80.")
+@description("Blocks process_prompt, process_response, and call_tool when crime_score >= 80.")
 @severity("high")
 @tags("category:trust-safety,threat:crime,detection:ml,compliance:nist-si-4")
 @reject_message("Content blocked: criminal activity content detected (illegal activity, fraud, or related).")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -4103,13 +4157,14 @@ when {
 
 @id("trust-safety.block-sexual")
 @name("Block sexual content")
-@description("Blocks process_prompt and call_tool when sexual_score >= 80.")
+@description("Blocks process_prompt, process_response, and call_tool when sexual_score >= 80.")
 @severity("high")
 @tags("category:trust-safety,threat:sexual,detection:ml,compliance:eu-ai-act,compliance:iso-42001")
 @reject_message("Content blocked: sexually explicit content detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -4118,13 +4173,14 @@ when {
 
 @id("trust-safety.block-profanity")
 @name("Block excessive profanity")
-@description("Blocks process_prompt and call_tool when profanity_score >= 90.")
+@description("Blocks process_prompt, process_response, and call_tool when profanity_score >= 90.")
 @severity("medium")
 @tags("category:trust-safety,threat:profanity,detection:ml")
 @reject_message("Content blocked: excessive profanity detected — please rephrase in professional language.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -4445,12 +4501,13 @@ permit (
 
 @id("organization.allow-support-project-read")
 @name("Permit support project read-only access")
-@description("Permits process_prompt and read_file actions on resources scoped to Project::\\"support-project\\".")
+@description("Permits process_prompt, process_response, and read_file actions on resources scoped to Project::\\"support-project\\".")
 @severity("medium")
 @tags("category:organization,scope:per-tool,posture:deny-default")
 permit (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"read_file"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"read_file"],
     resource in AgentOps::Project::"support-project"
 );
 `;
@@ -4474,11 +4531,11 @@ const AGENT_OPS_AGENT_IDENTITY_CLAUDE_BLOCK_INJECTION_CEDAR = `// ==============
 @name("Block injection on Claude agent")
 @description("Blocks process_prompt for the Claude agent when detected_threats contains \\"prompt_injection\\".")
 @severity("critical")
-@tags("category:agent-identity,threat:injection,scope:per-agent,detection:rule,surface:process-prompt,owasp:llm01")
+@tags("category:agent-identity,threat:injection,scope:per-agent,detection:rule,surface:process-prompt,surface:process-response,owasp:llm01")
 @reject_message("Prompt blocked: prompt injection detected for the Claude agent.")
 forbid (
     principal == AgentOps::Agent::"claude",
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {