@highflame/policy 2.2.36 → 2.2.38

package/dist/guardrails-defaults.gen.js

@@ -49,7 +49,7 @@ const GUARDRAILS_DATA_PROTECTION_DEFAULTS_CEDAR = `// ==========================
 
 @id("data-protection.block-secrets")
 @name("Block secrets")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secrets_detected is true.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secrets_detected is true.")
 @severity("critical")
 @tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
 @reject_message("Request blocked: secrets or credentials were detected in the content.")
@@ -57,6 +57,7 @@ forbid (
     principal,
     action in [
         Guardrails::Action::"process_prompt",
+        Guardrails::Action::"process_response",
         Guardrails::Action::"call_tool",
         Guardrails::Action::"read_file",
         Guardrails::Action::"write_file"
@@ -69,7 +70,7 @@ when {
 
 @id("data-protection.block-secrets-bulk")
 @name("Block secrets (bulk)")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secret_count >= 3.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secret_count >= 3.")
 @severity("critical")
 @tags("category:data-protection,threat:secrets,threat:exfiltration,detection:aggregate,owasp:llm06")
 @reject_message("Request blocked: multiple distinct secrets were detected — possible credential dump.")
@@ -77,6 +78,7 @@ forbid (
     principal,
     action in [
         Guardrails::Action::"process_prompt",
+        Guardrails::Action::"process_response",
         Guardrails::Action::"call_tool",
         Guardrails::Action::"read_file",
         Guardrails::Action::"write_file"
@@ -110,13 +112,14 @@ const GUARDRAILS_SECURITY_INJECTION_CEDAR = `// ================================
 
 @id("security.block-injection-ml")
 @name("Block injection (ML)")
-@description("Blocks process_prompt and call_tool when injection_score >= 86.")
+@description("Blocks process_prompt, process_response, and call_tool when injection_score >= 86.")
 @severity("high")
 @tags("category:security,threat:injection,detection:ml,owasp:llm01,mitre:atlas-t0051")
 @reject_message("Prompt blocked: the ML classifier detected prompt injection with high confidence.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool"],
     resource
 )
 when {
@@ -125,13 +128,13 @@ when {
 
 @id("security.block-jailbreak-ml")
 @name("Block jailbreak (ML)")
-@description("Blocks process_prompt when jailbreak_score >= 81.")
+@description("Blocks process_prompt and process_response when jailbreak_score >= 81.")
 @severity("high")
 @tags("category:security,threat:jailbreak,detection:ml,owasp:llm02,mitre:atlas-t0054")
 @reject_message("Prompt blocked: the ML classifier detected a jailbreak attempt with high confidence.")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -140,13 +143,13 @@ when {
 
 @id("security.block-injection-combined")
 @name("Block injection + jailbreak (combined)")
-@description("Blocks process_prompt when injection_score >= 61 and jailbreak_score >= 61.")
+@description("Blocks process_prompt and process_response when injection_score >= 61 and jailbreak_score >= 61.")
 @severity("high")
 @tags("category:security,threat:injection,threat:jailbreak,detection:ml")
 @reject_message("Prompt blocked: moderate injection and jailbreak signals were detected together.")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -156,13 +159,13 @@ when {
 
 @id("security.block-invisible-chars")
 @name("Block invisible-character injection")
-@description("Blocks process_prompt when invisible_chars_detected is true and invisible_chars_score >= 51.")
+@description("Blocks process_prompt and process_response when invisible_chars_detected is true and invisible_chars_score >= 51.")
 @severity("high")
 @tags("category:security,threat:invisible-chars,threat:injection,detection:pattern")
 @reject_message("Prompt blocked: invisible Unicode characters often used for injection were detected.")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -194,7 +197,8 @@ const GUARDRAILS_PRIVACY_DEFAULTS_CEDAR = `// ==================================
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -215,7 +219,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -230,7 +235,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -251,7 +257,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -274,7 +281,8 @@ when {
 @reject_message("Content blocked: tax identifier (ITIN or EIN) patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -294,7 +302,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -324,7 +333,8 @@ when {
 @reject_message("Content blocked: cryptocurrency wallet address patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -359,7 +369,8 @@ const GUARDRAILS_PRIVACY_PII_MODEL_CEDAR = `// =================================
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -374,7 +385,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -389,7 +401,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -404,7 +417,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -419,7 +433,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -451,13 +466,13 @@ const GUARDRAILS_TRUST_SAFETY_TOXICITY_CEDAR = `// =============================
 
 @id("trust-safety.block-toxicity-critical")
 @name("Block critical toxicity")
-@description("Blocks process_prompt when any toxicity score is >= 91.")
+@description("Blocks process_prompt and process_response when any toxicity score is >= 91.")
 @severity("critical")
 @tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act,compliance:iso-42001")
 @reject_message("Prompt blocked: critical-severity toxic content detected.")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -471,13 +486,13 @@ when {
 
 @id("trust-safety.block-hate-speech")
 @name("Block hate speech")
-@description("Blocks process_prompt when hate_speech_score >= 76.")
+@description("Blocks process_prompt and process_response when hate_speech_score >= 76.")
 @severity("high")
 @tags("category:trust-safety,threat:hate-speech,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: hate speech detected.")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -486,13 +501,13 @@ when {
 
 @id("trust-safety.block-toxicity-combined")
 @name("Block combined toxicity")
-@description("Blocks process_prompt when any two toxicity scores are >= 61.")
+@description("Blocks process_prompt and process_response when any two toxicity scores are >= 61.")
 @severity("high")
 @tags("category:trust-safety,threat:harmful,detection:aggregate")
 @reject_message("Prompt blocked: multiple moderate toxicity signals were detected together.")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -830,7 +845,7 @@ const GUARDRAILS_SECURITY_PATTERNS_CEDAR = `// =================================
 
 @id("security.block-path-traversal")
 @name("Block path traversal")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")
 @severity("high")
 @tags("category:security,threat:path-traversal,detection:pattern,mitre:t1005")
 @reject_message("Request blocked: path traversal pattern detected — sensitive system files or deep directory traversal.")
@@ -838,6 +853,7 @@ forbid (
     principal,
     action in [
         Guardrails::Action::"process_prompt",
+        Guardrails::Action::"process_response",
         Guardrails::Action::"call_tool",
         Guardrails::Action::"read_file",
         Guardrails::Action::"write_file"
@@ -852,13 +868,14 @@ when {
 
 @id("security.block-sql-injection")
 @name("Block SQL injection")
-@description("Blocks process_prompt and call_tool when sql_injection_detected is true and sql_injection_score >= 75.")
+@description("Blocks process_prompt, process_response, and call_tool when sql_injection_detected is true and sql_injection_score >= 75.")
 @severity("high")
 @tags("category:security,threat:sql-injection,detection:pattern")
 @reject_message("Request blocked: SQL injection pattern detected — tautology, UNION attack, or destructive query.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool"],
     resource
 )
 when {
@@ -886,13 +903,13 @@ const GUARDRAILS_TRUST_SAFETY_SEMANTIC_CEDAR = `// =============================
 
 @id("trust-safety.block-dangerous-topics")
 @name("Block dangerous topics")
-@description("Blocks process_prompt when content_topics contains weapons or explosives categories.")
+@description("Blocks process_prompt and process_response when content_topics contains weapons or explosives categories.")
 @severity("critical")
 @tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: content classified under a dangerous topic (weapons, explosives, illegal synthesis).")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -906,13 +923,13 @@ when {
 
 @id("trust-safety.block-controlled-substances")
 @name("Block controlled substances")
-@description("Blocks process_prompt when content_topics contains controlled substances or precursor chemicals.")
+@description("Blocks process_prompt and process_response when content_topics contains controlled substances or precursor chemicals.")
 @severity("high")
 @tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: content discusses controlled substances or precursor chemicals.")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -926,13 +943,13 @@ when {
 
 @id("trust-safety.block-restricted-topics")
 @name("Block high-confidence restricted topics")
-@description("Blocks process_prompt when topic_confidence >= 81 and content_topics contains a restricted category.")
+@description("Blocks process_prompt and process_response when topic_confidence >= 81 and content_topics contains a restricted category.")
 @severity("high")
 @tags("category:trust-safety,threat:harmful,detection:ml")
 @reject_message("Prompt blocked: content high-confidence classified into a restricted topic (illegal activity, fraud, social engineering).")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -1034,13 +1051,13 @@ when {
 
 @id("agent-identity.block-autonomous-injection")
 @name("Block injection on autonomous agents")
-@description("Blocks process_prompt when agent_type is \\"autonomous\\" and injection_score >= 51.")
+@description("Blocks process_prompt and process_response when agent_type is \\"autonomous\\" and injection_score >= 51.")
 @severity("high")
-@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,owasp:llm01")
+@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,surface:process-response,owasp:llm01")
 @reject_message("Prompt blocked: lower injection threshold applies to autonomous agents and was exceeded.")
 forbid (
     principal is Guardrails::Agent,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -1234,13 +1251,14 @@ const GUARDRAILS_SECURITY_CHAT_ASSISTANT_CEDAR = `// ===========================
 
 @id("security.chat-block-injection")
 @name("Block injection (chat profile)")
-@description("Blocks process_prompt and call_tool when injection_score >= 71 (lower threshold for public chat).")
+@description("Blocks process_prompt, process_response, and call_tool when injection_score >= 71 (lower threshold for public chat).")
 @severity("high")
 @tags("category:security,threat:injection,detection:ml,owasp:llm01")
 @reject_message("Prompt blocked: prompt injection detected with high confidence (chat profile).")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool"],
     resource
 )
 when {
@@ -1249,13 +1267,13 @@ when {
 
 @id("security.chat-block-jailbreak")
 @name("Block jailbreak (chat profile)")
-@description("Blocks process_prompt when jailbreak_score >= 66 (lower threshold for public chat).")
+@description("Blocks process_prompt and process_response when jailbreak_score >= 66 (lower threshold for public chat).")
 @severity("high")
 @tags("category:security,threat:jailbreak,detection:ml,owasp:llm02")
 @reject_message("Prompt blocked: jailbreak attempt detected with high confidence (chat profile).")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -1283,13 +1301,13 @@ const GUARDRAILS_TRUST_SAFETY_CHAT_ASSISTANT_CEDAR = `// =======================
 
 @id("trust-safety.chat-block-toxicity")
 @name("Block toxicity (chat profile)")
-@description("Blocks process_prompt when any toxicity score is >= 71 (lower threshold for public chat).")
+@description("Blocks process_prompt and process_response when any toxicity score is >= 71 (lower threshold for public chat).")
 @severity("critical")
 @tags("category:trust-safety,threat:harmful,threat:hate-speech,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: toxic content detected at the chat-profile threshold.")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -1301,13 +1319,14 @@ when {
 
 @id("trust-safety.chat-block-restricted-topics")
 @name("Block restricted topics (chat profile)")
-@description("Blocks process_prompt and call_tool when topic_confidence >= 71 and content_topics contains a restricted category.")
+@description("Blocks process_prompt, process_response, and call_tool when topic_confidence >= 71 and content_topics contains a restricted category.")
 @severity("high")
 @tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: content discusses a topic restricted for chat assistants.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool"],
     resource
 )
 when {
@@ -1817,7 +1836,7 @@ const GUARDRAILS_DATA_PROTECTION_DATA_PIPELINE_CEDAR = `// =====================
 
 @id("data-protection.data-pipeline-block-secrets")
 @name("Block secrets in data pipeline")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secrets_detected is true.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secrets_detected is true.")
 @severity("critical")
 @tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
 @reject_message("Request blocked: secrets detected in a data pipeline — any credential exposure is unacceptable here.")
@@ -1825,6 +1844,7 @@ forbid (
     principal,
     action in [
         Guardrails::Action::"process_prompt",
+        Guardrails::Action::"process_response",
         Guardrails::Action::"call_tool",
         Guardrails::Action::"read_file",
         Guardrails::Action::"write_file"
@@ -1870,13 +1890,14 @@ const GUARDRAILS_SECURITY_DATA_PIPELINE_BLOCK_INJECTION_CEDAR = `// ============
 
 @id("security.data-pipeline-block-injection")
 @name("Block pipeline injection (data-pipeline profile)")
-@description("Blocks process_prompt and call_tool when injection_score >= 66 (lower threshold for data pipelines).")
+@description("Blocks process_prompt, process_response, and call_tool when injection_score >= 66 (lower threshold for data pipelines).")
 @severity("high")
 @tags("category:security,threat:injection,detection:ml,owasp:llm01")
 @reject_message("Request blocked: prompt injection detected at the data-pipeline threshold — RAG inputs are high-risk for indirect injection.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool"],
     resource
 )
 when {
@@ -2024,13 +2045,13 @@ when {
 
 @id("agent-identity.multi-agent-autonomous-injection")
 @name("Block injection on autonomous agents (stricter)")
-@description("Blocks process_prompt when agent_type is \\"autonomous\\" and injection_score >= 51.")
+@description("Blocks process_prompt and process_response when agent_type is \\"autonomous\\" and injection_score >= 51.")
 @severity("high")
-@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,owasp:llm01")
+@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,surface:process-response,owasp:llm01")
 @reject_message("Prompt blocked: lower injection threshold applies to autonomous agents and was exceeded.")
 forbid (
     principal is Guardrails::Agent,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -2040,13 +2061,13 @@ when {
 
 @id("agent-identity.multi-agent-autonomous-jailbreak")
 @name("Block jailbreak on autonomous agents (stricter)")
-@description("Blocks process_prompt when agent_type is \\"autonomous\\" and jailbreak_score >= 51.")
+@description("Blocks process_prompt and process_response when agent_type is \\"autonomous\\" and jailbreak_score >= 51.")
 @severity("high")
-@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,owasp:llm02")
+@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,surface:process-response,owasp:llm02")
 @reject_message("Prompt blocked: lower jailbreak threshold applies to autonomous agents and was exceeded.")
 forbid (
     principal is Guardrails::Agent,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -2250,13 +2271,14 @@ const GUARDRAILS_AGENT_IDENTITY_A2A_CROSS_ORIGIN_CEDAR = `// ===================
 
 @id("agent-identity.a2a-block-cross-origin-critical")
 @name("Block critical cross-origin from any agent")
-@description("Blocks process_prompt and call_tool when cross_origin_detected is true and cross_origin_score >= 80.")
+@description("Blocks process_prompt, process_response, and call_tool when cross_origin_detected is true and cross_origin_score >= 80.")
 @severity("critical")
 @tags("category:agent-identity,threat:supply-chain,detection:ml,owasp:llm08")
 @reject_message("Request blocked: high-confidence cross-origin trust-boundary violation detected — confused-deputy attack.")
 forbid (
     principal is Guardrails::Agent,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool"],
     resource
 )
 when {
@@ -2267,13 +2289,14 @@ when {
 
 @id("agent-identity.a2a-block-cross-origin-unverified")
 @name("Block cross-origin from unverified agents")
-@description("Blocks process_prompt and call_tool when agent_trust_level is \\"unverified\\", cross_origin_detected is true, and cross_origin_score >= 60.")
+@description("Blocks process_prompt, process_response, and call_tool when agent_trust_level is \\"unverified\\", cross_origin_detected is true, and cross_origin_score >= 60.")
 @severity("high")
 @tags("category:agent-identity,threat:supply-chain,scope:per-agent,detection:ml,owasp:asi03")
 @reject_message("Request blocked: unverified agent attempted cross-origin activity — no trust attestation across trust domains.")
 forbid (
     principal is Guardrails::Agent,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool"],
     resource
 )
 when {
@@ -2385,13 +2408,13 @@ when {
 
 @id("agent-identity.a2a-block-deep-context-injection")
 @name("Block multi-turn progressive injection")
-@description("Blocks process_prompt when agent_trust_level is not \\"first_party\\", multi_turn_detection is true, and injection_deep_context_score >= 60.")
+@description("Blocks process_prompt and process_response when agent_trust_level is not \\"first_party\\", multi_turn_detection is true, and injection_deep_context_score >= 60.")
 @severity("high")
-@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,owasp:llm01")
+@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,surface:process-response,owasp:llm01")
 @reject_message("Prompt blocked: multi-turn progressive injection detected by the deep-context model across conversation history.")
 forbid (
     principal is Guardrails::Agent,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -2402,13 +2425,13 @@ when {
 
 @id("agent-identity.a2a-block-deep-context-jailbreak")
 @name("Block multi-turn progressive jailbreak")
-@description("Blocks process_prompt when agent_trust_level is not \\"first_party\\", multi_turn_detection is true, and jailbreak_deep_context_score >= 60.")
+@description("Blocks process_prompt and process_response when agent_trust_level is not \\"first_party\\", multi_turn_detection is true, and jailbreak_deep_context_score >= 60.")
 @severity("high")
-@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,owasp:llm02")
+@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,surface:process-response,owasp:llm02")
 @reject_message("Prompt blocked: multi-turn progressive jailbreak detected by the deep-context model across conversation history.")
 forbid (
     principal is Guardrails::Agent,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -2423,13 +2446,14 @@ when {
 
 @id("agent-identity.a2a-block-encoded-injection")
 @name("Block encoded payload delivery between agents")
-@description("Blocks process_prompt and call_tool when agent_id is non-empty, encoded_content_detected is true, and encoded_score >= 60.")
+@description("Blocks process_prompt, process_response, and call_tool when agent_id is non-empty, encoded_content_detected is true, and encoded_score >= 60.")
 @severity("high")
 @tags("category:agent-identity,threat:encoded-payload,detection:pattern,owasp:llm01")
 @reject_message("Request blocked: encoded payload detected in agent communication — agents should exchange plaintext, not encoded content.")
 forbid (
     principal is Guardrails::Agent,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool"],
     resource
 )
 when {
@@ -2671,13 +2695,14 @@ const GUARDRAILS_AGENT_IDENTITY_A2A_ESCALATION_CEDAR = `// =====================
 
 @id("agent-identity.a2a-block-session-injection-peak")
 @name("Block agents at high session injection peak")
-@description("Blocks call_tool and process_prompt when agent_trust_level is not \\"first_party\\" and session_max_injection_score >= 70.")
+@description("Blocks call_tool and process_prompt and process_response when agent_trust_level is not \\"first_party\\" and session_max_injection_score >= 70.")
 @severity("critical")
 @tags("category:agent-identity,threat:injection,scope:per-agent,detection:aggregate,owasp:llm01")
 @reject_message("Request blocked: this session previously crossed the injection peak threshold; non-first-party agents are restricted.")
 forbid (
     principal is Guardrails::Agent,
-    action in [Guardrails::Action::"call_tool", Guardrails::Action::"process_prompt"],
+    action in [Guardrails::Action::"call_tool", Guardrails::Action::"process_prompt",
+ Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -2687,13 +2712,13 @@ when {
 
 @id("agent-identity.a2a-block-session-jailbreak-peak")
 @name("Block agents at high session jailbreak peak")
-@description("Blocks process_prompt when agent_trust_level is not \\"first_party\\" and session_max_jailbreak_score >= 70.")
+@description("Blocks process_prompt and process_response when agent_trust_level is not \\"first_party\\" and session_max_jailbreak_score >= 70.")
 @severity("critical")
 @tags("category:agent-identity,threat:jailbreak,scope:per-agent,detection:aggregate,owasp:llm02")
 @reject_message("Request blocked: this session previously crossed the jailbreak peak threshold; non-first-party agents are restricted.")
 forbid (
     principal is Guardrails::Agent,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -2762,7 +2787,7 @@ const GUARDRAILS_DATA_PROTECTION_ADVANCED_SECRETS_CEDAR = `// ==================
 
 @id("data-protection.advanced-block-high-risk-secrets")
 @name("Block high-risk credential types")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secret_types contains a cloud, GitHub, SSH, or database credential.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secret_types contains a cloud, GitHub, SSH, or database credential.")
 @severity("critical")
 @tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
 @reject_message("Content blocked: high-risk credentials detected (cloud keys, GitHub tokens, SSH keys, or database URLs).")
@@ -2770,6 +2795,7 @@ forbid (
     principal,
     action in [
         Guardrails::Action::"process_prompt",
+        Guardrails::Action::"process_response",
         Guardrails::Action::"call_tool",
         Guardrails::Action::"read_file",
         Guardrails::Action::"write_file"
@@ -2792,7 +2818,7 @@ when {
 
 @id("data-protection.advanced-block-api-tokens")
 @name("Block API keys and bearer tokens")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secret_types contains api_key, bearer_token, jwt_token, or OAuth credentials.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secret_types contains api_key, bearer_token, jwt_token, or OAuth credentials.")
 @severity("high")
 @tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
 @reject_message("Content blocked: API keys, bearer tokens, or OAuth credentials detected.")
@@ -2800,6 +2826,7 @@ forbid (
     principal,
     action in [
         Guardrails::Action::"process_prompt",
+        Guardrails::Action::"process_response",
         Guardrails::Action::"call_tool",
         Guardrails::Action::"read_file",
         Guardrails::Action::"write_file"
@@ -2841,7 +2868,8 @@ const GUARDRAILS_PRIVACY_ADVANCED_PII_CEDAR = `// ==============================
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -2863,7 +2891,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -2882,7 +2911,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -2904,7 +2934,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -2928,7 +2959,8 @@ when {
 @reject_message("Content blocked: tax identifier (ITIN or EIN) patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -2948,7 +2980,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -2979,7 +3012,8 @@ when {
 @reject_message("Content blocked: cryptocurrency wallet address patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -2998,7 +3032,8 @@ when {
 @reject_message("Content blocked: personal name patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -3017,7 +3052,8 @@ when {
 @reject_message("Content blocked: email address patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -3036,7 +3072,8 @@ when {
 @reject_message("Content blocked: phone number patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -3055,7 +3092,8 @@ when {
 @reject_message("Content blocked: date or time patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -3077,7 +3115,8 @@ when {
 @reject_message("Content blocked: URL patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -3096,7 +3135,8 @@ when {
 @reject_message("Content blocked: street address or location patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -3117,7 +3157,8 @@ when {
 @reject_message("Content blocked: organization name patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -3136,7 +3177,8 @@ when {
 @reject_message("Content blocked: occupation patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -3155,7 +3197,8 @@ when {
 @reject_message("Content blocked: username patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -3174,7 +3217,8 @@ when {
 @reject_message("Content blocked: employee or customer identifier patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -3195,7 +3239,8 @@ when {
 @reject_message("Content blocked: device or network identifier patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -3222,7 +3267,8 @@ when {
 @reject_message("Content blocked: vehicle identifier (VIN or plate) patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -3242,7 +3288,8 @@ when {
 @reject_message("Content blocked: salary or financial amount patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -3263,7 +3310,8 @@ when {
 @reject_message("Content blocked: sensitive attribute (ethnicity, religion, etc.) patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -3283,37 +3331,6 @@ when {
     )
 };
 `;
-const GUARDRAILS_SECURITY_ADVANCED_BLOCK_CRITICAL_SEVERITY_CEDAR = `// =============================================================================
-// Advanced Detection — Threat Severity
-// =============================================================================
-// Catch-all that blocks any content flagged as critical severity by any
-// detector. Acts as a safety net behind all other policies.
-//
-// Context keys consumed:
-//   - highest_severity: String
-//
-// Compliance:
-//   - NIST 800-53 SI-3, SI-4
-//
-// Category:  security
-// Namespace: Guardrails
-// =============================================================================
-
-@id("security.advanced-block-critical-severity")
-@name("Block critical-severity threats")
-@description("Blocks process_prompt when highest_severity equals \\"critical\\".")
-@severity("critical")
-@tags("category:security,detection:aggregate,surface:process-prompt,posture:catch-all,compliance:nist-si-3")
-@reject_message("Prompt blocked: a critical-severity threat was reported by at least one detector.")
-forbid (
-    principal,
-    action == Guardrails::Action::"process_prompt",
-    resource
-)
-when {
-    context has highest_severity && context.highest_severity == "critical"
-};
-`;
 const GUARDRAILS_AGENT_SECURITY_PARAM_VALIDATION_CEDAR = `// =============================================================================
 // Action Parameter Validation  (AARM R3 / CAP-ENF-007)
 // =============================================================================
@@ -3764,15 +3781,6 @@ export const GUARDRAILS_TEMPLATES = [
         severity: 'critical',
         tags: ['category:privacy', 'threat:pii', 'detection:pattern', 'compliance:pci-dss', 'compliance:hipaa'],
     },
-    {
-        id: 'security.advanced-block-critical-severity',
-        name: 'Advanced Detection — Threat Severity',
-        description: 'Catch-all that blocks any content flagged as critical severity by any detector.',
-        category: 'security',
-        cedarText: GUARDRAILS_SECURITY_ADVANCED_BLOCK_CRITICAL_SEVERITY_CEDAR,
-        severity: 'critical',
-        tags: ['category:security', 'detection:aggregate', 'posture:catch-all'],
-    },
     {
         id: 'agent-security.param-validation',
         name: 'Action Parameter Validation',
@@ -4271,15 +4279,6 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
         "compliance:hipaa"
       ]
     },
-    {
-      "id": "security.advanced-block-critical-severity",
-      "name": "Advanced Detection — Threat Severity",
-      "description": "Catch-all that blocks any content flagged as critical severity by any detector.",
-      "category": "security",
-      "file": "profiles/advanced_detection/threat_severity.cedar",
-      "severity": "critical",
-      "tags": ["category:security", "detection:aggregate", "posture:catch-all"]
-    },
     {
       "id": "agent-security.param-validation",
       "name": "Action Parameter Validation",