@highflame/policy 2.2.36 → 2.2.38

package/_schemas/agent_ops/templates/ported/agent-security/agent_identity_a2a_escalation.cedar

@@ -27,13 +27,14 @@
 
 @id("agent-identity.a2a-block-session-injection-peak")
 @name("Block agents at high session injection peak")
-@description("Blocks call_tool and process_prompt when agent_trust_level is not \"first_party\" and session_max_injection_score >= 70.")
+@description("Blocks call_tool and process_prompt and process_response when agent_trust_level is not \"first_party\" and session_max_injection_score >= 70.")
 @severity("critical")
 @tags("category:agent-identity,threat:injection,scope:per-agent,detection:aggregate,owasp:llm01")
 @reject_message("Request blocked: this session previously crossed the injection peak threshold; non-first-party agents are restricted.")
 forbid (
     principal is AgentOps::Agent,
-    action in [AgentOps::Action::"call_tool", AgentOps::Action::"process_prompt"],
+    action in [AgentOps::Action::"call_tool", AgentOps::Action::"process_prompt",
+ AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -43,13 +44,13 @@ when {
 
 @id("agent-identity.a2a-block-session-jailbreak-peak")
 @name("Block agents at high session jailbreak peak")
-@description("Blocks process_prompt when agent_trust_level is not \"first_party\" and session_max_jailbreak_score >= 70.")
+@description("Blocks process_prompt and process_response when agent_trust_level is not \"first_party\" and session_max_jailbreak_score >= 70.")
 @severity("critical")
 @tags("category:agent-identity,threat:jailbreak,scope:per-agent,detection:aggregate,owasp:llm02")
 @reject_message("Request blocked: this session previously crossed the jailbreak peak threshold; non-first-party agents are restricted.")
 forbid (
     principal is AgentOps::Agent,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {

package/_schemas/agent_ops/templates/ported/agent-security/agent_identity_a2a_inter_agent_injection.cedar

@@ -66,13 +66,13 @@ when {
 
 @id("agent-identity.a2a-block-deep-context-injection")
 @name("Block multi-turn progressive injection")
-@description("Blocks process_prompt when agent_trust_level is not \"first_party\", multi_turn_detection is true, and injection_deep_context_score >= 60.")
+@description("Blocks process_prompt and process_response when agent_trust_level is not \"first_party\", multi_turn_detection is true, and injection_deep_context_score >= 60.")
 @severity("high")
-@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,owasp:llm01")
+@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,surface:process-response,owasp:llm01")
 @reject_message("Prompt blocked: multi-turn progressive injection detected by the deep-context model across conversation history.")
 forbid (
     principal is AgentOps::Agent,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -83,13 +83,13 @@ when {
 
 @id("agent-identity.a2a-block-deep-context-jailbreak")
 @name("Block multi-turn progressive jailbreak")
-@description("Blocks process_prompt when agent_trust_level is not \"first_party\", multi_turn_detection is true, and jailbreak_deep_context_score >= 60.")
+@description("Blocks process_prompt and process_response when agent_trust_level is not \"first_party\", multi_turn_detection is true, and jailbreak_deep_context_score >= 60.")
 @severity("high")
-@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,owasp:llm02")
+@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,surface:process-response,owasp:llm02")
 @reject_message("Prompt blocked: multi-turn progressive jailbreak detected by the deep-context model across conversation history.")
 forbid (
     principal is AgentOps::Agent,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -104,13 +104,14 @@ when {
 
 @id("agent-identity.a2a-block-encoded-injection")
 @name("Block encoded payload delivery between agents")
-@description("Blocks process_prompt and call_tool when agent_id is non-empty, encoded_content_detected is true, and encoded_score >= 60.")
+@description("Blocks process_prompt, process_response, and call_tool when agent_id is non-empty, encoded_content_detected is true, and encoded_score >= 60.")
 @severity("high")
 @tags("category:agent-identity,threat:encoded-payload,detection:pattern,owasp:llm01")
 @reject_message("Request blocked: encoded payload detected in agent communication — agents should exchange plaintext, not encoded content.")
 forbid (
     principal is AgentOps::Agent,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {

package/_schemas/agent_ops/templates/ported/agent-security/agent_identity_claude_block_injection.cedar

@@ -18,11 +18,11 @@
 @name("Block injection on Claude agent")
 @description("Blocks process_prompt for the Claude agent when detected_threats contains \"prompt_injection\".")
 @severity("critical")
-@tags("category:agent-identity,threat:injection,scope:per-agent,detection:rule,surface:process-prompt,owasp:llm01")
+@tags("category:agent-identity,threat:injection,scope:per-agent,detection:rule,surface:process-prompt,surface:process-response,owasp:llm01")
 @reject_message("Prompt blocked: prompt injection detected for the Claude agent.")
 forbid (
     principal == AgentOps::Agent::"claude",
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {

package/_schemas/agent_ops/templates/ported/agent-security/agent_identity_defaults.cedar

@@ -87,13 +87,13 @@ when {
 
 @id("agent-identity.block-autonomous-injection")
 @name("Block injection on autonomous agents")
-@description("Blocks process_prompt when agent_type is \"autonomous\" and injection_score >= 51.")
+@description("Blocks process_prompt and process_response when agent_type is \"autonomous\" and injection_score >= 51.")
 @severity("high")
-@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,owasp:llm01")
+@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,surface:process-response,owasp:llm01")
 @reject_message("Prompt blocked: lower injection threshold applies to autonomous agents and was exceeded.")
 forbid (
     principal is AgentOps::Agent,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {

package/_schemas/agent_ops/templates/ported/agent-security/agent_identity_multi_agent_trust.cedar

@@ -93,13 +93,13 @@ when {
 
 @id("agent-identity.multi-agent-autonomous-injection")
 @name("Block injection on autonomous agents (stricter)")
-@description("Blocks process_prompt when agent_type is \"autonomous\" and injection_score >= 51.")
+@description("Blocks process_prompt and process_response when agent_type is \"autonomous\" and injection_score >= 51.")
 @severity("high")
-@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,owasp:llm01")
+@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,surface:process-response,owasp:llm01")
 @reject_message("Prompt blocked: lower injection threshold applies to autonomous agents and was exceeded.")
 forbid (
     principal is AgentOps::Agent,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -109,13 +109,13 @@ when {
 
 @id("agent-identity.multi-agent-autonomous-jailbreak")
 @name("Block jailbreak on autonomous agents (stricter)")
-@description("Blocks process_prompt when agent_type is \"autonomous\" and jailbreak_score >= 51.")
+@description("Blocks process_prompt and process_response when agent_type is \"autonomous\" and jailbreak_score >= 51.")
 @severity("high")
-@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,owasp:llm02")
+@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,surface:process-response,owasp:llm02")
 @reject_message("Prompt blocked: lower jailbreak threshold applies to autonomous agents and was exceeded.")
 forbid (
     principal is AgentOps::Agent,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {

package/_schemas/agent_ops/templates/ported/content-safety/trust_safety_chat_assistant.cedar

@@ -19,13 +19,13 @@
 
 @id("trust-safety.chat-block-toxicity")
 @name("Block toxicity (chat profile)")
-@description("Blocks process_prompt when any toxicity score is >= 71 (lower threshold for public chat).")
+@description("Blocks process_prompt and process_response when any toxicity score is >= 71 (lower threshold for public chat).")
 @severity("critical")
 @tags("category:trust-safety,threat:harmful,threat:hate-speech,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: toxic content detected at the chat-profile threshold.")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -37,13 +37,14 @@ when {
 
 @id("trust-safety.chat-block-restricted-topics")
 @name("Block restricted topics (chat profile)")
-@description("Blocks process_prompt and call_tool when topic_confidence >= 71 and content_topics contains a restricted category.")
+@description("Blocks process_prompt, process_response, and call_tool when topic_confidence >= 71 and content_topics contains a restricted category.")
 @severity("high")
 @tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: content discusses a topic restricted for chat assistants.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {

package/_schemas/agent_ops/templates/ported/content-safety/trust_safety_defaults.cedar

@@ -22,13 +22,14 @@
 
 @id("trust-safety.block-violence")
 @name("Block violent content")
-@description("Blocks process_prompt and call_tool when violence_score >= 80.")
+@description("Blocks process_prompt, process_response, and call_tool when violence_score >= 80.")
 @severity("critical")
 @tags("category:trust-safety,threat:violence,detection:ml,compliance:nist-si-4,compliance:iso-42001")
 @reject_message("Content blocked: violent content detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -37,13 +38,14 @@ when {
 
 @id("trust-safety.block-weapons")
 @name("Block weapons content")
-@description("Blocks process_prompt and call_tool when weapons_score >= 80.")
+@description("Blocks process_prompt, process_response, and call_tool when weapons_score >= 80.")
 @severity("critical")
 @tags("category:trust-safety,threat:weapons,detection:ml,compliance:nist-si-4")
 @reject_message("Content blocked: weapons-related content detected (manufacturing, procurement, or specifications).")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -52,13 +54,14 @@ when {
 
 @id("trust-safety.block-hate-speech")
 @name("Block hate speech")
-@description("Blocks process_prompt and call_tool when hate_speech_score >= 75.")
+@description("Blocks process_prompt, process_response, and call_tool when hate_speech_score >= 75.")
 @severity("critical")
 @tags("category:trust-safety,threat:hate-speech,detection:ml,compliance:nist-si-4,compliance:eu-ai-act")
 @reject_message("Content blocked: hate speech or discriminatory content detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -67,13 +70,14 @@ when {
 
 @id("trust-safety.block-crime")
 @name("Block criminal content")
-@description("Blocks process_prompt and call_tool when crime_score >= 80.")
+@description("Blocks process_prompt, process_response, and call_tool when crime_score >= 80.")
 @severity("high")
 @tags("category:trust-safety,threat:crime,detection:ml,compliance:nist-si-4")
 @reject_message("Content blocked: criminal activity content detected (illegal activity, fraud, or related).")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -82,13 +86,14 @@ when {
 
 @id("trust-safety.block-sexual")
 @name("Block sexual content")
-@description("Blocks process_prompt and call_tool when sexual_score >= 80.")
+@description("Blocks process_prompt, process_response, and call_tool when sexual_score >= 80.")
 @severity("high")
 @tags("category:trust-safety,threat:sexual,detection:ml,compliance:eu-ai-act,compliance:iso-42001")
 @reject_message("Content blocked: sexually explicit content detected.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {
@@ -97,13 +102,14 @@ when {
 
 @id("trust-safety.block-profanity")
 @name("Block excessive profanity")
-@description("Blocks process_prompt and call_tool when profanity_score >= 90.")
+@description("Blocks process_prompt, process_response, and call_tool when profanity_score >= 90.")
 @severity("medium")
 @tags("category:trust-safety,threat:profanity,detection:ml")
 @reject_message("Content blocked: excessive profanity detected — please rephrase in professional language.")
 forbid (
     principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
+    action in [AgentOps::Action::"process_prompt",
+AgentOps::Action::"process_response", AgentOps::Action::"call_tool"],
     resource
 )
 when {

package/_schemas/agent_ops/templates/ported/content-safety/trust_safety_semantic.cedar

@@ -18,13 +18,13 @@
 
 @id("trust-safety.block-dangerous-topics")
 @name("Block dangerous topics")
-@description("Blocks process_prompt when content_topics contains weapons or explosives categories.")
+@description("Blocks process_prompt and process_response when content_topics contains weapons or explosives categories.")
 @severity("critical")
 @tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: content classified under a dangerous topic (weapons, explosives, illegal synthesis).")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -38,13 +38,13 @@ when {
 
 @id("trust-safety.block-controlled-substances")
 @name("Block controlled substances")
-@description("Blocks process_prompt when content_topics contains controlled substances or precursor chemicals.")
+@description("Blocks process_prompt and process_response when content_topics contains controlled substances or precursor chemicals.")
 @severity("high")
 @tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: content discusses controlled substances or precursor chemicals.")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -58,13 +58,13 @@ when {
 
 @id("trust-safety.block-restricted-topics")
 @name("Block high-confidence restricted topics")
-@description("Blocks process_prompt when topic_confidence >= 81 and content_topics contains a restricted category.")
+@description("Blocks process_prompt and process_response when topic_confidence >= 81 and content_topics contains a restricted category.")
 @severity("high")
 @tags("category:trust-safety,threat:harmful,detection:ml")
 @reject_message("Prompt blocked: content high-confidence classified into a restricted topic (illegal activity, fraud, social engineering).")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {

package/_schemas/agent_ops/templates/ported/content-safety/trust_safety_toxicity.cedar

@@ -23,13 +23,13 @@
 
 @id("trust-safety.block-toxicity-critical")
 @name("Block critical toxicity")
-@description("Blocks process_prompt when any toxicity score is >= 91.")
+@description("Blocks process_prompt and process_response when any toxicity score is >= 91.")
 @severity("critical")
 @tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act,compliance:iso-42001")
 @reject_message("Prompt blocked: critical-severity toxic content detected.")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {
@@ -43,13 +43,13 @@ when {
 
 @id("trust-safety.block-toxicity-combined")
 @name("Block combined toxicity")
-@description("Blocks process_prompt when any two toxicity scores are >= 61.")
+@description("Blocks process_prompt and process_response when any two toxicity scores are >= 61.")
 @severity("high")
 @tags("category:trust-safety,threat:harmful,detection:aggregate")
 @reject_message("Prompt blocked: multiple moderate toxicity signals were detected together.")
 forbid (
     principal,
-    action == AgentOps::Action::"process_prompt",
+    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"process_response"],
     resource
 )
 when {

package/_schemas/agent_ops/templates/ported/data-protection/data_protection_advanced_secrets.cedar

@@ -18,7 +18,7 @@
 
 @id("data-protection.advanced-block-high-risk-secrets")
 @name("Block high-risk credential types")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secret_types contains a cloud, GitHub, SSH, or database credential.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secret_types contains a cloud, GitHub, SSH, or database credential.")
 @severity("critical")
 @tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
 @reject_message("Content blocked: high-risk credentials detected (cloud keys, GitHub tokens, SSH keys, or database URLs).")
@@ -26,6 +26,7 @@ forbid (
     principal,
     action in [
         AgentOps::Action::"process_prompt",
+        AgentOps::Action::"process_response",
         AgentOps::Action::"call_tool",
         AgentOps::Action::"read_file",
         AgentOps::Action::"write_file"
@@ -48,7 +49,7 @@ when {
 
 @id("data-protection.advanced-block-api-tokens")
 @name("Block API keys and bearer tokens")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secret_types contains api_key, bearer_token, jwt_token, or OAuth credentials.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secret_types contains api_key, bearer_token, jwt_token, or OAuth credentials.")
 @severity("high")
 @tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
 @reject_message("Content blocked: API keys, bearer tokens, or OAuth credentials detected.")
@@ -56,6 +57,7 @@ forbid (
     principal,
     action in [
         AgentOps::Action::"process_prompt",
+        AgentOps::Action::"process_response",
         AgentOps::Action::"call_tool",
         AgentOps::Action::"read_file",
         AgentOps::Action::"write_file"

package/_schemas/agent_ops/templates/ported/data-protection/data_protection_data_pipeline.cedar

@@ -17,7 +17,7 @@
 
 @id("data-protection.data-pipeline-block-secrets")
 @name("Block secrets in data pipeline")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secrets_detected is true.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secrets_detected is true.")
 @severity("critical")
 @tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
 @reject_message("Request blocked: secrets detected in a data pipeline — any credential exposure is unacceptable here.")
@@ -25,6 +25,7 @@ forbid (
     principal,
     action in [
         AgentOps::Action::"process_prompt",
+        AgentOps::Action::"process_response",
         AgentOps::Action::"call_tool",
         AgentOps::Action::"read_file",
         AgentOps::Action::"write_file"

package/_schemas/agent_ops/templates/ported/data-protection/data_protection_defaults.cedar

@@ -18,7 +18,7 @@
 
 @id("data-protection.block-secrets")
 @name("Block secrets")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secrets_detected is true.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secrets_detected is true.")
 @severity("critical")
 @tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
 @reject_message("Request blocked: secrets or credentials were detected in the content.")
@@ -26,6 +26,7 @@ forbid (
     principal,
     action in [
         AgentOps::Action::"process_prompt",
+        AgentOps::Action::"process_response",
         AgentOps::Action::"call_tool",
         AgentOps::Action::"read_file",
         AgentOps::Action::"write_file"
@@ -38,7 +39,7 @@ when {
 
 @id("data-protection.block-secrets-bulk")
 @name("Block secrets (bulk)")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secret_count >= 3.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secret_count >= 3.")
 @severity("critical")
 @tags("category:data-protection,threat:secrets,threat:exfiltration,detection:aggregate,owasp:llm06")
 @reject_message("Request blocked: multiple distinct secrets were detected — possible credential dump.")
@@ -46,6 +47,7 @@ forbid (
     principal,
     action in [
         AgentOps::Action::"process_prompt",
+        AgentOps::Action::"process_response",
         AgentOps::Action::"call_tool",
         AgentOps::Action::"read_file",
         AgentOps::Action::"write_file"