@highflame/policy 2.2.36 → 2.2.38

package/_schemas/ai_gateway/templates/defaults/pii_model.cedar

@@ -22,7 +22,8 @@
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -37,7 +38,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -52,7 +54,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -67,7 +70,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {
@@ -82,7 +86,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
+    action in [AIGateway::Action::"process_prompt",
+AIGateway::Action::"process_response", AIGateway::Action::"call_tool", AIGateway::Action::"read_file", AIGateway::Action::"write_file"],
     resource
 )
 when {

package/_schemas/ai_gateway/templates/defaults/semantic.cedar

@@ -1,21 +1,20 @@
 // =============================================================================
 // Semantic Threat Detection (Default)
 // =============================================================================
-// Blocks prompt injection, jailbreak attempts, and high-severity threats in
-// MCP tool calls and LLM prompts. Uses both detection-engine rule triggers and
-// ML classifier confidence scores.
+// Blocks prompt injection and jailbreak attempts in MCP tool calls and LLM
+// prompts via ML classifier confidence scores.
 //
-// Detection layers:
-//   - Rule triggers (detected_threats), always available
-//   - ML classifier scores (injection_score, jailbreak_score), require API token
-//   - Severity aggregation (highest_severity, threat_count), catch-all rules
+// The detected_threats rule-trigger clauses and the highest_severity /
+// threat_count severity-aggregation clauses this template used to carry were
+// removed: AIGateway does not run threat aggregation, so its projected context
+// never contains those keys and the rules could never fire
+// (highflame-shield#429). The ML-score rules below are the working coverage
+// for the same threats. Restore aggregate rules only if the product gains
+// aggregation.
 //
 // Context keys consumed:
-//   - detected_threats:  Set<String>
 //   - injection_score:   Long (0-100)
 //   - jailbreak_score:   Long (0-100)
-//   - highest_severity:  String
-//   - threat_count:      Long
 //
 // Compliance:
 //   - OWASP LLM01, OWASP LLM02
@@ -29,21 +28,6 @@
 // Section 1: Prompt injection
 // ---------------------------------------------------------------------------
 
-@id("semantic.block-injection-rule")
-@name("Block injection (rule)")
-@description("Blocks call_tool when detected_threats contains \"prompt_injection\".")
-@severity("critical")
-@tags("category:semantic,threat:injection,detection:rule,surface:call-tool,owasp:llm01,mitre:atlas-t0051,posture:baseline")
-@reject_message("Tool execution blocked: prompt injection patterns detected (OWASP LLM01).")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("prompt_injection")
-};
-
 @id("semantic.block-injection-ml")
 @name("Block injection (ML)")
 @description("Blocks call_tool when injection_score >= 75.")
@@ -63,21 +47,6 @@ when {
 // Section 2: Jailbreak
 // ---------------------------------------------------------------------------
 
-@id("semantic.block-jailbreak-rule")
-@name("Block jailbreak (rule)")
-@description("Blocks call_tool when detected_threats contains \"jailbreak\".")
-@severity("critical")
-@tags("category:semantic,threat:jailbreak,detection:rule,surface:call-tool,owasp:llm02,mitre:atlas-t0054,posture:baseline")
-@reject_message("Tool execution blocked: jailbreak patterns detected (OWASP LLM02).")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("jailbreak")
-};
-
 @id("semantic.block-jailbreak-ml")
 @name("Block jailbreak (ML)")
 @description("Blocks call_tool when jailbreak_score >= 75.")
@@ -92,37 +61,3 @@ forbid (
 when {
     context has jailbreak_score && context.jailbreak_score >= 75
 };
-
-// ---------------------------------------------------------------------------
-// Section 3: Severity aggregation
-// ---------------------------------------------------------------------------
-
-@id("semantic.block-critical")
-@name("Block critical threats")
-@description("Blocks all MCP operations when highest_severity equals \"critical\".")
-@severity("critical")
-@tags("category:semantic,detection:aggregate,posture:catch-all")
-@reject_message("MCP operation blocked: a critical-severity threat was detected.")
-forbid (
-    principal,
-    action,
-    resource
-)
-when {
-    context has highest_severity && context.highest_severity == "critical"
-};
-
-@id("semantic.block-multi-threat")
-@name("Block multi-threat tool calls")
-@description("Blocks call_tool when threat_count >= 3.")
-@severity("high")
-@tags("category:semantic,detection:aggregate,surface:call-tool,posture:catch-all")
-@reject_message("Tool execution blocked: multiple concurrent security threats were detected.")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has threat_count && context.threat_count >= 3
-};

package/_schemas/ai_gateway/templates/defaults/tools.cedar

@@ -1,20 +1,15 @@
 // =============================================================================
 // Tool Permissioning (Default)
 // =============================================================================
-// Blocks MCP tool calls based on risk scoring, threat detection, and tool
-// classification.
+// Blocks MCP tool calls based on risk scoring and tool classification.
 //
 // Detection layers:
 //   - Computed risk score (tool_risk_score)
 //   - Detector category labels (tool_category, tool_is_sensitive)
-//   - Threat aggregation (threat_count, max_threat_severity)
 //
 // Context keys consumed:
 //   - tool_risk_score:      Long (0-100)
 //   - tool_category:        String
-//   - tool_is_sensitive:    Bool
-//   - threat_count:         Long
-//   - max_threat_severity:  Long (0-4)
 //
 // Compliance:
 //   - OWASP LLM06, OWASP ASI02
@@ -53,38 +48,12 @@ when {
     context has tool_category && context.tool_category == "dangerous"
 };
 
-@id("tools.block-sensitive-with-threats")
-@name("Block sensitive tools with threats")
-@description("Blocks call_tool when tool_is_sensitive is true and threat_count >= 1.")
-@severity("high")
-@tags("category:tools,detection:aggregate,surface:call-tool,owasp:llm06")
-@reject_message("Tool execution blocked: a sensitive tool was called while threats were detected.")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has tool_is_sensitive && context.tool_is_sensitive == true &&
-    context has threat_count && context.threat_count >= 1
-};
-
-@id("tools.block-high-severity")
-@name("Block high-severity tool calls")
-@description("Blocks call_tool when threat_count >= 1 and max_threat_severity >= 3.")
-@severity("high")
-@tags("category:tools,detection:aggregate,surface:call-tool")
-@reject_message("Tool execution blocked: high or critical severity threats were detected.")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has threat_count && context has max_threat_severity &&
-    context.threat_count >= 1 && context.max_threat_severity >= 3
-};
-
 // The command-injection rule was removed while that detector is disabled, so
 // this template cannot instantiate a rule that can never fire. See
 // highflame-shield#386; restore it when the detector is re-enabled.
+
+// The threat_count / max_threat_severity aggregate rules
+// (tools.block-sensitive-with-threats, tools.block-high-severity) were removed
+// for the same reason: AIGateway does not run threat aggregation, so its
+// projected context never contains those keys and the rules could never fire
+// (highflame-shield#429). Restore them only if the product gains aggregation.

package/_schemas/ai_gateway/templates/secrets.cedar

@@ -17,13 +17,13 @@
 
 @id("data-protection.block-secrets")
 @name("Block secrets in prompts")
-@description("Blocks process_prompt when secrets_detected is true.")
+@description("Blocks process_prompt and process_response when secrets_detected is true.")
 @severity("critical")
-@tags("category:data-protection,threat:secrets,detection:rule,surface:process-prompt,owasp:llm06")
+@tags("category:data-protection,threat:secrets,detection:rule,surface:process-prompt,surface:process-response,owasp:llm06")
 @reject_message("Prompt blocked: secrets or credentials were detected — remove sensitive data and retry.")
 forbid (
     principal,
-    action == AIGateway::Action::"process_prompt",
+    action in [AIGateway::Action::"process_prompt", AIGateway::Action::"process_response"],
     resource
 )
 when {