@highflame/policy 2.2.37 → 2.2.39

package/_schemas/agent_ops/templates/templates.json

@@ -6,42 +6,50 @@
     {
       "id": "threat-detection",
       "name": "Threat Detection",
-      "description": "Detect and block injection, jailbreak, and adversarial attacks across all agent traffic."
+      "description": "Detect and block injection, jailbreak, and adversarial attacks across all agent traffic.",
+      "layer": "guardrail"
     },
     {
       "id": "data-protection",
       "name": "Data Protection",
-      "description": "Prevent secrets, PII, and sensitive data from leaking in prompts, responses, or tool calls."
+      "description": "Prevent secrets, PII, and sensitive data from leaking in prompts, responses, or tool calls.",
+      "layer": "guardrail"
     },
     {
       "id": "agent-security",
       "name": "Agent Security",
-      "description": "Guard against tool poisoning, rug-pull attacks, and multi-agent delegation abuse."
+      "description": "Guard against tool poisoning, rug-pull attacks, and multi-agent delegation abuse.",
+      "layer": "guardrail"
     },
     {
       "id": "tool-permissioning",
       "name": "Tool Permissioning",
-      "description": "Allow-list or block-list specific tools, MCP servers, and shell operations by risk tier."
+      "description": "Allow-list or block-list specific tools, MCP servers, and shell operations by risk tier.",
+      "layer": "access"
     },
     {
       "id": "code-security",
       "name": "Code Security",
-      "description": "Enforce safe coding patterns: no exfiltration commands, no destructive write operations."
+      "description": "Enforce safe coding patterns: no exfiltration commands, no destructive write operations.",
+      "layer": "guardrail"
     },
     {
       "id": "content-safety",
       "name": "Content Safety",
-      "description": "Block harmful, toxic, or policy-violating content in agent inputs and outputs."
+      "description": "Block harmful, toxic, or policy-violating content in agent inputs and outputs.",
+      "layer": "guardrail"
     },
     {
       "id": "organization",
       "name": "Organization",
-      "description": "Organization-wide baselines and default permit/deny policies."
+      "description": "Organization-wide baselines and default permit/deny policies.",
+      "layer": "access"
     },
     {
       "id": "sandbox",
       "name": "Sandbox",
-      "description": "Forge sandbox provisioning profiles \u2014 capability ceilings for the OS-layer envelope (writable paths, egress, exec, mechanism toggles, isolation tier)."
+      "description": "Forge sandbox provisioning profiles \u2014 capability ceilings for the OS-layer envelope (writable paths, egress, exec, mechanism toggles, isolation tier).",
+      "layer": "access"
     }
   ],
   "defaults": [

package/_schemas/ai_gateway/templates/templates.json

@@ -6,32 +6,38 @@
     {
       "id": "semantic",
       "name": "Semantic Threat Detection",
-      "description": "Detect and block prompt injection, jailbreak attempts, and high-severity AI security threats."
+      "description": "Detect and block prompt injection, jailbreak attempts, and high-severity AI security threats.",
+      "layer": "guardrail"
     },
     {
       "id": "tools",
       "name": "Tool Permissioning",
-      "description": "Control access to MCP tools, enforce risk scoring, and manage per-tool permissions."
+      "description": "Control access to MCP tools, enforce risk scoring, and manage per-tool permissions.",
+      "layer": "access"
     },
     {
       "id": "agent-security",
       "name": "Agent Security",
-      "description": "Detect tool poisoning, rug pull attacks, indirect prompt injection, and MCP supply chain threats."
+      "description": "Detect tool poisoning, rug pull attacks, indirect prompt injection, and MCP supply chain threats.",
+      "layer": "guardrail"
     },
     {
       "id": "data-protection",
       "name": "Data Protection",
-      "description": "Prevent secrets leakage in LLM chat completions and MCP operations."
+      "description": "Prevent secrets leakage in LLM chat completions and MCP operations.",
+      "layer": "guardrail"
     },
     {
       "id": "privacy",
       "name": "Privacy",
-      "description": "Block personally identifiable information (PII) in LLM prompts and MCP tool calls."
+      "description": "Block personally identifiable information (PII) in LLM prompts and MCP tool calls.",
+      "layer": "guardrail"
     },
     {
       "id": "organization",
       "name": "Organization",
-      "description": "Organization-wide baselines and default permit policies."
+      "description": "Organization-wide baselines and default permit policies.",
+      "layer": "access"
     }
   ],
   "defaults": [

package/_schemas/guardrails/templates/templates.json

@@ -6,42 +6,50 @@
     {
       "id": "security",
       "name": "Security",
-      "description": "Block prompt injection, jailbreak attempts, path traversal, and SQL injection."
+      "description": "Block prompt injection, jailbreak attempts, path traversal, and SQL injection.",
+      "layer": "guardrail"
     },
     {
       "id": "privacy",
       "name": "Privacy",
-      "description": "Block personally identifiable information (PII) in prompts and responses."
+      "description": "Block personally identifiable information (PII) in prompts and responses.",
+      "layer": "guardrail"
     },
     {
       "id": "data-protection",
       "name": "Data Protection",
-      "description": "Block secrets, API keys, tokens, and bulk credential exposure."
+      "description": "Block secrets, API keys, tokens, and bulk credential exposure.",
+      "layer": "guardrail"
     },
     {
       "id": "trust-safety",
       "name": "Trust & Safety",
-      "description": "Block toxic, violent, hateful, sexual, or profane content; restrict regulated topics."
+      "description": "Block toxic, violent, hateful, sexual, or profane content; restrict regulated topics.",
+      "layer": "guardrail"
     },
     {
       "id": "tools",
       "name": "Tools",
-      "description": "Per-tool MCP access control, org-wide server exclusions, unverified server blocks."
+      "description": "Per-tool MCP access control, org-wide server exclusions, unverified server blocks.",
+      "layer": "access"
     },
     {
       "id": "agent-security",
       "name": "Agent Security",
-      "description": "Block tool abuse, exfiltration patterns, loops, budget violations, tool poisoning, rug pull, and risky MCP configs."
+      "description": "Block tool abuse, exfiltration patterns, loops, budget violations, tool poisoning, rug pull, and risky MCP configs.",
+      "layer": "guardrail"
     },
     {
       "id": "agent-identity",
       "name": "Agent Identity",
-      "description": "Trust-based access control for AI agents — tiered permissions by trust level, autonomous agent restrictions, cross-turn session lockdowns."
+      "description": "Trust-based access control for AI agents — tiered permissions by trust level, autonomous agent restrictions, cross-turn session lockdowns.",
+      "layer": "guardrail"
     },
     {
       "id": "organization",
       "name": "Organization",
-      "description": "Organization-wide baselines and default permit/deny policies."
+      "description": "Organization-wide baselines and default permit/deny policies.",
+      "layer": "access"
     }
   ],
   "defaults": [

package/_schemas/sentry/templates/templates.json

@@ -6,32 +6,38 @@
     {
       "id": "data-protection",
       "name": "Secrets & Data Protection",
-      "description": "Block secrets, API keys, tokens, and credentials in messages and uploads."
+      "description": "Block secrets, API keys, tokens, and credentials in messages and uploads.",
+      "layer": "guardrail"
     },
     {
       "id": "privacy",
       "name": "PII Detection",
-      "description": "Block personally identifiable information across messages and uploads."
+      "description": "Block personally identifiable information across messages and uploads.",
+      "layer": "guardrail"
     },
     {
       "id": "semantic",
       "name": "Semantic Threat Detection",
-      "description": "Block prompt injection, jailbreak attempts, and high-severity threats."
+      "description": "Block prompt injection, jailbreak attempts, and high-severity threats.",
+      "layer": "guardrail"
     },
     {
       "id": "trust-safety",
       "name": "Content Safety",
-      "description": "Block violent, harmful, hateful, sexual, or profane content."
+      "description": "Block violent, harmful, hateful, sexual, or profane content.",
+      "layer": "guardrail"
     },
     {
       "id": "clipboard",
       "name": "Clipboard Policy",
-      "description": "Control paste operations into AI chat services."
+      "description": "Control paste operations into AI chat services.",
+      "layer": "guardrail"
     },
     {
       "id": "organization",
       "name": "Organization Rules",
-      "description": "Organization-wide baselines and session-aware threat escalation."
+      "description": "Organization-wide baselines and session-aware threat escalation.",
+      "layer": "access"
     }
   ],
   "defaults": [

package/dist/agent_ops-defaults.gen.d.ts

@@ -10,6 +10,9 @@ export interface AgentOpsCategoryInfo {
     id: AgentOpsCategory;
     name: string;
     description: string;
+    /** Control layer: 'access' governs whether an action is permitted at
+     *  all; 'guardrail' governs whether a given request should pass. */
+    layer: 'access' | 'guardrail';
 }
 /**
  * A default policy that is auto-created for new projects.

package/dist/agent_ops-defaults.gen.js

@@ -4546,14 +4546,14 @@ when {
 // CATEGORIES
 // =============================================================================
 export const AGENT_OPS_CATEGORIES = [
-    { id: 'threat-detection', name: 'Threat Detection', description: 'Detect and block injection, jailbreak, and adversarial attacks across all agent traffic.' },
-    { id: 'data-protection', name: 'Data Protection', description: 'Prevent secrets, PII, and sensitive data from leaking in prompts, responses, or tool calls.' },
-    { id: 'agent-security', name: 'Agent Security', description: 'Guard against tool poisoning, rug-pull attacks, and multi-agent delegation abuse.' },
-    { id: 'tool-permissioning', name: 'Tool Permissioning', description: 'Allow-list or block-list specific tools, MCP servers, and shell operations by risk tier.' },
-    { id: 'code-security', name: 'Code Security', description: 'Enforce safe coding patterns: no exfiltration commands, no destructive write operations.' },
-    { id: 'content-safety', name: 'Content Safety', description: 'Block harmful, toxic, or policy-violating content in agent inputs and outputs.' },
-    { id: 'organization', name: 'Organization', description: 'Organization-wide baselines and default permit/deny policies.' },
-    { id: 'sandbox', name: 'Sandbox', description: 'Forge sandbox provisioning profiles — capability ceilings for the OS-layer envelope (writable paths, egress, exec, mechanism toggles, isolation tier).' },
+    { id: 'threat-detection', name: 'Threat Detection', description: 'Detect and block injection, jailbreak, and adversarial attacks across all agent traffic.', layer: 'guardrail' },
+    { id: 'data-protection', name: 'Data Protection', description: 'Prevent secrets, PII, and sensitive data from leaking in prompts, responses, or tool calls.', layer: 'guardrail' },
+    { id: 'agent-security', name: 'Agent Security', description: 'Guard against tool poisoning, rug-pull attacks, and multi-agent delegation abuse.', layer: 'guardrail' },
+    { id: 'tool-permissioning', name: 'Tool Permissioning', description: 'Allow-list or block-list specific tools, MCP servers, and shell operations by risk tier.', layer: 'access' },
+    { id: 'code-security', name: 'Code Security', description: 'Enforce safe coding patterns: no exfiltration commands, no destructive write operations.', layer: 'guardrail' },
+    { id: 'content-safety', name: 'Content Safety', description: 'Block harmful, toxic, or policy-violating content in agent inputs and outputs.', layer: 'guardrail' },
+    { id: 'organization', name: 'Organization', description: 'Organization-wide baselines and default permit/deny policies.', layer: 'access' },
+    { id: 'sandbox', name: 'Sandbox', description: 'Forge sandbox provisioning profiles — capability ceilings for the OS-layer envelope (writable paths, egress, exec, mechanism toggles, isolation tier).', layer: 'access' },
 ];
 // =============================================================================
 // DEFAULT POLICIES
@@ -5011,42 +5011,50 @@ export const AGENT_OPS_TEMPLATES_JSON = `{
     {
       "id": "threat-detection",
       "name": "Threat Detection",
-      "description": "Detect and block injection, jailbreak, and adversarial attacks across all agent traffic."
+      "description": "Detect and block injection, jailbreak, and adversarial attacks across all agent traffic.",
+      "layer": "guardrail"
     },
     {
       "id": "data-protection",
       "name": "Data Protection",
-      "description": "Prevent secrets, PII, and sensitive data from leaking in prompts, responses, or tool calls."
+      "description": "Prevent secrets, PII, and sensitive data from leaking in prompts, responses, or tool calls.",
+      "layer": "guardrail"
     },
     {
       "id": "agent-security",
       "name": "Agent Security",
-      "description": "Guard against tool poisoning, rug-pull attacks, and multi-agent delegation abuse."
+      "description": "Guard against tool poisoning, rug-pull attacks, and multi-agent delegation abuse.",
+      "layer": "guardrail"
     },
     {
       "id": "tool-permissioning",
       "name": "Tool Permissioning",
-      "description": "Allow-list or block-list specific tools, MCP servers, and shell operations by risk tier."
+      "description": "Allow-list or block-list specific tools, MCP servers, and shell operations by risk tier.",
+      "layer": "access"
     },
     {
       "id": "code-security",
       "name": "Code Security",
-      "description": "Enforce safe coding patterns: no exfiltration commands, no destructive write operations."
+      "description": "Enforce safe coding patterns: no exfiltration commands, no destructive write operations.",
+      "layer": "guardrail"
     },
     {
       "id": "content-safety",
       "name": "Content Safety",
-      "description": "Block harmful, toxic, or policy-violating content in agent inputs and outputs."
+      "description": "Block harmful, toxic, or policy-violating content in agent inputs and outputs.",
+      "layer": "guardrail"
     },
     {
       "id": "organization",
       "name": "Organization",
-      "description": "Organization-wide baselines and default permit/deny policies."
+      "description": "Organization-wide baselines and default permit/deny policies.",
+      "layer": "access"
     },
     {
       "id": "sandbox",
       "name": "Sandbox",
-      "description": "Forge sandbox provisioning profiles \\u2014 capability ceilings for the OS-layer envelope (writable paths, egress, exec, mechanism toggles, isolation tier)."
+      "description": "Forge sandbox provisioning profiles \\u2014 capability ceilings for the OS-layer envelope (writable paths, egress, exec, mechanism toggles, isolation tier).",
+      "layer": "access"
     }
   ],
   "defaults": [

package/dist/ai_gateway-defaults.gen.d.ts

@@ -10,6 +10,9 @@ export interface AiGatewayCategoryInfo {
     id: AiGatewayCategory;
     name: string;
     description: string;
+    /** Control layer: 'access' governs whether an action is permitted at
+     *  all; 'guardrail' governs whether a given request should pass. */
+    layer: 'access' | 'guardrail';
 }
 /**
  * A default policy that is auto-created for new projects.

package/dist/ai_gateway-defaults.gen.js

@@ -1275,12 +1275,12 @@ when {
 // CATEGORIES
 // =============================================================================
 export const AI_GATEWAY_CATEGORIES = [
-    { id: 'semantic', name: 'Semantic Threat Detection', description: 'Detect and block prompt injection, jailbreak attempts, and high-severity AI security threats.' },
-    { id: 'tools', name: 'Tool Permissioning', description: 'Control access to MCP tools, enforce risk scoring, and manage per-tool permissions.' },
-    { id: 'agent-security', name: 'Agent Security', description: 'Detect tool poisoning, rug pull attacks, indirect prompt injection, and MCP supply chain threats.' },
-    { id: 'data-protection', name: 'Data Protection', description: 'Prevent secrets leakage in LLM chat completions and MCP operations.' },
-    { id: 'privacy', name: 'Privacy', description: 'Block personally identifiable information (PII) in LLM prompts and MCP tool calls.' },
-    { id: 'organization', name: 'Organization', description: 'Organization-wide baselines and default permit policies.' },
+    { id: 'semantic', name: 'Semantic Threat Detection', description: 'Detect and block prompt injection, jailbreak attempts, and high-severity AI security threats.', layer: 'guardrail' },
+    { id: 'tools', name: 'Tool Permissioning', description: 'Control access to MCP tools, enforce risk scoring, and manage per-tool permissions.', layer: 'access' },
+    { id: 'agent-security', name: 'Agent Security', description: 'Detect tool poisoning, rug pull attacks, indirect prompt injection, and MCP supply chain threats.', layer: 'guardrail' },
+    { id: 'data-protection', name: 'Data Protection', description: 'Prevent secrets leakage in LLM chat completions and MCP operations.', layer: 'guardrail' },
+    { id: 'privacy', name: 'Privacy', description: 'Block personally identifiable information (PII) in LLM prompts and MCP tool calls.', layer: 'guardrail' },
+    { id: 'organization', name: 'Organization', description: 'Organization-wide baselines and default permit policies.', layer: 'access' },
 ];
 // =============================================================================
 // DEFAULT POLICIES
@@ -1414,32 +1414,38 @@ export const AI_GATEWAY_TEMPLATES_JSON = `{
     {
       "id": "semantic",
       "name": "Semantic Threat Detection",
-      "description": "Detect and block prompt injection, jailbreak attempts, and high-severity AI security threats."
+      "description": "Detect and block prompt injection, jailbreak attempts, and high-severity AI security threats.",
+      "layer": "guardrail"
     },
     {
       "id": "tools",
       "name": "Tool Permissioning",
-      "description": "Control access to MCP tools, enforce risk scoring, and manage per-tool permissions."
+      "description": "Control access to MCP tools, enforce risk scoring, and manage per-tool permissions.",
+      "layer": "access"
     },
     {
       "id": "agent-security",
       "name": "Agent Security",
-      "description": "Detect tool poisoning, rug pull attacks, indirect prompt injection, and MCP supply chain threats."
+      "description": "Detect tool poisoning, rug pull attacks, indirect prompt injection, and MCP supply chain threats.",
+      "layer": "guardrail"
     },
     {
       "id": "data-protection",
       "name": "Data Protection",
-      "description": "Prevent secrets leakage in LLM chat completions and MCP operations."
+      "description": "Prevent secrets leakage in LLM chat completions and MCP operations.",
+      "layer": "guardrail"
     },
     {
       "id": "privacy",
       "name": "Privacy",
-      "description": "Block personally identifiable information (PII) in LLM prompts and MCP tool calls."
+      "description": "Block personally identifiable information (PII) in LLM prompts and MCP tool calls.",
+      "layer": "guardrail"
     },
     {
       "id": "organization",
       "name": "Organization",
-      "description": "Organization-wide baselines and default permit policies."
+      "description": "Organization-wide baselines and default permit policies.",
+      "layer": "access"
     }
   ],
   "defaults": [

package/dist/category-layers.gen.d.ts

@@ -0,0 +1,22 @@
+/**
+ * A policy's control layer.
+ *
+ * `access`    — may this agent take this action at all?
+ * `guardrail` — should this particular request go through?
+ */
+export type PolicyLayer = 'access' | 'guardrail';
+/**
+ * Resolve a policy or template category to its control layer.
+ *
+ * Normalizes separators, case and surrounding whitespace before looking
+ * up: the catalogues are kebab-case, but stored policy categories are
+ * not uniformly so, and an unnormalized lookup silently misses them.
+ *
+ * Returns `undefined` for a slug this package does not classify, so a
+ * caller renders nothing rather than a guessed layer.
+ */
+export declare function layerForCategory(category: string | null | undefined): PolicyLayer | undefined;
+/** Every slug this package classifies, canonical first. */
+export declare function knownCategorySlugs(): string[];
+/** True when the slug resolves only because it is a retired alias. */
+export declare function isRetiredCategory(category: string | null | undefined): boolean;

package/dist/category-layers.gen.js

@@ -0,0 +1,69 @@
+// Code generated by highflame-policy-codegen. DO NOT EDIT.
+// Source: `layer` on each category in schemas/*/templates/templates.json,
+//         plus RETIRED_CATEGORY_LAYERS in codegen/src/lib.rs
+//
+// The single source for "which control layer does this policy category
+// belong to?". Consumers must call layerForCategory rather than keeping a
+// private slug->layer table: this taxonomy is derived from the Cedar rule
+// heads in each template (only categories that grant are Access), and a
+// hand-maintained copy drifts the moment a category is added upstream.
+/** Layer for every category the catalogues currently define. */
+const CANONICAL = {
+    "agent-identity": 'guardrail',
+    "agent-security": 'guardrail',
+    "clipboard": 'guardrail',
+    "code-security": 'guardrail',
+    "content-safety": 'guardrail',
+    "data-protection": 'guardrail',
+    "organization": 'access',
+    "privacy": 'guardrail',
+    "sandbox": 'access',
+    "security": 'guardrail',
+    "semantic": 'guardrail',
+    "threat-detection": 'guardrail',
+    "tool-permissioning": 'access',
+    "tools": 'access',
+    "trust-safety": 'guardrail',
+};
+/**
+ * Layer for slugs no catalogue defines any more but which still tag live
+ * policies. Kept separate from CANONICAL so the canonical set stays
+ * exactly what the catalogues declare, and consulted second so that
+ * reviving a retired name upstream takes effect rather than being
+ * shadowed here.
+ */
+const RETIRED = {
+    "agentic-security": 'guardrail', // superseded by agent-security
+    "secrets": 'guardrail', // superseded by data-protection
+    "pii": 'guardrail', // superseded by privacy
+    "pii-types": 'guardrail', // superseded by privacy
+    "keyword-filter": 'guardrail', // superseded by content-safety
+    "file-safety": 'guardrail', // superseded by content-safety
+};
+/**
+ * Resolve a policy or template category to its control layer.
+ *
+ * Normalizes separators, case and surrounding whitespace before looking
+ * up: the catalogues are kebab-case, but stored policy categories are
+ * not uniformly so, and an unnormalized lookup silently misses them.
+ *
+ * Returns `undefined` for a slug this package does not classify, so a
+ * caller renders nothing rather than a guessed layer.
+ */
+export function layerForCategory(category) {
+    if (!category)
+        return undefined;
+    const slug = category.trim().toLowerCase().replace(/_/g, '-');
+    return CANONICAL[slug] ?? RETIRED[slug];
+}
+/** Every slug this package classifies, canonical first. */
+export function knownCategorySlugs() {
+    return [...Object.keys(CANONICAL), ...Object.keys(RETIRED)];
+}
+/** True when the slug resolves only because it is a retired alias. */
+export function isRetiredCategory(category) {
+    if (!category)
+        return false;
+    const slug = category.trim().toLowerCase().replace(/_/g, '-');
+    return !(slug in CANONICAL) && slug in RETIRED;
+}

package/dist/engine.d.ts

@@ -80,6 +80,16 @@ export interface EvaluateRequest {
     resource: EntityUID;
     context?: Record<string, unknown>;
     entities?: Entity[];
+    /**
+     * Narrows evaluation to the policies this predicate accepts, keyed by policy
+     * id. Cedar evaluates everything it is handed, so selecting the relevant
+     * subset is the caller's job.
+     *
+     * Omit to evaluate everything. That is also the correct fallback when a
+     * caller cannot resolve a subset: a predicate matching nothing leaves Cedar
+     * with no policies, and Cedar is default-deny.
+     */
+    policyFilter?: (policyId: string) => boolean;
 }
 /**
  * PolicyEngine wraps cedar-wasm with Highflame schema types.

package/dist/engine.js

@@ -186,6 +186,30 @@ function extractPolicies(policyText) {
     }
     return { policySet: policyMap, annotations: annotationsMap };
 }
+/**
+ * Narrow a policy set to the ids `keep` accepts. Returns the set unchanged when
+ * no predicate is given, so the unfiltered path is untouched.
+ *
+ * Throws on a string-form set, which cannot be split by id. Returning it whole
+ * would silently evaluate every policy while the caller believed it had asked
+ * for a subset — the one behaviour the filter contract must never have.
+ */
+function filterPolicySet(set, keep) {
+    if (!keep) {
+        return set;
+    }
+    if (typeof set === "string") {
+        throw new Error("policyFilter cannot be applied: policies are loaded in string form, " +
+            "which has no per-policy ids. Load via loadPoliciesWithIds().");
+    }
+    const out = {};
+    for (const [id, policy] of Object.entries(set)) {
+        if (keep(id)) {
+            out[id] = policy;
+        }
+    }
+    return out;
+}
 /**
  * PolicyEngine wraps cedar-wasm with Highflame schema types.
  */
@@ -346,7 +370,7 @@ export class PolicyEngine {
             action,
             resource,
             context,
-            policies: { staticPolicies: this.policySet },
+            policies: { staticPolicies: filterPolicySet(this.policySet, req.policyFilter) },
             entities,
         };
         // Add schema if available

package/dist/guardrails-defaults.gen.d.ts

@@ -10,6 +10,9 @@ export interface GuardrailsCategoryInfo {
     id: GuardrailsCategory;
     name: string;
     description: string;
+    /** Control layer: 'access' governs whether an action is permitted at
+     *  all; 'guardrail' governs whether a given request should pass. */
+    layer: 'access' | 'guardrail';
 }
 /**
  * A default policy that is auto-created for new projects.

package/dist/guardrails-defaults.gen.js

@@ -3455,14 +3455,14 @@ when {
 // CATEGORIES
 // =============================================================================
 export const GUARDRAILS_CATEGORIES = [
-    { id: 'security', name: 'Security', description: 'Block prompt injection, jailbreak attempts, path traversal, and SQL injection.' },
-    { id: 'privacy', name: 'Privacy', description: 'Block personally identifiable information (PII) in prompts and responses.' },
-    { id: 'data-protection', name: 'Data Protection', description: 'Block secrets, API keys, tokens, and bulk credential exposure.' },
-    { id: 'trust-safety', name: 'Trust & Safety', description: 'Block toxic, violent, hateful, sexual, or profane content; restrict regulated topics.' },
-    { id: 'tools', name: 'Tools', description: 'Per-tool MCP access control, org-wide server exclusions, unverified server blocks.' },
-    { id: 'agent-security', name: 'Agent Security', description: 'Block tool abuse, exfiltration patterns, loops, budget violations, tool poisoning, rug pull, and risky MCP configs.' },
-    { id: 'agent-identity', name: 'Agent Identity', description: 'Trust-based access control for AI agents — tiered permissions by trust level, autonomous agent restrictions, cross-turn session lockdowns.' },
-    { id: 'organization', name: 'Organization', description: 'Organization-wide baselines and default permit/deny policies.' },
+    { id: 'security', name: 'Security', description: 'Block prompt injection, jailbreak attempts, path traversal, and SQL injection.', layer: 'guardrail' },
+    { id: 'privacy', name: 'Privacy', description: 'Block personally identifiable information (PII) in prompts and responses.', layer: 'guardrail' },
+    { id: 'data-protection', name: 'Data Protection', description: 'Block secrets, API keys, tokens, and bulk credential exposure.', layer: 'guardrail' },
+    { id: 'trust-safety', name: 'Trust & Safety', description: 'Block toxic, violent, hateful, sexual, or profane content; restrict regulated topics.', layer: 'guardrail' },
+    { id: 'tools', name: 'Tools', description: 'Per-tool MCP access control, org-wide server exclusions, unverified server blocks.', layer: 'access' },
+    { id: 'agent-security', name: 'Agent Security', description: 'Block tool abuse, exfiltration patterns, loops, budget violations, tool poisoning, rug pull, and risky MCP configs.', layer: 'guardrail' },
+    { id: 'agent-identity', name: 'Agent Identity', description: 'Trust-based access control for AI agents — tiered permissions by trust level, autonomous agent restrictions, cross-turn session lockdowns.', layer: 'guardrail' },
+    { id: 'organization', name: 'Organization', description: 'Organization-wide baselines and default permit/deny policies.', layer: 'access' },
 ];
 // =============================================================================
 // DEFAULT POLICIES
@@ -3803,42 +3803,50 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
     {
       "id": "security",
       "name": "Security",
-      "description": "Block prompt injection, jailbreak attempts, path traversal, and SQL injection."
+      "description": "Block prompt injection, jailbreak attempts, path traversal, and SQL injection.",
+      "layer": "guardrail"
     },
     {
       "id": "privacy",
       "name": "Privacy",
-      "description": "Block personally identifiable information (PII) in prompts and responses."
+      "description": "Block personally identifiable information (PII) in prompts and responses.",
+      "layer": "guardrail"
     },
     {
       "id": "data-protection",
       "name": "Data Protection",
-      "description": "Block secrets, API keys, tokens, and bulk credential exposure."
+      "description": "Block secrets, API keys, tokens, and bulk credential exposure.",
+      "layer": "guardrail"
     },
     {
       "id": "trust-safety",
       "name": "Trust & Safety",
-      "description": "Block toxic, violent, hateful, sexual, or profane content; restrict regulated topics."
+      "description": "Block toxic, violent, hateful, sexual, or profane content; restrict regulated topics.",
+      "layer": "guardrail"
     },
     {
       "id": "tools",
       "name": "Tools",
-      "description": "Per-tool MCP access control, org-wide server exclusions, unverified server blocks."
+      "description": "Per-tool MCP access control, org-wide server exclusions, unverified server blocks.",
+      "layer": "access"
     },
     {
       "id": "agent-security",
       "name": "Agent Security",
-      "description": "Block tool abuse, exfiltration patterns, loops, budget violations, tool poisoning, rug pull, and risky MCP configs."
+      "description": "Block tool abuse, exfiltration patterns, loops, budget violations, tool poisoning, rug pull, and risky MCP configs.",
+      "layer": "guardrail"
     },
     {
       "id": "agent-identity",
       "name": "Agent Identity",
-      "description": "Trust-based access control for AI agents — tiered permissions by trust level, autonomous agent restrictions, cross-turn session lockdowns."
+      "description": "Trust-based access control for AI agents — tiered permissions by trust level, autonomous agent restrictions, cross-turn session lockdowns.",
+      "layer": "guardrail"
     },
     {
       "id": "organization",
       "name": "Organization",
-      "description": "Organization-wide baselines and default permit/deny policies."
+      "description": "Organization-wide baselines and default permit/deny policies.",
+      "layer": "access"
     }
   ],
   "defaults": [

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export * from './entities.gen.js';
 export * from './actions.gen.js';
 export * from './context.gen.js';
 export * from './schema.gen.js';
+export * from './category-layers.gen.js';
 export * from './decision-effects.gen.js';
 export * from './aarm-annotations.gen.js';
 export * from './aarm-annotation.js';