@highflame/policy 2.2.38 → 2.2.39

package/_schemas/agent_ops/templates/templates.json

@@ -6,42 +6,50 @@
     {
       "id": "threat-detection",
       "name": "Threat Detection",
-      "description": "Detect and block injection, jailbreak, and adversarial attacks across all agent traffic."
+      "description": "Detect and block injection, jailbreak, and adversarial attacks across all agent traffic.",
+      "layer": "guardrail"
     },
     {
       "id": "data-protection",
       "name": "Data Protection",
-      "description": "Prevent secrets, PII, and sensitive data from leaking in prompts, responses, or tool calls."
+      "description": "Prevent secrets, PII, and sensitive data from leaking in prompts, responses, or tool calls.",
+      "layer": "guardrail"
     },
     {
       "id": "agent-security",
       "name": "Agent Security",
-      "description": "Guard against tool poisoning, rug-pull attacks, and multi-agent delegation abuse."
+      "description": "Guard against tool poisoning, rug-pull attacks, and multi-agent delegation abuse.",
+      "layer": "guardrail"
     },
     {
       "id": "tool-permissioning",
       "name": "Tool Permissioning",
-      "description": "Allow-list or block-list specific tools, MCP servers, and shell operations by risk tier."
+      "description": "Allow-list or block-list specific tools, MCP servers, and shell operations by risk tier.",
+      "layer": "access"
     },
     {
       "id": "code-security",
       "name": "Code Security",
-      "description": "Enforce safe coding patterns: no exfiltration commands, no destructive write operations."
+      "description": "Enforce safe coding patterns: no exfiltration commands, no destructive write operations.",
+      "layer": "guardrail"
     },
     {
       "id": "content-safety",
       "name": "Content Safety",
-      "description": "Block harmful, toxic, or policy-violating content in agent inputs and outputs."
+      "description": "Block harmful, toxic, or policy-violating content in agent inputs and outputs.",
+      "layer": "guardrail"
     },
     {
       "id": "organization",
       "name": "Organization",
-      "description": "Organization-wide baselines and default permit/deny policies."
+      "description": "Organization-wide baselines and default permit/deny policies.",
+      "layer": "access"
     },
     {
       "id": "sandbox",
       "name": "Sandbox",
-      "description": "Forge sandbox provisioning profiles \u2014 capability ceilings for the OS-layer envelope (writable paths, egress, exec, mechanism toggles, isolation tier)."
+      "description": "Forge sandbox provisioning profiles \u2014 capability ceilings for the OS-layer envelope (writable paths, egress, exec, mechanism toggles, isolation tier).",
+      "layer": "access"
     }
   ],
   "defaults": [

package/_schemas/ai_gateway/templates/templates.json

@@ -6,32 +6,38 @@
     {
       "id": "semantic",
       "name": "Semantic Threat Detection",
-      "description": "Detect and block prompt injection, jailbreak attempts, and high-severity AI security threats."
+      "description": "Detect and block prompt injection, jailbreak attempts, and high-severity AI security threats.",
+      "layer": "guardrail"
     },
     {
       "id": "tools",
       "name": "Tool Permissioning",
-      "description": "Control access to MCP tools, enforce risk scoring, and manage per-tool permissions."
+      "description": "Control access to MCP tools, enforce risk scoring, and manage per-tool permissions.",
+      "layer": "access"
     },
     {
       "id": "agent-security",
       "name": "Agent Security",
-      "description": "Detect tool poisoning, rug pull attacks, indirect prompt injection, and MCP supply chain threats."
+      "description": "Detect tool poisoning, rug pull attacks, indirect prompt injection, and MCP supply chain threats.",
+      "layer": "guardrail"
     },
     {
       "id": "data-protection",
       "name": "Data Protection",
-      "description": "Prevent secrets leakage in LLM chat completions and MCP operations."
+      "description": "Prevent secrets leakage in LLM chat completions and MCP operations.",
+      "layer": "guardrail"
     },
     {
       "id": "privacy",
       "name": "Privacy",
-      "description": "Block personally identifiable information (PII) in LLM prompts and MCP tool calls."
+      "description": "Block personally identifiable information (PII) in LLM prompts and MCP tool calls.",
+      "layer": "guardrail"
     },
     {
       "id": "organization",
       "name": "Organization",
-      "description": "Organization-wide baselines and default permit policies."
+      "description": "Organization-wide baselines and default permit policies.",
+      "layer": "access"
     }
   ],
   "defaults": [

package/_schemas/guardrails/templates/templates.json

@@ -6,42 +6,50 @@
     {
       "id": "security",
       "name": "Security",
-      "description": "Block prompt injection, jailbreak attempts, path traversal, and SQL injection."
+      "description": "Block prompt injection, jailbreak attempts, path traversal, and SQL injection.",
+      "layer": "guardrail"
     },
     {
       "id": "privacy",
       "name": "Privacy",
-      "description": "Block personally identifiable information (PII) in prompts and responses."
+      "description": "Block personally identifiable information (PII) in prompts and responses.",
+      "layer": "guardrail"
     },
     {
       "id": "data-protection",
       "name": "Data Protection",
-      "description": "Block secrets, API keys, tokens, and bulk credential exposure."
+      "description": "Block secrets, API keys, tokens, and bulk credential exposure.",
+      "layer": "guardrail"
     },
     {
       "id": "trust-safety",
       "name": "Trust & Safety",
-      "description": "Block toxic, violent, hateful, sexual, or profane content; restrict regulated topics."
+      "description": "Block toxic, violent, hateful, sexual, or profane content; restrict regulated topics.",
+      "layer": "guardrail"
     },
     {
       "id": "tools",
       "name": "Tools",
-      "description": "Per-tool MCP access control, org-wide server exclusions, unverified server blocks."
+      "description": "Per-tool MCP access control, org-wide server exclusions, unverified server blocks.",
+      "layer": "access"
     },
     {
       "id": "agent-security",
       "name": "Agent Security",
-      "description": "Block tool abuse, exfiltration patterns, loops, budget violations, tool poisoning, rug pull, and risky MCP configs."
+      "description": "Block tool abuse, exfiltration patterns, loops, budget violations, tool poisoning, rug pull, and risky MCP configs.",
+      "layer": "guardrail"
     },
     {
       "id": "agent-identity",
       "name": "Agent Identity",
-      "description": "Trust-based access control for AI agents — tiered permissions by trust level, autonomous agent restrictions, cross-turn session lockdowns."
+      "description": "Trust-based access control for AI agents — tiered permissions by trust level, autonomous agent restrictions, cross-turn session lockdowns.",
+      "layer": "guardrail"
     },
     {
       "id": "organization",
       "name": "Organization",
-      "description": "Organization-wide baselines and default permit/deny policies."
+      "description": "Organization-wide baselines and default permit/deny policies.",
+      "layer": "access"
     }
   ],
   "defaults": [

package/_schemas/sentry/templates/templates.json

@@ -6,32 +6,38 @@
     {
       "id": "data-protection",
       "name": "Secrets & Data Protection",
-      "description": "Block secrets, API keys, tokens, and credentials in messages and uploads."
+      "description": "Block secrets, API keys, tokens, and credentials in messages and uploads.",
+      "layer": "guardrail"
     },
     {
       "id": "privacy",
       "name": "PII Detection",
-      "description": "Block personally identifiable information across messages and uploads."
+      "description": "Block personally identifiable information across messages and uploads.",
+      "layer": "guardrail"
     },
     {
       "id": "semantic",
       "name": "Semantic Threat Detection",
-      "description": "Block prompt injection, jailbreak attempts, and high-severity threats."
+      "description": "Block prompt injection, jailbreak attempts, and high-severity threats.",
+      "layer": "guardrail"
     },
     {
       "id": "trust-safety",
       "name": "Content Safety",
-      "description": "Block violent, harmful, hateful, sexual, or profane content."
+      "description": "Block violent, harmful, hateful, sexual, or profane content.",
+      "layer": "guardrail"
     },
     {
       "id": "clipboard",
       "name": "Clipboard Policy",
-      "description": "Control paste operations into AI chat services."
+      "description": "Control paste operations into AI chat services.",
+      "layer": "guardrail"
     },
     {
       "id": "organization",
       "name": "Organization Rules",
-      "description": "Organization-wide baselines and session-aware threat escalation."
+      "description": "Organization-wide baselines and session-aware threat escalation.",
+      "layer": "access"
     }
   ],
   "defaults": [

package/dist/agent_ops-defaults.gen.d.ts

@@ -10,6 +10,9 @@ export interface AgentOpsCategoryInfo {
     id: AgentOpsCategory;
     name: string;
     description: string;
+    /** Control layer: 'access' governs whether an action is permitted at
+     *  all; 'guardrail' governs whether a given request should pass. */
+    layer: 'access' | 'guardrail';
 }
 /**
  * A default policy that is auto-created for new projects.

package/dist/agent_ops-defaults.gen.js

@@ -4546,14 +4546,14 @@ when {
 // CATEGORIES
 // =============================================================================
 export const AGENT_OPS_CATEGORIES = [
-    { id: 'threat-detection', name: 'Threat Detection', description: 'Detect and block injection, jailbreak, and adversarial attacks across all agent traffic.' },
-    { id: 'data-protection', name: 'Data Protection', description: 'Prevent secrets, PII, and sensitive data from leaking in prompts, responses, or tool calls.' },
-    { id: 'agent-security', name: 'Agent Security', description: 'Guard against tool poisoning, rug-pull attacks, and multi-agent delegation abuse.' },
-    { id: 'tool-permissioning', name: 'Tool Permissioning', description: 'Allow-list or block-list specific tools, MCP servers, and shell operations by risk tier.' },
-    { id: 'code-security', name: 'Code Security', description: 'Enforce safe coding patterns: no exfiltration commands, no destructive write operations.' },
-    { id: 'content-safety', name: 'Content Safety', description: 'Block harmful, toxic, or policy-violating content in agent inputs and outputs.' },
-    { id: 'organization', name: 'Organization', description: 'Organization-wide baselines and default permit/deny policies.' },
-    { id: 'sandbox', name: 'Sandbox', description: 'Forge sandbox provisioning profiles — capability ceilings for the OS-layer envelope (writable paths, egress, exec, mechanism toggles, isolation tier).' },
+    { id: 'threat-detection', name: 'Threat Detection', description: 'Detect and block injection, jailbreak, and adversarial attacks across all agent traffic.', layer: 'guardrail' },
+    { id: 'data-protection', name: 'Data Protection', description: 'Prevent secrets, PII, and sensitive data from leaking in prompts, responses, or tool calls.', layer: 'guardrail' },
+    { id: 'agent-security', name: 'Agent Security', description: 'Guard against tool poisoning, rug-pull attacks, and multi-agent delegation abuse.', layer: 'guardrail' },
+    { id: 'tool-permissioning', name: 'Tool Permissioning', description: 'Allow-list or block-list specific tools, MCP servers, and shell operations by risk tier.', layer: 'access' },
+    { id: 'code-security', name: 'Code Security', description: 'Enforce safe coding patterns: no exfiltration commands, no destructive write operations.', layer: 'guardrail' },
+    { id: 'content-safety', name: 'Content Safety', description: 'Block harmful, toxic, or policy-violating content in agent inputs and outputs.', layer: 'guardrail' },
+    { id: 'organization', name: 'Organization', description: 'Organization-wide baselines and default permit/deny policies.', layer: 'access' },
+    { id: 'sandbox', name: 'Sandbox', description: 'Forge sandbox provisioning profiles — capability ceilings for the OS-layer envelope (writable paths, egress, exec, mechanism toggles, isolation tier).', layer: 'access' },
 ];
 // =============================================================================
 // DEFAULT POLICIES
@@ -5011,42 +5011,50 @@ export const AGENT_OPS_TEMPLATES_JSON = `{
     {
       "id": "threat-detection",
       "name": "Threat Detection",
-      "description": "Detect and block injection, jailbreak, and adversarial attacks across all agent traffic."
+      "description": "Detect and block injection, jailbreak, and adversarial attacks across all agent traffic.",
+      "layer": "guardrail"
     },
     {
       "id": "data-protection",
       "name": "Data Protection",
-      "description": "Prevent secrets, PII, and sensitive data from leaking in prompts, responses, or tool calls."
+      "description": "Prevent secrets, PII, and sensitive data from leaking in prompts, responses, or tool calls.",
+      "layer": "guardrail"
     },
     {
       "id": "agent-security",
       "name": "Agent Security",
-      "description": "Guard against tool poisoning, rug-pull attacks, and multi-agent delegation abuse."
+      "description": "Guard against tool poisoning, rug-pull attacks, and multi-agent delegation abuse.",
+      "layer": "guardrail"
     },
     {
       "id": "tool-permissioning",
       "name": "Tool Permissioning",
-      "description": "Allow-list or block-list specific tools, MCP servers, and shell operations by risk tier."
+      "description": "Allow-list or block-list specific tools, MCP servers, and shell operations by risk tier.",
+      "layer": "access"
     },
     {
       "id": "code-security",
       "name": "Code Security",
-      "description": "Enforce safe coding patterns: no exfiltration commands, no destructive write operations."
+      "description": "Enforce safe coding patterns: no exfiltration commands, no destructive write operations.",
+      "layer": "guardrail"
     },
     {
       "id": "content-safety",
       "name": "Content Safety",
-      "description": "Block harmful, toxic, or policy-violating content in agent inputs and outputs."
+      "description": "Block harmful, toxic, or policy-violating content in agent inputs and outputs.",
+      "layer": "guardrail"
     },
     {
       "id": "organization",
       "name": "Organization",
-      "description": "Organization-wide baselines and default permit/deny policies."
+      "description": "Organization-wide baselines and default permit/deny policies.",
+      "layer": "access"
     },
     {
       "id": "sandbox",
       "name": "Sandbox",
-      "description": "Forge sandbox provisioning profiles \\u2014 capability ceilings for the OS-layer envelope (writable paths, egress, exec, mechanism toggles, isolation tier)."
+      "description": "Forge sandbox provisioning profiles \\u2014 capability ceilings for the OS-layer envelope (writable paths, egress, exec, mechanism toggles, isolation tier).",
+      "layer": "access"
     }
   ],
   "defaults": [

package/dist/ai_gateway-defaults.gen.d.ts

@@ -10,6 +10,9 @@ export interface AiGatewayCategoryInfo {
     id: AiGatewayCategory;
     name: string;
     description: string;
+    /** Control layer: 'access' governs whether an action is permitted at
+     *  all; 'guardrail' governs whether a given request should pass. */
+    layer: 'access' | 'guardrail';
 }
 /**
  * A default policy that is auto-created for new projects.

package/dist/ai_gateway-defaults.gen.js

@@ -1275,12 +1275,12 @@ when {
 // CATEGORIES
 // =============================================================================
 export const AI_GATEWAY_CATEGORIES = [
-    { id: 'semantic', name: 'Semantic Threat Detection', description: 'Detect and block prompt injection, jailbreak attempts, and high-severity AI security threats.' },
-    { id: 'tools', name: 'Tool Permissioning', description: 'Control access to MCP tools, enforce risk scoring, and manage per-tool permissions.' },
-    { id: 'agent-security', name: 'Agent Security', description: 'Detect tool poisoning, rug pull attacks, indirect prompt injection, and MCP supply chain threats.' },
-    { id: 'data-protection', name: 'Data Protection', description: 'Prevent secrets leakage in LLM chat completions and MCP operations.' },
-    { id: 'privacy', name: 'Privacy', description: 'Block personally identifiable information (PII) in LLM prompts and MCP tool calls.' },
-    { id: 'organization', name: 'Organization', description: 'Organization-wide baselines and default permit policies.' },
+    { id: 'semantic', name: 'Semantic Threat Detection', description: 'Detect and block prompt injection, jailbreak attempts, and high-severity AI security threats.', layer: 'guardrail' },
+    { id: 'tools', name: 'Tool Permissioning', description: 'Control access to MCP tools, enforce risk scoring, and manage per-tool permissions.', layer: 'access' },
+    { id: 'agent-security', name: 'Agent Security', description: 'Detect tool poisoning, rug pull attacks, indirect prompt injection, and MCP supply chain threats.', layer: 'guardrail' },
+    { id: 'data-protection', name: 'Data Protection', description: 'Prevent secrets leakage in LLM chat completions and MCP operations.', layer: 'guardrail' },
+    { id: 'privacy', name: 'Privacy', description: 'Block personally identifiable information (PII) in LLM prompts and MCP tool calls.', layer: 'guardrail' },
+    { id: 'organization', name: 'Organization', description: 'Organization-wide baselines and default permit policies.', layer: 'access' },
 ];
 // =============================================================================
 // DEFAULT POLICIES
@@ -1414,32 +1414,38 @@ export const AI_GATEWAY_TEMPLATES_JSON = `{
     {
       "id": "semantic",
       "name": "Semantic Threat Detection",
-      "description": "Detect and block prompt injection, jailbreak attempts, and high-severity AI security threats."
+      "description": "Detect and block prompt injection, jailbreak attempts, and high-severity AI security threats.",
+      "layer": "guardrail"
     },
     {
       "id": "tools",
       "name": "Tool Permissioning",
-      "description": "Control access to MCP tools, enforce risk scoring, and manage per-tool permissions."
+      "description": "Control access to MCP tools, enforce risk scoring, and manage per-tool permissions.",
+      "layer": "access"
     },
     {
       "id": "agent-security",
       "name": "Agent Security",
-      "description": "Detect tool poisoning, rug pull attacks, indirect prompt injection, and MCP supply chain threats."
+      "description": "Detect tool poisoning, rug pull attacks, indirect prompt injection, and MCP supply chain threats.",
+      "layer": "guardrail"
     },
     {
       "id": "data-protection",
       "name": "Data Protection",
-      "description": "Prevent secrets leakage in LLM chat completions and MCP operations."
+      "description": "Prevent secrets leakage in LLM chat completions and MCP operations.",
+      "layer": "guardrail"
     },
     {
       "id": "privacy",
       "name": "Privacy",
-      "description": "Block personally identifiable information (PII) in LLM prompts and MCP tool calls."
+      "description": "Block personally identifiable information (PII) in LLM prompts and MCP tool calls.",
+      "layer": "guardrail"
     },
     {
       "id": "organization",
       "name": "Organization",
-      "description": "Organization-wide baselines and default permit policies."
+      "description": "Organization-wide baselines and default permit policies.",
+      "layer": "access"
     }
   ],
   "defaults": [

package/dist/category-layers.gen.d.ts

@@ -0,0 +1,22 @@
+/**
+ * A policy's control layer.
+ *
+ * `access`    — may this agent take this action at all?
+ * `guardrail` — should this particular request go through?
+ */
+export type PolicyLayer = 'access' | 'guardrail';
+/**
+ * Resolve a policy or template category to its control layer.
+ *
+ * Normalizes separators, case and surrounding whitespace before looking
+ * up: the catalogues are kebab-case, but stored policy categories are
+ * not uniformly so, and an unnormalized lookup silently misses them.
+ *
+ * Returns `undefined` for a slug this package does not classify, so a
+ * caller renders nothing rather than a guessed layer.
+ */
+export declare function layerForCategory(category: string | null | undefined): PolicyLayer | undefined;
+/** Every slug this package classifies, canonical first. */
+export declare function knownCategorySlugs(): string[];
+/** True when the slug resolves only because it is a retired alias. */
+export declare function isRetiredCategory(category: string | null | undefined): boolean;

package/dist/category-layers.gen.js

@@ -0,0 +1,69 @@
+// Code generated by highflame-policy-codegen. DO NOT EDIT.
+// Source: `layer` on each category in schemas/*/templates/templates.json,
+//         plus RETIRED_CATEGORY_LAYERS in codegen/src/lib.rs
+//
+// The single source for "which control layer does this policy category
+// belong to?". Consumers must call layerForCategory rather than keeping a
+// private slug->layer table: this taxonomy is derived from the Cedar rule
+// heads in each template (only categories that grant are Access), and a
+// hand-maintained copy drifts the moment a category is added upstream.
+/** Layer for every category the catalogues currently define. */
+const CANONICAL = {
+    "agent-identity": 'guardrail',
+    "agent-security": 'guardrail',
+    "clipboard": 'guardrail',
+    "code-security": 'guardrail',
+    "content-safety": 'guardrail',
+    "data-protection": 'guardrail',
+    "organization": 'access',
+    "privacy": 'guardrail',
+    "sandbox": 'access',
+    "security": 'guardrail',
+    "semantic": 'guardrail',
+    "threat-detection": 'guardrail',
+    "tool-permissioning": 'access',
+    "tools": 'access',
+    "trust-safety": 'guardrail',
+};
+/**
+ * Layer for slugs no catalogue defines any more but which still tag live
+ * policies. Kept separate from CANONICAL so the canonical set stays
+ * exactly what the catalogues declare, and consulted second so that
+ * reviving a retired name upstream takes effect rather than being
+ * shadowed here.
+ */
+const RETIRED = {
+    "agentic-security": 'guardrail', // superseded by agent-security
+    "secrets": 'guardrail', // superseded by data-protection
+    "pii": 'guardrail', // superseded by privacy
+    "pii-types": 'guardrail', // superseded by privacy
+    "keyword-filter": 'guardrail', // superseded by content-safety
+    "file-safety": 'guardrail', // superseded by content-safety
+};
+/**
+ * Resolve a policy or template category to its control layer.
+ *
+ * Normalizes separators, case and surrounding whitespace before looking
+ * up: the catalogues are kebab-case, but stored policy categories are
+ * not uniformly so, and an unnormalized lookup silently misses them.
+ *
+ * Returns `undefined` for a slug this package does not classify, so a
+ * caller renders nothing rather than a guessed layer.
+ */
+export function layerForCategory(category) {
+    if (!category)
+        return undefined;
+    const slug = category.trim().toLowerCase().replace(/_/g, '-');
+    return CANONICAL[slug] ?? RETIRED[slug];
+}
+/** Every slug this package classifies, canonical first. */
+export function knownCategorySlugs() {
+    return [...Object.keys(CANONICAL), ...Object.keys(RETIRED)];
+}
+/** True when the slug resolves only because it is a retired alias. */
+export function isRetiredCategory(category) {
+    if (!category)
+        return false;
+    const slug = category.trim().toLowerCase().replace(/_/g, '-');
+    return !(slug in CANONICAL) && slug in RETIRED;
+}

package/dist/guardrails-defaults.gen.d.ts

@@ -10,6 +10,9 @@ export interface GuardrailsCategoryInfo {
     id: GuardrailsCategory;
     name: string;
     description: string;
+    /** Control layer: 'access' governs whether an action is permitted at
+     *  all; 'guardrail' governs whether a given request should pass. */
+    layer: 'access' | 'guardrail';
 }
 /**
  * A default policy that is auto-created for new projects.

package/dist/guardrails-defaults.gen.js

@@ -3455,14 +3455,14 @@ when {
 // CATEGORIES
 // =============================================================================
 export const GUARDRAILS_CATEGORIES = [
-    { id: 'security', name: 'Security', description: 'Block prompt injection, jailbreak attempts, path traversal, and SQL injection.' },
-    { id: 'privacy', name: 'Privacy', description: 'Block personally identifiable information (PII) in prompts and responses.' },
-    { id: 'data-protection', name: 'Data Protection', description: 'Block secrets, API keys, tokens, and bulk credential exposure.' },
-    { id: 'trust-safety', name: 'Trust & Safety', description: 'Block toxic, violent, hateful, sexual, or profane content; restrict regulated topics.' },
-    { id: 'tools', name: 'Tools', description: 'Per-tool MCP access control, org-wide server exclusions, unverified server blocks.' },
-    { id: 'agent-security', name: 'Agent Security', description: 'Block tool abuse, exfiltration patterns, loops, budget violations, tool poisoning, rug pull, and risky MCP configs.' },
-    { id: 'agent-identity', name: 'Agent Identity', description: 'Trust-based access control for AI agents — tiered permissions by trust level, autonomous agent restrictions, cross-turn session lockdowns.' },
-    { id: 'organization', name: 'Organization', description: 'Organization-wide baselines and default permit/deny policies.' },
+    { id: 'security', name: 'Security', description: 'Block prompt injection, jailbreak attempts, path traversal, and SQL injection.', layer: 'guardrail' },
+    { id: 'privacy', name: 'Privacy', description: 'Block personally identifiable information (PII) in prompts and responses.', layer: 'guardrail' },
+    { id: 'data-protection', name: 'Data Protection', description: 'Block secrets, API keys, tokens, and bulk credential exposure.', layer: 'guardrail' },
+    { id: 'trust-safety', name: 'Trust & Safety', description: 'Block toxic, violent, hateful, sexual, or profane content; restrict regulated topics.', layer: 'guardrail' },
+    { id: 'tools', name: 'Tools', description: 'Per-tool MCP access control, org-wide server exclusions, unverified server blocks.', layer: 'access' },
+    { id: 'agent-security', name: 'Agent Security', description: 'Block tool abuse, exfiltration patterns, loops, budget violations, tool poisoning, rug pull, and risky MCP configs.', layer: 'guardrail' },
+    { id: 'agent-identity', name: 'Agent Identity', description: 'Trust-based access control for AI agents — tiered permissions by trust level, autonomous agent restrictions, cross-turn session lockdowns.', layer: 'guardrail' },
+    { id: 'organization', name: 'Organization', description: 'Organization-wide baselines and default permit/deny policies.', layer: 'access' },
 ];
 // =============================================================================
 // DEFAULT POLICIES
@@ -3803,42 +3803,50 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
     {
       "id": "security",
       "name": "Security",
-      "description": "Block prompt injection, jailbreak attempts, path traversal, and SQL injection."
+      "description": "Block prompt injection, jailbreak attempts, path traversal, and SQL injection.",
+      "layer": "guardrail"
     },
     {
       "id": "privacy",
       "name": "Privacy",
-      "description": "Block personally identifiable information (PII) in prompts and responses."
+      "description": "Block personally identifiable information (PII) in prompts and responses.",
+      "layer": "guardrail"
     },
     {
       "id": "data-protection",
       "name": "Data Protection",
-      "description": "Block secrets, API keys, tokens, and bulk credential exposure."
+      "description": "Block secrets, API keys, tokens, and bulk credential exposure.",
+      "layer": "guardrail"
     },
     {
       "id": "trust-safety",
       "name": "Trust & Safety",
-      "description": "Block toxic, violent, hateful, sexual, or profane content; restrict regulated topics."
+      "description": "Block toxic, violent, hateful, sexual, or profane content; restrict regulated topics.",
+      "layer": "guardrail"
     },
     {
       "id": "tools",
       "name": "Tools",
-      "description": "Per-tool MCP access control, org-wide server exclusions, unverified server blocks."
+      "description": "Per-tool MCP access control, org-wide server exclusions, unverified server blocks.",
+      "layer": "access"
     },
     {
       "id": "agent-security",
       "name": "Agent Security",
-      "description": "Block tool abuse, exfiltration patterns, loops, budget violations, tool poisoning, rug pull, and risky MCP configs."
+      "description": "Block tool abuse, exfiltration patterns, loops, budget violations, tool poisoning, rug pull, and risky MCP configs.",
+      "layer": "guardrail"
     },
     {
       "id": "agent-identity",
       "name": "Agent Identity",
-      "description": "Trust-based access control for AI agents — tiered permissions by trust level, autonomous agent restrictions, cross-turn session lockdowns."
+      "description": "Trust-based access control for AI agents — tiered permissions by trust level, autonomous agent restrictions, cross-turn session lockdowns.",
+      "layer": "guardrail"
     },
     {
       "id": "organization",
       "name": "Organization",
-      "description": "Organization-wide baselines and default permit/deny policies."
+      "description": "Organization-wide baselines and default permit/deny policies.",
+      "layer": "access"
     }
   ],
   "defaults": [

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export * from './entities.gen.js';
 export * from './actions.gen.js';
 export * from './context.gen.js';
 export * from './schema.gen.js';
+export * from './category-layers.gen.js';
 export * from './decision-effects.gen.js';
 export * from './aarm-annotations.gen.js';
 export * from './aarm-annotation.js';

package/dist/index.js

@@ -9,6 +9,7 @@ export * from './context.gen.js';
 export * from './schema.gen.js';
 // Canonical decision-effect vocabulary (AARM R4 Wave A). Always emitted —
 // source is ALLOWED_DECISION_EFFECTS in codegen/src/lib.rs, not annotations.json.
+export * from './category-layers.gen.js';
 export * from './decision-effects.gen.js';
 // AARM-aware annotation registry (typed Cedar annotation vocabulary
 // Shield interprets at decision time; Studio/Admin use for lint).

package/dist/overwatch-defaults.gen.d.ts

@@ -10,6 +10,9 @@ export interface OverwatchCategoryInfo {
     id: OverwatchCategory;
     name: string;
     description: string;
+    /** Control layer: 'access' governs whether an action is permitted at
+     *  all; 'guardrail' governs whether a given request should pass. */
+    layer: 'access' | 'guardrail';
 }
 /**
  * A default policy that is auto-created for new projects.

package/dist/overwatch-defaults.gen.js

@@ -1823,14 +1823,14 @@ when {
 // CATEGORIES
 // =============================================================================
 export const OVERWATCH_CATEGORIES = [
-    { id: 'data-protection', name: 'Secrets & Data Protection', description: 'Block credential leakage and protect sensitive file paths.' },
-    { id: 'privacy', name: 'PII Detection', description: 'Block personally identifiable information across prompts, tool calls, and file operations.' },
-    { id: 'semantic', name: 'Semantic Threat Detection', description: 'Block injection attacks (SQL, path traversal, encoded), prompt injection, and jailbreak attempts.' },
-    { id: 'trust-safety', name: 'Content Safety', description: 'Block violent, hateful, sexual, criminal, or excessively profane content.' },
-    { id: 'tools', name: 'Tool Permissioning', description: 'Control shell execution, file operations, MCP servers, and sensitive system paths.' },
-    { id: 'agent-identity', name: 'Agent-Specific Guardrails', description: 'Per-agent security policies applied based on agent identity.' },
-    { id: 'agent-security', name: 'Agent Security', description: 'Block supply-chain attacks, malicious package installs, and code-agent-specific threats.' },
-    { id: 'organization', name: 'Organization', description: 'Organization-wide baselines, audit, and project-scoped permissions.' },
+    { id: 'data-protection', name: 'Secrets & Data Protection', description: 'Block credential leakage and protect sensitive file paths.', layer: 'guardrail' },
+    { id: 'privacy', name: 'PII Detection', description: 'Block personally identifiable information across prompts, tool calls, and file operations.', layer: 'guardrail' },
+    { id: 'semantic', name: 'Semantic Threat Detection', description: 'Block injection attacks (SQL, path traversal, encoded), prompt injection, and jailbreak attempts.', layer: 'guardrail' },
+    { id: 'trust-safety', name: 'Content Safety', description: 'Block violent, hateful, sexual, criminal, or excessively profane content.', layer: 'guardrail' },
+    { id: 'tools', name: 'Tool Permissioning', description: 'Control shell execution, file operations, MCP servers, and sensitive system paths.', layer: 'access' },
+    { id: 'agent-identity', name: 'Agent-Specific Guardrails', description: 'Per-agent security policies applied based on agent identity.', layer: 'guardrail' },
+    { id: 'agent-security', name: 'Agent Security', description: 'Block supply-chain attacks, malicious package installs, and code-agent-specific threats.', layer: 'guardrail' },
+    { id: 'organization', name: 'Organization', description: 'Organization-wide baselines, audit, and project-scoped permissions.', layer: 'access' },
 ];
 // =============================================================================
 // DEFAULT POLICIES
@@ -2036,42 +2036,50 @@ export const OVERWATCH_TEMPLATES_JSON = `{
     {
       "id": "data-protection",
       "name": "Secrets & Data Protection",
-      "description": "Block credential leakage and protect sensitive file paths."
+      "description": "Block credential leakage and protect sensitive file paths.",
+      "layer": "guardrail"
     },
     {
       "id": "privacy",
       "name": "PII Detection",
-      "description": "Block personally identifiable information across prompts, tool calls, and file operations."
+      "description": "Block personally identifiable information across prompts, tool calls, and file operations.",
+      "layer": "guardrail"
     },
     {
       "id": "semantic",
       "name": "Semantic Threat Detection",
-      "description": "Block injection attacks (SQL, path traversal, encoded), prompt injection, and jailbreak attempts."
+      "description": "Block injection attacks (SQL, path traversal, encoded), prompt injection, and jailbreak attempts.",
+      "layer": "guardrail"
     },
     {
       "id": "trust-safety",
       "name": "Content Safety",
-      "description": "Block violent, hateful, sexual, criminal, or excessively profane content."
+      "description": "Block violent, hateful, sexual, criminal, or excessively profane content.",
+      "layer": "guardrail"
     },
     {
       "id": "tools",
       "name": "Tool Permissioning",
-      "description": "Control shell execution, file operations, MCP servers, and sensitive system paths."
+      "description": "Control shell execution, file operations, MCP servers, and sensitive system paths.",
+      "layer": "access"
     },
     {
       "id": "agent-identity",
       "name": "Agent-Specific Guardrails",
-      "description": "Per-agent security policies applied based on agent identity."
+      "description": "Per-agent security policies applied based on agent identity.",
+      "layer": "guardrail"
     },
     {
       "id": "agent-security",
       "name": "Agent Security",
-      "description": "Block supply-chain attacks, malicious package installs, and code-agent-specific threats."
+      "description": "Block supply-chain attacks, malicious package installs, and code-agent-specific threats.",
+      "layer": "guardrail"
     },
     {
       "id": "organization",
       "name": "Organization",
-      "description": "Organization-wide baselines, audit, and project-scoped permissions."
+      "description": "Organization-wide baselines, audit, and project-scoped permissions.",
+      "layer": "access"
     }
   ],
   "defaults": [

package/dist/sentry-defaults.gen.d.ts

@@ -10,6 +10,9 @@ export interface SentryCategoryInfo {
     id: SentryCategory;
     name: string;
     description: string;
+    /** Control layer: 'access' governs whether an action is permitted at
+     *  all; 'guardrail' governs whether a given request should pass. */
+    layer: 'access' | 'guardrail';
 }
 /**
  * A default policy that is auto-created for new projects.

package/dist/sentry-defaults.gen.js

@@ -1227,12 +1227,12 @@ when {
 // CATEGORIES
 // =============================================================================
 export const SENTRY_CATEGORIES = [
-    { id: 'data-protection', name: 'Secrets & Data Protection', description: 'Block secrets, API keys, tokens, and credentials in messages and uploads.' },
-    { id: 'privacy', name: 'PII Detection', description: 'Block personally identifiable information across messages and uploads.' },
-    { id: 'semantic', name: 'Semantic Threat Detection', description: 'Block prompt injection, jailbreak attempts, and high-severity threats.' },
-    { id: 'trust-safety', name: 'Content Safety', description: 'Block violent, harmful, hateful, sexual, or profane content.' },
-    { id: 'clipboard', name: 'Clipboard Policy', description: 'Control paste operations into AI chat services.' },
-    { id: 'organization', name: 'Organization Rules', description: 'Organization-wide baselines and session-aware threat escalation.' },
+    { id: 'data-protection', name: 'Secrets & Data Protection', description: 'Block secrets, API keys, tokens, and credentials in messages and uploads.', layer: 'guardrail' },
+    { id: 'privacy', name: 'PII Detection', description: 'Block personally identifiable information across messages and uploads.', layer: 'guardrail' },
+    { id: 'semantic', name: 'Semantic Threat Detection', description: 'Block prompt injection, jailbreak attempts, and high-severity threats.', layer: 'guardrail' },
+    { id: 'trust-safety', name: 'Content Safety', description: 'Block violent, harmful, hateful, sexual, or profane content.', layer: 'guardrail' },
+    { id: 'clipboard', name: 'Clipboard Policy', description: 'Control paste operations into AI chat services.', layer: 'guardrail' },
+    { id: 'organization', name: 'Organization Rules', description: 'Organization-wide baselines and session-aware threat escalation.', layer: 'access' },
 ];
 // =============================================================================
 // DEFAULT POLICIES
@@ -1348,32 +1348,38 @@ export const SENTRY_TEMPLATES_JSON = `{
     {
       "id": "data-protection",
       "name": "Secrets & Data Protection",
-      "description": "Block secrets, API keys, tokens, and credentials in messages and uploads."
+      "description": "Block secrets, API keys, tokens, and credentials in messages and uploads.",
+      "layer": "guardrail"
     },
     {
       "id": "privacy",
       "name": "PII Detection",
-      "description": "Block personally identifiable information across messages and uploads."
+      "description": "Block personally identifiable information across messages and uploads.",
+      "layer": "guardrail"
     },
     {
       "id": "semantic",
       "name": "Semantic Threat Detection",
-      "description": "Block prompt injection, jailbreak attempts, and high-severity threats."
+      "description": "Block prompt injection, jailbreak attempts, and high-severity threats.",
+      "layer": "guardrail"
     },
     {
       "id": "trust-safety",
       "name": "Content Safety",
-      "description": "Block violent, harmful, hateful, sexual, or profane content."
+      "description": "Block violent, harmful, hateful, sexual, or profane content.",
+      "layer": "guardrail"
     },
     {
       "id": "clipboard",
       "name": "Clipboard Policy",
-      "description": "Control paste operations into AI chat services."
+      "description": "Control paste operations into AI chat services.",
+      "layer": "guardrail"
     },
     {
       "id": "organization",
       "name": "Organization Rules",
-      "description": "Organization-wide baselines and session-aware threat escalation."
+      "description": "Organization-wide baselines and session-aware threat escalation.",
+      "layer": "access"
     }
   ],
   "defaults": [

package/dist/types.d.ts

@@ -2,6 +2,7 @@ export * from './entities.gen.js';
 export * from './actions.gen.js';
 export * from './context.gen.js';
 export * from './schema.gen.js';
+export * from './category-layers.gen.js';
 export * from './decision-effects.gen.js';
 export * from './aarm-annotations.gen.js';
 export * from './aarm-annotation.js';

package/dist/types.js

@@ -11,6 +11,7 @@ export * from './context.gen.js';
 export * from './schema.gen.js';
 // Canonical decision-effect vocabulary (browser-safe). Studio's Monaco
 // policy editor imports these typed symbols rather than string literals.
+export * from './category-layers.gen.js';
 export * from './decision-effects.gen.js';
 // AARM-aware annotation registry (browser-safe — Studio uses this
 // for Monaco autocomplete + lint of @step_up_required / @defer_* keys).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.2.38",
+  "version": "2.2.39",
   "engines": {
     "node": ">=18"
   },