@highflame/policy 2.2.4 → 2.2.5

package/_schemas/guardrails/templates/templates.json

@@ -83,16 +83,44 @@
       "category": "security",
       "file": "defaults/injection.cedar",
       "severity": "high",
-      "tags": ["category:security", "threat:injection", "threat:jailbreak", "detection:ml", "owasp:llm01", "owasp:llm02"]
+      "tags": [
+        "category:security",
+        "threat:injection",
+        "threat:jailbreak",
+        "detection:ml",
+        "owasp:llm01",
+        "owasp:llm02"
+      ]
     },
     {
       "id": "privacy.defaults",
-      "name": "PII Detection",
-      "description": "Block LLM outputs containing PII, with a stricter rule for SSN, credit card, and passport numbers.",
+      "name": "Structural PII",
+      "description": "Block well-formatted sensitive identifiers — SSNs, credit cards, IBANs, API keys — via fast deterministic pattern matching. High precision, low latency, few false positives; use as the always-on baseline.",
       "category": "privacy",
       "file": "defaults/pii.cedar",
       "severity": "critical",
-      "tags": ["category:privacy", "threat:pii", "compliance:gdpr", "compliance:hipaa", "compliance:pci-dss"]
+      "tags": [
+        "category:privacy",
+        "threat:pii",
+        "detection:pattern",
+        "compliance:pci-dss",
+        "compliance:hipaa"
+      ]
+    },
+    {
+      "id": "privacy.pii-model",
+      "name": "Contextual PII",
+      "description": "Block the same sensitive identifiers when the ML model infers them from surrounding context — catches unstructured or novel PII the structural patterns miss. Higher recall; requires the pii_model detector.",
+      "category": "privacy",
+      "file": "defaults/pii_model.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:privacy",
+        "threat:pii",
+        "detection:ml",
+        "compliance:pci-dss",
+        "compliance:hipaa"
+      ]
     },
     {
       "id": "trust-safety.toxicity",
@@ -101,7 +129,13 @@
       "category": "trust-safety",
       "file": "defaults/toxicity.cedar",
       "severity": "critical",
-      "tags": ["category:trust-safety", "threat:harmful", "threat:hate-speech", "detection:ml", "compliance:eu-ai-act"]
+      "tags": [
+        "category:trust-safety",
+        "threat:harmful",
+        "threat:hate-speech",
+        "detection:ml",
+        "compliance:eu-ai-act"
+      ]
     },
     {
       "id": "agent-security.tool-risk",
@@ -110,7 +144,12 @@
       "category": "agent-security",
       "file": "defaults/tool_risk.cedar",
       "severity": "critical",
-      "tags": ["category:agent-security", "threat:command-injection", "owasp:llm06", "owasp:asi02"]
+      "tags": [
+        "category:agent-security",
+        "threat:command-injection",
+        "owasp:llm06",
+        "owasp:asi02"
+      ]
     },
     {
       "id": "agent-security.defaults",
@@ -119,7 +158,15 @@
       "category": "agent-security",
       "file": "defaults/agentic_safety.cedar",
       "severity": "critical",
-      "tags": ["category:agent-security", "threat:loop", "threat:exfiltration", "threat:tool-poisoning", "threat:rug-pull", "owasp:asi01", "owasp:asi04"]
+      "tags": [
+        "category:agent-security",
+        "threat:loop",
+        "threat:exfiltration",
+        "threat:tool-poisoning",
+        "threat:rug-pull",
+        "owasp:asi01",
+        "owasp:asi04"
+      ]
     },
     {
       "id": "security.patterns",
@@ -128,7 +175,14 @@
       "category": "security",
       "file": "defaults/security_patterns.cedar",
       "severity": "critical",
-      "tags": ["category:security", "threat:command-injection", "threat:sql-injection", "threat:path-traversal", "detection:pattern", "mitre:t1059"]
+      "tags": [
+        "category:security",
+        "threat:command-injection",
+        "threat:sql-injection",
+        "threat:path-traversal",
+        "detection:pattern",
+        "mitre:t1059"
+      ]
     },
     {
       "id": "trust-safety.semantic",
@@ -137,7 +191,13 @@
       "category": "trust-safety",
       "file": "defaults/semantic.cedar",
       "severity": "critical",
-      "tags": ["category:trust-safety", "threat:harmful", "detection:ml", "compliance:eu-ai-act", "compliance:iso-42001"]
+      "tags": [
+        "category:trust-safety",
+        "threat:harmful",
+        "detection:ml",
+        "compliance:eu-ai-act",
+        "compliance:iso-42001"
+      ]
     },
     {
       "id": "agent-identity.defaults",
@@ -164,16 +224,12 @@
       "category": "security",
       "file": "profiles/chat_assistant/security.cedar",
       "severity": "high",
-      "tags": ["category:security", "threat:injection", "threat:jailbreak", "detection:ml"]
-    },
-    {
-      "id": "privacy.chat-block-pii",
-      "name": "Chat Assistant — Privacy",
-      "description": "Block PII in both user inputs and assistant outputs for chat applications.",
-      "category": "privacy",
-      "file": "profiles/chat_assistant/privacy.cedar",
-      "severity": "high",
-      "tags": ["category:privacy", "threat:pii", "compliance:gdpr"]
+      "tags": [
+        "category:security",
+        "threat:injection",
+        "threat:jailbreak",
+        "detection:ml"
+      ]
     },
     {
       "id": "trust-safety.chat-assistant",
@@ -182,7 +238,11 @@
       "category": "trust-safety",
       "file": "profiles/chat_assistant/trust_safety.cedar",
       "severity": "critical",
-      "tags": ["category:trust-safety", "threat:harmful", "compliance:eu-ai-act"]
+      "tags": [
+        "category:trust-safety",
+        "threat:harmful",
+        "compliance:eu-ai-act"
+      ]
     },
     {
       "id": "data-protection.code-block-write-secrets",
@@ -200,7 +260,11 @@
       "category": "security",
       "file": "profiles/code_agent/encoding.cedar",
       "severity": "critical",
-      "tags": ["category:security", "threat:invisible-chars", "threat:injection"]
+      "tags": [
+        "category:security",
+        "threat:invisible-chars",
+        "threat:injection"
+      ]
     },
     {
       "id": "security.code-agent-path-security",
@@ -218,7 +282,12 @@
       "category": "agent-security",
       "file": "profiles/code_agent/agentic_security.cedar",
       "severity": "critical",
-      "tags": ["category:agent-security", "threat:exfiltration", "threat:loop", "owasp:llm06"]
+      "tags": [
+        "category:agent-security",
+        "threat:exfiltration",
+        "threat:loop",
+        "owasp:llm06"
+      ]
     },
     {
       "id": "agent-security.code-agent-supply-chain",
@@ -227,16 +296,14 @@
       "category": "agent-security",
       "file": "profiles/code_agent/supply_chain.cedar",
       "severity": "critical",
-      "tags": ["category:agent-security", "threat:tool-poisoning", "threat:indirect-injection", "threat:exfiltration", "owasp:asi01", "owasp:asi04"]
-    },
-    {
-      "id": "privacy.data-pipeline",
-      "name": "Data Pipeline — Privacy",
-      "description": "Strict PII protection with zero tolerance for sensitive PII types in data pipelines.",
-      "category": "privacy",
-      "file": "profiles/data_pipeline/privacy.cedar",
-      "severity": "critical",
-      "tags": ["category:privacy", "threat:pii", "compliance:gdpr", "compliance:hipaa"]
+      "tags": [
+        "category:agent-security",
+        "threat:tool-poisoning",
+        "threat:indirect-injection",
+        "threat:exfiltration",
+        "owasp:asi01",
+        "owasp:asi04"
+      ]
     },
     {
       "id": "data-protection.data-pipeline",
@@ -272,7 +339,12 @@
       "category": "agent-identity",
       "file": "profiles/multi_agent/agent_trust.cedar",
       "severity": "critical",
-      "tags": ["category:agent-identity", "scope:per-agent", "owasp:llm01", "owasp:llm02"]
+      "tags": [
+        "category:agent-identity",
+        "scope:per-agent",
+        "owasp:llm01",
+        "owasp:llm02"
+      ]
     },
     {
       "id": "agent-identity.multi-agent-safety",
@@ -281,7 +353,13 @@
       "category": "agent-identity",
       "file": "profiles/multi_agent/agent_safety.cedar",
       "severity": "critical",
-      "tags": ["category:agent-identity", "scope:per-agent", "threat:pii", "threat:secrets", "threat:injection"]
+      "tags": [
+        "category:agent-identity",
+        "scope:per-agent",
+        "threat:pii",
+        "threat:secrets",
+        "threat:injection"
+      ]
     },
     {
       "id": "agent-identity.a2a-cross-origin",
@@ -290,7 +368,12 @@
       "category": "agent-identity",
       "file": "profiles/a2a_security/cross_origin.cedar",
       "severity": "critical",
-      "tags": ["category:agent-identity", "threat:supply-chain", "owasp:llm08", "owasp:asi03"]
+      "tags": [
+        "category:agent-identity",
+        "threat:supply-chain",
+        "owasp:llm08",
+        "owasp:asi03"
+      ]
     },
     {
       "id": "agent-identity.a2a-inter-agent-injection",
@@ -299,7 +382,12 @@
       "category": "agent-identity",
       "file": "profiles/a2a_security/inter_agent_injection.cedar",
       "severity": "critical",
-      "tags": ["category:agent-identity", "threat:indirect-injection", "threat:encoded-payload", "owasp:llm01"]
+      "tags": [
+        "category:agent-identity",
+        "threat:indirect-injection",
+        "threat:encoded-payload",
+        "owasp:llm01"
+      ]
     },
     {
       "id": "agent-identity.a2a-supply-chain",
@@ -308,7 +396,13 @@
       "category": "agent-identity",
       "file": "profiles/a2a_security/supply_chain.cedar",
       "severity": "critical",
-      "tags": ["category:agent-identity", "threat:tool-poisoning", "threat:rug-pull", "threat:exfiltration", "owasp:asi04"]
+      "tags": [
+        "category:agent-identity",
+        "threat:tool-poisoning",
+        "threat:rug-pull",
+        "threat:exfiltration",
+        "owasp:asi04"
+      ]
     },
     {
       "id": "agent-identity.a2a-identity-enforcement",
@@ -317,7 +411,12 @@
       "category": "agent-identity",
       "file": "profiles/a2a_security/identity_enforcement.cedar",
       "severity": "critical",
-      "tags": ["category:agent-identity", "threat:spoofing", "scope:per-agent", "owasp:asi04"]
+      "tags": [
+        "category:agent-identity",
+        "threat:spoofing",
+        "scope:per-agent",
+        "owasp:asi04"
+      ]
     },
     {
       "id": "agent-identity.a2a-escalation",
@@ -326,7 +425,12 @@
       "category": "agent-identity",
       "file": "profiles/a2a_security/escalation_detection.cedar",
       "severity": "critical",
-      "tags": ["category:agent-identity", "threat:escalation", "scope:per-agent", "owasp:llm01"]
+      "tags": [
+        "category:agent-identity",
+        "threat:escalation",
+        "scope:per-agent",
+        "owasp:llm01"
+      ]
     },
     {
       "id": "data-protection.advanced-secrets",
@@ -339,12 +443,18 @@
     },
     {
       "id": "privacy.advanced-pii",
-      "name": "Advanced Detection — PII",
-      "description": "Bulk PII exposure threshold, ML classifier confidence, and file-operation blocking.",
+      "name": "Comprehensive PII",
+      "description": "Block every PII type — structural and contextual, sensitive and situational. Situational entities (names, locations, dates, etc.) are real PII but appear in ordinary text, so this tier flags often; one forbid rule per entity lets you disable the ones you don't need. Opt-in for strict environments.",
       "category": "privacy",
       "file": "profiles/advanced_detection/pii.cedar",
       "severity": "critical",
-      "tags": ["category:privacy", "threat:pii", "threat:exfiltration", "detection:ml", "compliance:gdpr"]
+      "tags": [
+        "category:privacy",
+        "threat:pii",
+        "detection:pattern",
+        "compliance:pci-dss",
+        "compliance:hipaa"
+      ]
     },
     {
       "id": "security.advanced-block-critical-severity",
@@ -362,7 +472,12 @@
       "category": "agent-security",
       "file": "param_validation.cedar",
       "severity": "high",
-      "tags": ["category:agent-security", "surface:call-tool", "aarm:r3", "posture:deny-default"]
+      "tags": [
+        "category:agent-security",
+        "surface:call-tool",
+        "aarm:r3",
+        "posture:deny-default"
+      ]
     }
   ]
 }

package/_schemas/sentry/templates/defaults/clipboard.cedar

@@ -2,8 +2,9 @@
 // Clipboard Policy (Default)
 // =============================================================================
 // Controls paste operations into AI chat services. Covers blanket paste
-// blocking, paste-with-secrets, paste-with-PII, encoded payload pastes, and
-// pastes containing invisible Unicode characters.
+// blocking, paste-with-secrets, encoded payload pastes, and pastes containing
+// invisible Unicode characters. PII pastes are handled by the canonical
+// privacy.* templates (defaults/pii*.cedar), which scope to paste_content.
 //
 // All rules scope to action == "paste_content". Other templates
 // (semantic, content_safety, pii, secrets) cover process_prompt and
@@ -11,7 +12,6 @@
 //
 // Context keys consumed:
 //   - secrets_detected:           Bool
-//   - pii_detected:               Bool
 //   - encoded_content_detected:   Bool
 //   - encoded_score:              Long (0-100)
 //   - invisible_chars_detected:   Bool
@@ -51,21 +51,6 @@ when {
     context has secrets_detected && context.secrets_detected == true
 };
 
-@id("clipboard.block-paste-pii")
-@name("Block paste with PII")
-@description("Blocks paste_content when pii_detected is true.")
-@severity("critical")
-@tags("category:clipboard,threat:pii,detection:rule,compliance:gdpr")
-@reject_message("Paste blocked: personally identifiable information detected in pasted content.")
-forbid (
-    principal,
-    action == Sentry::Action::"paste_content",
-    resource
-)
-when {
-    context has pii_detected && context.pii_detected == true
-};
-
 @id("clipboard.block-paste-encoded")
 @name("Block paste with encoded payloads")
 @description("Blocks paste_content when encoded_content_detected is true and encoded_score >= 60.")

package/_schemas/sentry/templates/defaults/file_safety.cedar

@@ -2,11 +2,11 @@
 // File & Attachment Safety (Default)
 // =============================================================================
 // Blocks file uploads to AI chat services when document content contains
-// secrets or PII.
+// secrets. PII in uploads is handled by the canonical privacy.* templates
+// (defaults/pii*.cedar), which scope to upload_file.
 //
 // Context keys consumed:
 //   - secrets_detected: Bool
-//   - pii_detected:     Bool
 //
 // Compliance:
 //   - NIST 800-53 SC-28; GDPR Art. 32
@@ -29,18 +29,3 @@ forbid (
 when {
     context has secrets_detected && context.secrets_detected == true
 };
-
-@id("file-safety.block-upload-pii")
-@name("Block file uploads with PII")
-@description("Blocks upload_file when pii_detected is true.")
-@severity("critical")
-@tags("category:file-safety,threat:pii,detection:rule,surface:upload-file,compliance:gdpr")
-@reject_message("File upload blocked: personally identifiable information detected in document content.")
-forbid (
-    principal,
-    action == Sentry::Action::"upload_file",
-    resource
-)
-when {
-    context has pii_detected && context.pii_detected == true
-};