@highflame/policy 2.2.4 → 2.2.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.2.4",
+  "version": "2.2.6",
   "engines": {
     "node": ">=18"
   },

package/_schemas/ai_gateway/templates/pii_redaction.cedar

@@ -1,94 +0,0 @@
-// =============================================================================
-// PII & Secrets Redaction
-// =============================================================================
-// Blocks AI Gateway operations when personally identifiable information or
-// secrets are detected in the content. Covers both LLM prompt processing
-// and MCP tool calls, plus a bulk-exposure catch-all.
-//
-// Context keys consumed:
-//   - pii_detected:      Bool
-//   - secrets_detected:  Bool
-//   - pii_count:         Long
-//
-// Compliance:
-//   - OWASP LLM06
-//   - GDPR, HIPAA (depending on data classification)
-//
-// Category:  data-protection
-// Namespace: AIGateway
-// =============================================================================
-
-@id("data-protection.block-pii")
-@name("Block PII in prompts")
-@description("Blocks process_prompt when pii_detected is true.")
-@severity("high")
-@tags("category:data-protection,threat:pii,detection:rule,surface:process-prompt,owasp:llm06")
-@reject_message("Prompt blocked: personally identifiable information was detected — remove sensitive data and retry.")
-forbid (
-    principal,
-    action == AIGateway::Action::"process_prompt",
-    resource
-)
-when {
-    context has pii_detected && context.pii_detected == true
-};
-
-@id("data-protection.block-secrets")
-@name("Block secrets in prompts")
-@description("Blocks process_prompt when secrets_detected is true.")
-@severity("critical")
-@tags("category:data-protection,threat:secrets,detection:rule,surface:process-prompt")
-@reject_message("Prompt blocked: secrets or credentials were detected — remove sensitive data and retry.")
-forbid (
-    principal,
-    action == AIGateway::Action::"process_prompt",
-    resource
-)
-when {
-    context has secrets_detected && context.secrets_detected == true
-};
-
-@id("data-protection.block-pii-tools")
-@name("Block PII in tool calls")
-@description("Blocks call_tool when pii_detected is true.")
-@severity("high")
-@tags("category:data-protection,threat:pii,detection:rule,surface:call-tool,owasp:llm06")
-@reject_message("Tool execution blocked: personally identifiable information was detected in tool arguments.")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has pii_detected && context.pii_detected == true
-};
-
-@id("data-protection.block-secrets-tools")
-@name("Block secrets in tool calls")
-@description("Blocks call_tool when secrets_detected is true.")
-@severity("critical")
-@tags("category:data-protection,threat:secrets,detection:rule,surface:call-tool")
-@reject_message("Tool execution blocked: secrets or credentials were detected in tool arguments.")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has secrets_detected && context.secrets_detected == true
-};
-
-@id("data-protection.block-pii-bulk")
-@name("Block bulk PII exposure")
-@description("Blocks any action when pii_count >= 3.")
-@severity("critical")
-@tags("category:data-protection,threat:exfiltration,detection:aggregate,posture:catch-all")
-@reject_message("Request blocked: multiple PII matches were detected — possible data exfiltration.")
-forbid (
-    principal,
-    action,
-    resource
-)
-when {
-    context has pii_count && context.pii_count >= 3
-};

package/_schemas/guardrails/templates/profiles/chat_assistant/privacy.cedar

@@ -1,35 +0,0 @@
-// =============================================================================
-// Chat Assistant — Privacy
-// =============================================================================
-// PII protection for customer-facing chatbots. Blocks PII in both directions
-// (input + output) across prompts, tool calls, and file operations.
-//
-// Context keys consumed:
-//   - pii_detected: Bool
-//
-// Compliance:
-//   - GDPR Art. 32, HIPAA, PCI-DSS
-//
-// Category:  privacy
-// Namespace: Guardrails
-// =============================================================================
-
-@id("privacy.chat-block-pii")
-@name("Block PII in chat (both directions)")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when pii_detected is true.")
-@severity("high")
-@tags("category:privacy,threat:pii,detection:rule,compliance:gdpr,compliance:hipaa")
-@reject_message("Request blocked: personally identifiable information was detected.")
-forbid (
-    principal,
-    action in [
-        Guardrails::Action::"process_prompt",
-        Guardrails::Action::"call_tool",
-        Guardrails::Action::"read_file",
-        Guardrails::Action::"write_file"
-    ],
-    resource
-)
-when {
-    context has pii_detected && context.pii_detected == true
-};

package/_schemas/guardrails/templates/profiles/data_pipeline/privacy.cedar

@@ -1,63 +0,0 @@
-// =============================================================================
-// Data Pipeline — Privacy
-// =============================================================================
-// Strict PII protection for RAG pipelines and data processing agents.
-// Zero-tolerance for sensitive PII types — data pipelines must not leak PII.
-//
-// Context keys consumed:
-//   - pii_detected: Bool
-//   - pii_types:    Set<String>
-//
-// Compliance:
-//   - GDPR Art. 32, HIPAA §164.312, PCI DSS 3.4
-//
-// Category:  privacy
-// Namespace: Guardrails
-// =============================================================================
-
-@id("privacy.data-pipeline-block-pii")
-@name("Block PII in data pipeline")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when pii_detected is true.")
-@severity("critical")
-@tags("category:privacy,threat:pii,detection:rule,compliance:gdpr,compliance:hipaa")
-@reject_message("Request blocked: PII detected in a data pipeline — pipelines must not process or leak personal data.")
-forbid (
-    principal,
-    action in [
-        Guardrails::Action::"process_prompt",
-        Guardrails::Action::"call_tool",
-        Guardrails::Action::"read_file",
-        Guardrails::Action::"write_file"
-    ],
-    resource
-)
-when {
-    context has pii_detected && context.pii_detected == true
-};
-
-@id("privacy.data-pipeline-block-pii-sensitive")
-@name("Block sensitive PII types in data pipeline")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when pii_types contains SSN, credit_card, passport, medical_id, or tax_id.")
-@severity("critical")
-@tags("category:privacy,threat:pii,detection:rule,compliance:gdpr,compliance:hipaa,compliance:pci-dss")
-@reject_message("Request blocked: highly sensitive PII (SSN, credit card, passport, medical ID, or tax ID) detected in a data pipeline.")
-forbid (
-    principal,
-    action in [
-        Guardrails::Action::"process_prompt",
-        Guardrails::Action::"call_tool",
-        Guardrails::Action::"read_file",
-        Guardrails::Action::"write_file"
-    ],
-    resource
-)
-when {
-    context has pii_types &&
-    (
-        context.pii_types.contains("ssn") ||
-        context.pii_types.contains("credit_card") ||
-        context.pii_types.contains("passport") ||
-        context.pii_types.contains("medical_id") ||
-        context.pii_types.contains("tax_id")
-    )
-};