@highflame/policy 2.2.40 → 2.2.42

package/_schemas/agent_ops/templates/ported/organization/organization_deny_baseline.cedar

@@ -10,8 +10,8 @@
 // =============================================================================
 
 @id("organization.deny-baseline")
-@name("Block all actions (deny baseline)")
-@description("Blocks all actions; pair with scoped permit rules for a deny-by-default posture.")
+@name("Block all actions (kill switch)")
+@description("Blocks all actions unconditionally. A kill switch, not a baseline: forbid beats permit in Cedar, so this also disables every permit in the set.")
 @severity("high")
 @tags("category:organization,posture:deny-default,scope:org-wide")
 @reject_message("Request blocked: this organization uses a deny-by-default baseline — only explicitly permitted actions are allowed.")

package/_schemas/agent_ops/templates/ported/tool-permissioning/tools_mcp_server_allowlist.cedar

@@ -2,8 +2,23 @@
 // MCP Server Allowlist
 // =============================================================================
 // Restricts MCP server connections to a pre-approved list. Customize the
-// `context.mcp_server` values in the permit rule to match the allowed
-// servers for your environment.
+// `context.mcp_server` values to match the allowed servers for your
+// environment — the SAME list appears in both rules and both must be edited.
+//
+// Both rules are conditional on the allowlist, and both are needed:
+//
+//   permit ... when   { allowlisted }  grants access; Cedar is default-deny,
+//                                      so without this nothing allows the
+//                                      allowlisted servers either.
+//   forbid ... unless { allowlisted }  claws back everything else, including
+//                                      when a broad Baseline Permit is loaded.
+//
+// The forbid MUST carry the negation. `forbid` always beats `permit` in Cedar,
+// so an UNCONDITIONAL forbid denies the allowlisted servers too — which is
+// what this template used to do (highflame-policy#186).
+//
+// The `context has mcp_server` guard stays inside both conditions: a request
+// naming no server cannot be on the allowlist, so it is denied.
 //
 // Context keys consumed:
 //   - mcp_server: String
@@ -30,7 +45,7 @@ when {
 
 @id("tools.deny-non-allowlisted-mcp")
 @name("Block non-allowlisted MCP servers")
-@description("Blocks connect_server unconditionally so only the allowlist permit applies.")
+@description("Blocks connect_server unless mcp_server is in the allowlist.")
 @severity("medium")
 @tags("category:tools,surface:connect-server,scope:org-wide,posture:deny-default")
 @reject_message("MCP server connection blocked: server is not on the allowlist.")
@@ -38,4 +53,9 @@ forbid (
     principal,
     action == AgentOps::Action::"connect_server",
     resource
-);
+)
+unless {
+    context has mcp_server &&
+        (context.mcp_server == "filesystem" ||
+         context.mcp_server == "playwright")
+};

package/_schemas/ai_gateway/context.json

@@ -779,6 +779,306 @@
         }
       ]
     },
+    {
+      "name": "list",
+      "description": "Enumerate a server's tools, prompts, or resources — threat focus: tool poisoning and rug pull in the returned descriptions",
+      "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011)."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011)."
+        },
+        {
+          "key": "content",
+          "type": "string",
+          "required": false,
+          "description": "The enumerated item's description — the text scanned for poisoning. Absent when the item declares none."
+        },
+        {
+          "key": "mcp_server",
+          "type": "string",
+          "required": false,
+          "description": "MCP server being enumerated"
+        },
+        {
+          "key": "tool_name",
+          "type": "string",
+          "required": false,
+          "description": "Name of the enumerated item being evaluated"
+        },
+        {
+          "key": "tool_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Tool risk score"
+        },
+        {
+          "key": "tool_category",
+          "type": "string",
+          "required": false,
+          "description": "\"safe\", \"sensitive\", \"dangerous\""
+        },
+        {
+          "key": "tool_is_sensitive",
+          "type": "boolean",
+          "required": false,
+          "description": "Tool is sensitive"
+        },
+        {
+          "key": "tool_is_builtin",
+          "type": "boolean",
+          "required": false,
+          "description": "Tool is builtin"
+        },
+        {
+          "key": "tool_operation_classes",
+          "type": "array",
+          "required": false,
+          "description": "Tool operation classes"
+        },
+        {
+          "key": "threat_count",
+          "type": "number",
+          "required": false,
+          "description": "Total threats detected"
+        },
+        {
+          "key": "highest_severity",
+          "type": "string",
+          "required": false,
+          "description": "Highest threat severity"
+        },
+        {
+          "key": "threat_categories",
+          "type": "array",
+          "required": false,
+          "description": "Threat category names"
+        },
+        {
+          "key": "detected_threats",
+          "type": "array",
+          "required": false,
+          "description": "Detection rule names that matched"
+        },
+        {
+          "key": "max_threat_severity",
+          "type": "number",
+          "required": false,
+          "description": "Numeric severity (0=none, 4=critical)"
+        },
+        {
+          "key": "tool_poisoning_score",
+          "type": "number",
+          "required": false,
+          "description": "Hidden instructions in a tool description"
+        },
+        {
+          "key": "tool_poisoning_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Hidden instructions found in the description"
+        },
+        {
+          "key": "rug_pull_score",
+          "type": "number",
+          "required": false,
+          "description": "Description drift after trust establishment"
+        },
+        {
+          "key": "rug_pull_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Description drifted after trust was established"
+        },
+        {
+          "key": "indirect_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Indirect injection score"
+        },
+        {
+          "key": "injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Prompt injection classifier confidence (0-100)"
+        },
+        {
+          "key": "jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Jailbreak classifier confidence (0-100)"
+        },
+        {
+          "key": "secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether secrets were detected in the description"
+        },
+        {
+          "key": "secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Secret types detected"
+        },
+        {
+          "key": "secret_count",
+          "type": "number",
+          "required": false,
+          "description": "Number of secrets detected"
+        },
+        {
+          "key": "pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether PII was detected"
+        },
+        {
+          "key": "pii_types",
+          "type": "array",
+          "required": false,
+          "description": "PII types detected"
+        },
+        {
+          "key": "pii_count",
+          "type": "number",
+          "required": false,
+          "description": "Number of PII entities"
+        },
+        {
+          "key": "pii_score",
+          "type": "number",
+          "required": false,
+          "description": "PII confidence (0-100)"
+        },
+        {
+          "key": "mcp_server_verified",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the server is from a verified registry"
+        },
+        {
+          "key": "mcp_config_risk",
+          "type": "boolean",
+          "required": false,
+          "description": "Server config flagged risky"
+        },
+        {
+          "key": "mcp_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Server risk score (0-100)"
+        },
+        {
+          "key": "session_threat_turns",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated threat turns across prior turns"
+        },
+        {
+          "key": "session_cumulative_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated cumulative risk score across prior turns"
+        },
+        {
+          "key": "session_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Session-aggregated injection detected across prior turns"
+        },
+        {
+          "key": "session_command_injection",
+          "type": "boolean",
+          "required": false,
+          "description": "Session-aggregated command injection across prior turns"
+        },
+        {
+          "key": "session_pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Session-aggregated pii detected across prior turns"
+        },
+        {
+          "key": "session_pii_types",
+          "type": "array",
+          "required": false,
+          "description": "Session-aggregated pii types across prior turns"
+        },
+        {
+          "key": "session_secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Session-aggregated secrets detected across prior turns"
+        },
+        {
+          "key": "session_secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Session-aggregated secret types across prior turns"
+        },
+        {
+          "key": "session_max_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated max injection score across prior turns"
+        },
+        {
+          "key": "session_max_jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated max jailbreak score across prior turns"
+        },
+        {
+          "key": "session_max_command_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated max command injection score across prior turns"
+        },
+        {
+          "key": "session_max_pii_score",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated max pii score across prior turns"
+        },
+        {
+          "key": "session_max_secret_score",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated max secret score across prior turns"
+        },
+        {
+          "key": "rpm_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Requests-per-minute headroom remaining"
+        },
+        {
+          "key": "rpm_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "RPM limit exceeded"
+        },
+        {
+          "key": "tpm_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Tokens-per-minute headroom remaining"
+        },
+        {
+          "key": "tpm_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "TPM limit exceeded"
+        }
+      ]
+    },
     {
       "name": "process_prompt",
       "description": "Process a prompt (MCP or LLM chat completion) — threat focus: injection, jailbreak, secrets, PII, content safety",