@highflame/policy 2.2.40 → 2.2.42

package/_schemas/overwatch/schema.cedarschema

@@ -151,6 +151,24 @@ action process_prompt appliesTo {
     // --- Legacy ---
     prompt_text?: String,             // Same as content (backward compatibility)
     response_content?: String,        // Response content (if available)
+    // --- Session Token Budget --- (OWASP LLM10; CAP-ENF-009, cerberus#147)
+    // Fed by the cumulative session total the Overwatch daemon reports on the
+    // prompt and before-tool events.
+    //
+    // BOTH are optional, so BOTH need a `has` guard — a bare
+    // `context.budget_remaining_pct < 10` fails cedar validation with
+    // "unable to guarantee safety of access to optional attribute".
+    // Write: `context has budget_remaining_pct && context.budget_remaining_pct < 10`.
+    //
+    // The guard is a validation requirement, NOT a safety property. Whenever a
+    // session loads, budget_checker emits both keys — including
+    // budget_exceeded: false and budget_remaining_pct: 100 when no budget rule
+    // is configured for the scope. So a grant conditioned on
+    // `!context.budget_exceeded` fires on unbudgeted sessions, and a low
+    // percentage is evidence of spend only when a budget rule exists. Absence
+    // means the detector did not run at all (no session).
+    budget_remaining_pct?: Long,      // Remaining session token budget (0-100)
+    budget_exceeded?: Bool,           // Session token budget exceeded
   },
 };
 
@@ -270,6 +288,24 @@ action call_tool appliesTo {
 
     // --- Legacy ---
     response_content?: String,
+    // --- Session Token Budget --- (OWASP LLM10; CAP-ENF-009, cerberus#147)
+    // Fed by the cumulative session total the Overwatch daemon reports on the
+    // prompt and before-tool events.
+    //
+    // BOTH are optional, so BOTH need a `has` guard — a bare
+    // `context.budget_remaining_pct < 10` fails cedar validation with
+    // "unable to guarantee safety of access to optional attribute".
+    // Write: `context has budget_remaining_pct && context.budget_remaining_pct < 10`.
+    //
+    // The guard is a validation requirement, NOT a safety property. Whenever a
+    // session loads, budget_checker emits both keys — including
+    // budget_exceeded: false and budget_remaining_pct: 100 when no budget rule
+    // is configured for the scope. So a grant conditioned on
+    // `!context.budget_exceeded` fires on unbudgeted sessions, and a low
+    // percentage is evidence of spend only when a budget rule exists. Absence
+    // means the detector did not run at all (no session).
+    budget_remaining_pct?: Long,      // Remaining session token budget (0-100)
+    budget_exceeded?: Bool,           // Session token budget exceeded
   },
 };
 
@@ -392,6 +428,24 @@ action connect_server appliesTo {
     session_max_pii_score?: Long,
     session_max_secret_score?: Long,
     session_cumulative_risk_score?: Long,
+    // --- Session Token Budget --- (OWASP LLM10; CAP-ENF-009, cerberus#147)
+    // Fed by the cumulative session total the Overwatch daemon reports on the
+    // prompt and before-tool events.
+    //
+    // BOTH are optional, so BOTH need a `has` guard — a bare
+    // `context.budget_remaining_pct < 10` fails cedar validation with
+    // "unable to guarantee safety of access to optional attribute".
+    // Write: `context has budget_remaining_pct && context.budget_remaining_pct < 10`.
+    //
+    // The guard is a validation requirement, NOT a safety property. Whenever a
+    // session loads, budget_checker emits both keys — including
+    // budget_exceeded: false and budget_remaining_pct: 100 when no budget rule
+    // is configured for the scope. So a grant conditioned on
+    // `!context.budget_exceeded` fires on unbudgeted sessions, and a low
+    // percentage is evidence of spend only when a budget rule exists. Absence
+    // means the detector did not run at all (no session).
+    budget_remaining_pct?: Long,      // Remaining session token budget (0-100)
+    budget_exceeded?: Bool,           // Session token budget exceeded
   },
 };
 
@@ -446,6 +500,24 @@ action read_file appliesTo {
 
     // --- Agent Security ---
     indirect_injection_score?: Long,  // Indirect injection via file content
+    // --- Session Token Budget --- (OWASP LLM10; CAP-ENF-009, cerberus#147)
+    // Fed by the cumulative session total the Overwatch daemon reports on the
+    // prompt and before-tool events.
+    //
+    // BOTH are optional, so BOTH need a `has` guard — a bare
+    // `context.budget_remaining_pct < 10` fails cedar validation with
+    // "unable to guarantee safety of access to optional attribute".
+    // Write: `context has budget_remaining_pct && context.budget_remaining_pct < 10`.
+    //
+    // The guard is a validation requirement, NOT a safety property. Whenever a
+    // session loads, budget_checker emits both keys — including
+    // budget_exceeded: false and budget_remaining_pct: 100 when no budget rule
+    // is configured for the scope. So a grant conditioned on
+    // `!context.budget_exceeded` fires on unbudgeted sessions, and a low
+    // percentage is evidence of spend only when a budget rule exists. Absence
+    // means the detector did not run at all (no session).
+    budget_remaining_pct?: Long,      // Remaining session token budget (0-100)
+    budget_exceeded?: Bool,           // Session token budget exceeded
   },
 };
 
@@ -500,6 +572,24 @@ action write_file appliesTo {
 
     // --- Agent Security ---
     indirect_injection_score?: Long,  // Indirect injection via file content
+    // --- Session Token Budget --- (OWASP LLM10; CAP-ENF-009, cerberus#147)
+    // Fed by the cumulative session total the Overwatch daemon reports on the
+    // prompt and before-tool events.
+    //
+    // BOTH are optional, so BOTH need a `has` guard — a bare
+    // `context.budget_remaining_pct < 10` fails cedar validation with
+    // "unable to guarantee safety of access to optional attribute".
+    // Write: `context has budget_remaining_pct && context.budget_remaining_pct < 10`.
+    //
+    // The guard is a validation requirement, NOT a safety property. Whenever a
+    // session loads, budget_checker emits both keys — including
+    // budget_exceeded: false and budget_remaining_pct: 100 when no budget rule
+    // is configured for the scope. So a grant conditioned on
+    // `!context.budget_exceeded` fires on unbudgeted sessions, and a low
+    // percentage is evidence of spend only when a budget rule exists. Absence
+    // means the detector did not run at all (no session).
+    budget_remaining_pct?: Long,      // Remaining session token budget (0-100)
+    budget_exceeded?: Bool,           // Session token budget exceeded
   },
 };