@highflame/policy 2.2.41 → 2.2.42

package/_schemas/ai_gateway/context.json

@@ -779,6 +779,306 @@
         }
       ]
     },
+    {
+      "name": "list",
+      "description": "Enumerate a server's tools, prompts, or resources — threat focus: tool poisoning and rug pull in the returned descriptions",
+      "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011)."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011)."
+        },
+        {
+          "key": "content",
+          "type": "string",
+          "required": false,
+          "description": "The enumerated item's description — the text scanned for poisoning. Absent when the item declares none."
+        },
+        {
+          "key": "mcp_server",
+          "type": "string",
+          "required": false,
+          "description": "MCP server being enumerated"
+        },
+        {
+          "key": "tool_name",
+          "type": "string",
+          "required": false,
+          "description": "Name of the enumerated item being evaluated"
+        },
+        {
+          "key": "tool_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Tool risk score"
+        },
+        {
+          "key": "tool_category",
+          "type": "string",
+          "required": false,
+          "description": "\"safe\", \"sensitive\", \"dangerous\""
+        },
+        {
+          "key": "tool_is_sensitive",
+          "type": "boolean",
+          "required": false,
+          "description": "Tool is sensitive"
+        },
+        {
+          "key": "tool_is_builtin",
+          "type": "boolean",
+          "required": false,
+          "description": "Tool is builtin"
+        },
+        {
+          "key": "tool_operation_classes",
+          "type": "array",
+          "required": false,
+          "description": "Tool operation classes"
+        },
+        {
+          "key": "threat_count",
+          "type": "number",
+          "required": false,
+          "description": "Total threats detected"
+        },
+        {
+          "key": "highest_severity",
+          "type": "string",
+          "required": false,
+          "description": "Highest threat severity"
+        },
+        {
+          "key": "threat_categories",
+          "type": "array",
+          "required": false,
+          "description": "Threat category names"
+        },
+        {
+          "key": "detected_threats",
+          "type": "array",
+          "required": false,
+          "description": "Detection rule names that matched"
+        },
+        {
+          "key": "max_threat_severity",
+          "type": "number",
+          "required": false,
+          "description": "Numeric severity (0=none, 4=critical)"
+        },
+        {
+          "key": "tool_poisoning_score",
+          "type": "number",
+          "required": false,
+          "description": "Hidden instructions in a tool description"
+        },
+        {
+          "key": "tool_poisoning_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Hidden instructions found in the description"
+        },
+        {
+          "key": "rug_pull_score",
+          "type": "number",
+          "required": false,
+          "description": "Description drift after trust establishment"
+        },
+        {
+          "key": "rug_pull_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Description drifted after trust was established"
+        },
+        {
+          "key": "indirect_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Indirect injection score"
+        },
+        {
+          "key": "injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Prompt injection classifier confidence (0-100)"
+        },
+        {
+          "key": "jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Jailbreak classifier confidence (0-100)"
+        },
+        {
+          "key": "secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether secrets were detected in the description"
+        },
+        {
+          "key": "secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Secret types detected"
+        },
+        {
+          "key": "secret_count",
+          "type": "number",
+          "required": false,
+          "description": "Number of secrets detected"
+        },
+        {
+          "key": "pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether PII was detected"
+        },
+        {
+          "key": "pii_types",
+          "type": "array",
+          "required": false,
+          "description": "PII types detected"
+        },
+        {
+          "key": "pii_count",
+          "type": "number",
+          "required": false,
+          "description": "Number of PII entities"
+        },
+        {
+          "key": "pii_score",
+          "type": "number",
+          "required": false,
+          "description": "PII confidence (0-100)"
+        },
+        {
+          "key": "mcp_server_verified",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the server is from a verified registry"
+        },
+        {
+          "key": "mcp_config_risk",
+          "type": "boolean",
+          "required": false,
+          "description": "Server config flagged risky"
+        },
+        {
+          "key": "mcp_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Server risk score (0-100)"
+        },
+        {
+          "key": "session_threat_turns",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated threat turns across prior turns"
+        },
+        {
+          "key": "session_cumulative_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated cumulative risk score across prior turns"
+        },
+        {
+          "key": "session_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Session-aggregated injection detected across prior turns"
+        },
+        {
+          "key": "session_command_injection",
+          "type": "boolean",
+          "required": false,
+          "description": "Session-aggregated command injection across prior turns"
+        },
+        {
+          "key": "session_pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Session-aggregated pii detected across prior turns"
+        },
+        {
+          "key": "session_pii_types",
+          "type": "array",
+          "required": false,
+          "description": "Session-aggregated pii types across prior turns"
+        },
+        {
+          "key": "session_secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Session-aggregated secrets detected across prior turns"
+        },
+        {
+          "key": "session_secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Session-aggregated secret types across prior turns"
+        },
+        {
+          "key": "session_max_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated max injection score across prior turns"
+        },
+        {
+          "key": "session_max_jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated max jailbreak score across prior turns"
+        },
+        {
+          "key": "session_max_command_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated max command injection score across prior turns"
+        },
+        {
+          "key": "session_max_pii_score",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated max pii score across prior turns"
+        },
+        {
+          "key": "session_max_secret_score",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated max secret score across prior turns"
+        },
+        {
+          "key": "rpm_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Requests-per-minute headroom remaining"
+        },
+        {
+          "key": "rpm_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "RPM limit exceeded"
+        },
+        {
+          "key": "tpm_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Tokens-per-minute headroom remaining"
+        },
+        {
+          "key": "tpm_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "TPM limit exceeded"
+        }
+      ]
+    },
     {
       "name": "process_prompt",
       "description": "Process a prompt (MCP or LLM chat completion) — threat focus: injection, jailbreak, secrets, PII, content safety",

package/_schemas/ai_gateway/schema.cedarschema

@@ -74,7 +74,7 @@ entity FilePath in [Project];
 // ACTIONS
 // =============================================================================
 
-// Call an MCP tool
+// Call an MCP tool (tools/call). Enumeration is the `list` action.
 // Threat focus: command injection, tool poisoning, rug pull, secrets, PII
 action call_tool appliesTo {
   principal: [User, MCP_Client],
@@ -274,6 +274,108 @@ action connect_server appliesTo {
   },
 };
 
+// Enumerate a server's tools, prompts, or resources
+// (tools/list, prompts/list, resources/list)
+//
+// Threat focus: tool poisoning and rug pull in the DESCRIPTIONS returned by
+// enumeration — the text a host feeds the model when it assembles the
+// session's tool schema, and the vector a rug-pull exploits between scans.
+//
+// Distinct from the actions it enumerates, and deliberately NOT default-locked
+// (highflame-shield#515 / INV-AUTHZ-003). Listing is host plumbing: the model
+// never decides to enumerate, the host does it to build the session. Folding
+// it into call_tool / process_prompt / read_file made enumeration inherit
+// their lock, and because a list names no tool, no conditioned grant
+// (`context has tool_name && ...`) can ever match it — so an agent holding a
+// correct grant for every tool it uses was still denied the enumeration step,
+// and without tools/list it cannot call anything at all. The only grant that
+// could match was an unconditioned one, which would have lifted the lock for
+// every call as well. There is no way to express "may list, may not call"
+// while a list and a call are the same action. See highflame-firehog#589.
+//
+// Authorization over WHAT may be enumerated is expressed through the list
+// CONTENTS (the grant-derived list filter), not by denying the request.
+action list appliesTo {
+  principal: [User, MCP_Client],
+  resource: [Server],
+  context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
+
+    // --- Content ---
+    // The enumerated item's description. Optional: a tool may declare none,
+    // and a policy must still evaluate when it does not.
+    content?: String,
+    mcp_server?: String,
+
+    // --- Enumerated item identity ---
+    // The list is scanned one item at a time, so the item being evaluated
+    // rides here while the resource stays the server being enumerated.
+    tool_name?: String,
+    tool_risk_score?: Long,
+    tool_category?: String,           // "safe", "sensitive", "dangerous"
+    tool_is_sensitive?: Bool,
+    tool_is_builtin?: Bool,
+    tool_operation_classes?: Set<String>,
+
+    // --- Threat Detection ---
+    threat_count?: Long,
+    highest_severity?: String,
+    threat_categories?: Set<String>,
+    detected_threats?: Set<String>,
+    max_threat_severity?: Long,
+
+    // --- Agent Security (0-100) — the reason this action scans at all ---
+    tool_poisoning_score?: Long,      // Hidden instructions in a tool description
+    tool_poisoning_detected?: Bool,
+    rug_pull_score?: Long,            // Description drift after trust establishment
+    rug_pull_detected?: Bool,
+    indirect_injection_score?: Long,
+
+    // --- ML Detector Confidence Scores (0-100) ---
+    injection_score?: Long,
+    jailbreak_score?: Long,
+
+    // --- Secrets ---
+    secrets_detected?: Bool,
+    secret_types?: Set<String>,
+    secret_count?: Long,
+
+    // --- PII Detection ---
+    pii_detected?: Bool,
+    pii_types?: Set<String>,
+    pii_count?: Long,
+    pii_score?: Long,
+
+    // --- MCP Trust & Config Risk ---
+    mcp_server_verified?: Bool,
+    mcp_config_risk?: Bool,
+    mcp_risk_score?: Long,
+
+    // --- Session-Aware Threat Aggregation ---
+    session_threat_turns?: Long,
+    session_cumulative_risk_score?: Long,
+    session_injection_detected?: Bool,
+    session_command_injection?: Bool,
+    session_pii_detected?: Bool,
+    session_pii_types?: Set<String>,
+    session_secrets_detected?: Bool,
+    session_secret_types?: Set<String>,
+    session_max_injection_score?: Long,
+    session_max_jailbreak_score?: Long,
+    session_max_command_injection_score?: Long,
+    session_max_pii_score?: Long,
+    session_max_secret_score?: Long,
+
+    // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
+    rpm_remaining_pct?: Long,
+    rpm_exceeded?: Bool,
+    tpm_remaining_pct?: Long,
+    tpm_exceeded?: Bool,
+  },
+};
+
 // Shared content-inspection context.
 //
 // Prompts and responses are inspected by the same detector pipeline and so
@@ -361,7 +463,8 @@ type ContentInspectionContext = {
     tpm_exceeded?: Bool,
 };
 
-// Process a prompt (MCP prompts/get or LLM chat completions)
+// Process a prompt (MCP prompts/get or LLM chat completions).
+// Enumeration (prompts/list) is the `list` action.
 // Threat focus: injection, jailbreak, secrets, PII, content safety
 action process_prompt appliesTo {
   principal: [User, MCP_Client],
@@ -384,7 +487,8 @@ action process_response appliesTo {
   context: ContentInspectionContext,
 };
 
-// Read an MCP resource (resources/read, resources/list)
+// Read an MCP resource (resources/read). Enumeration (resources/list)
+// is the `list` action.
 // Threat focus: secrets exposure, PII exposure, sensitive paths
 action read_file appliesTo {
   principal: [User, MCP_Client],

package/_schemas/guardrails/templates/profiles/output_protection/credentials.cedar

@@ -0,0 +1,35 @@
+// =============================================================================
+// Output Protection — Credentials
+// =============================================================================
+// Split from data_leakage.cedar: secrets are category `data-protection`, PII is
+// `privacy`, and a template wrapper may only carry rules of its own category
+// (HFP-LINT-TMPL-006). Relabelling one to fit the other would put a wrong
+// category on the wire, where it drives signals[] and the severity rollup.
+//
+// Same scoping rule as the rest of this profile — process_response ALONE, so a
+// tenant can police what the model says without touching what users send.
+//
+// Context keys consumed:
+//   - secrets_detected:  Bool
+//
+// Compliance:
+//   - OWASP LLM02 (Sensitive Information Disclosure)
+//
+// Category:  data-protection
+// Namespace: Guardrails
+// =============================================================================
+
+@id("data-protection.output-block-secrets")
+@name("Block secrets in model responses")
+@description("Blocks process_response when the model's own output contains credentials, API keys or tokens — the canonical way a leaked secret reaches a caller.")
+@severity("critical")
+@tags("category:data-protection,threat:secrets,surface:process-response,detection:rule,owasp:llm02")
+@reject_message("Response blocked: the model's output contained credentials.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has secrets_detected && context.secrets_detected == true
+};

package/_schemas/guardrails/templates/profiles/output_protection/data_leakage.cedar

@@ -0,0 +1,63 @@
+// =============================================================================
+// Output Protection — Data Leakage
+// =============================================================================
+// Guards what the MODEL SAYS BACK, not what the user sends in.
+//
+// Every other guardrails template binds process_response alongside
+// process_prompt and the tool/file actions, which is right for a threat that
+// is the same in both directions. Data leakage is not that: the risk is
+// specific to egress, and a tenant who wants to police only their outputs had
+// no template to enable. That gap is why one deployed tenant hand-authored a
+// rule named "Block PII in outputs" and bound it to process_prompt — the only
+// action that covered responses before the direction split (ADR 0031).
+//
+// These rules bind process_response ALONE. That is the point: ADR 0031 created
+// the distinct trigger precisely so a policy could be scoped to one direction
+// from its head, and this profile is what that is for. Enabling it cannot
+// change how prompts are treated.
+//
+// Context keys consumed:
+//   - pii_detected:      Bool
+//   - pii_count:         Long
+//
+// Compliance:
+//   - OWASP LLM02 (Sensitive Information Disclosure), OWASP LLM06
+//
+// Category:  privacy
+// Namespace: Guardrails
+// =============================================================================
+
+@id("privacy.output-block-pii")
+@name("Block PII in model responses")
+@description("Blocks process_response when the model's own output contains PII. Scoped to the response direction only — prompts are unaffected.")
+@severity("high")
+@tags("category:privacy,threat:data-leak,surface:process-response,detection:rule,owasp:llm02")
+@reject_message("Response blocked: the model's output contained personal data.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has pii_detected && context.pii_detected == true
+};
+
+// Bulk disclosure is a separate finding from a single incidental match: a
+// response carrying many distinct PII items is an exfiltration shape rather
+// than a mention, and is worth its own severity and message even though the
+// rule above already blocks it. Kept as a distinct rule so a tenant running
+// the first in monitor mode can still enforce on bulk.
+@id("privacy.output-block-bulk-pii")
+@name("Block bulk PII disclosure in model responses")
+@description("Blocks process_response when the output carries five or more PII items — a disclosure shape rather than an incidental mention.")
+@severity("critical")
+@tags("category:privacy,threat:data-leak,surface:process-response,detection:rule,owasp:llm06")
+@reject_message("Response blocked: the model's output contained bulk personal data.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has pii_count && context.pii_count >= 5
+};

package/_schemas/guardrails/templates/profiles/output_protection/harmful_content.cedar

@@ -0,0 +1,58 @@
+// =============================================================================
+// Output Protection — Harmful Content
+// =============================================================================
+// The companion to data_leakage.cedar: what the model says back, judged for
+// safety rather than for disclosure.
+//
+// Same scoping rule and same reason — process_response ALONE (ADR 0031). A
+// tenant enabling this is saying "hold my model's answers to a standard",
+// which is a different decision from "police what users send me", and the two
+// should be separately enableable.
+//
+// Thresholds match the org-wide toxicity defaults rather than tightening them.
+// An output profile that silently enforced stricter limits than the tenant's
+// existing prompt rules would surprise anyone comparing the two.
+//
+// Context keys consumed:
+//   - violence_score:     Long (0-100)
+//   - hate_speech_score:  Long (0-100)
+//   - sexual_score:       Long (0-100)
+//   - injection_score:    Long (0-100)
+//
+// Compliance:
+//   - OWASP LLM05 (Improper Output Handling), OWASP LLM01
+//
+// Category:  trust-safety
+// Namespace: Guardrails
+// =============================================================================
+
+@id("trust-safety.output-block-toxic")
+@name("Block toxic model responses")
+@description("Blocks process_response when the model's own output scores high for violence or hate speech.")
+@severity("high")
+@tags("category:trust-safety,threat:harmful,surface:process-response,detection:ml,owasp:llm05")
+@reject_message("Response blocked: the model's output was flagged as harmful.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has violence_score && context.violence_score >= 70 ||
+    context has hate_speech_score && context.hate_speech_score >= 70
+};
+
+@id("trust-safety.output-block-sexual")
+@name("Block sexual content in model responses")
+@description("Blocks process_response when the model's own output scores high for sexual content.")
+@severity("critical")
+@tags("category:trust-safety,threat:sexual,surface:process-response,detection:ml,owasp:llm05")
+@reject_message("Response blocked: the model's output was flagged as explicit.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has sexual_score && context.sexual_score >= 91
+};

package/_schemas/guardrails/templates/profiles/output_protection/injection_carried_back.cedar

@@ -0,0 +1,39 @@
+// =============================================================================
+// Output Protection — Injection Carried Back
+// =============================================================================
+// Split from harmful_content.cedar because its category is `security`, not
+// `trust-safety`, and a template wrapper may only carry rules of its own
+// category (HFP-LINT-TMPL-006). The split is the honest outcome: this is a
+// different threat with a different owner, not a toxicity variant.
+//
+// Same scoping rule as the rest of this profile — process_response ALONE.
+//
+// Context keys consumed:
+//   - injection_score:  Long (0-100)
+//
+// Compliance:
+//   - OWASP LLM05 (Improper Output Handling)
+//
+// Category:  security
+// Namespace: Guardrails
+// =============================================================================
+
+// Injection scored on an OUTPUT is a different finding from injection scored on
+// a prompt. On the way in it is a user attacking the model; on the way out it
+// is content the model is handing to the caller — a downstream agent, a
+// renderer, or another tool — which is OWASP LLM05's improper output handling.
+// Worth its own rule so the two can be tuned and reasoned about separately.
+@id("security.output-block-injection-carried-back")
+@name("Block injection payloads carried back in model responses")
+@description("Blocks process_response when the output itself scores as an injection payload — content the caller may execute or forward.")
+@severity("high")
+@tags("category:security,threat:injection,surface:process-response,detection:ml,owasp:llm05")
+@reject_message("Response blocked: the model's output contained an injection payload.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has injection_score && context.injection_score >= 80
+};