@highflame/policy 2.2.41 → 2.2.42

package/_schemas/guardrails/templates/templates.json

@@ -60,7 +60,10 @@
       "category": "organization",
       "file": "defaults/baseline.cedar",
       "severity": "low",
-      "tags": ["category:organization", "posture:permit-default"],
+      "tags": [
+        "category:organization",
+        "posture:permit-default"
+      ],
       "is_active": true
     }
   ],
@@ -72,7 +75,10 @@
       "category": "organization",
       "file": "defaults/baseline.cedar",
       "severity": "low",
-      "tags": ["category:organization", "posture:permit-default"],
+      "tags": [
+        "category:organization",
+        "posture:permit-default"
+      ],
       "auto_deploy": true
     },
     {
@@ -82,7 +88,11 @@
       "category": "data-protection",
       "file": "defaults/secrets.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
     },
     {
       "id": "security.injection",
@@ -226,7 +236,11 @@
       "category": "agent-identity",
       "file": "defaults/agent_identity.cedar",
       "severity": "critical",
-      "tags": ["category:agent-identity", "scope:per-agent", "owasp:llm01"]
+      "tags": [
+        "category:agent-identity",
+        "scope:per-agent",
+        "owasp:llm01"
+      ]
     },
     {
       "id": "tools.mcp-tool-permissions",
@@ -235,7 +249,11 @@
       "category": "tools",
       "file": "mcp_tool_permissions.cedar",
       "severity": "critical",
-      "tags": ["category:tools", "threat:supply-chain", "posture:deny-default"]
+      "tags": [
+        "category:tools",
+        "threat:supply-chain",
+        "posture:deny-default"
+      ]
     },
     {
       "id": "tools.mcp-server-allowlist",
@@ -285,7 +303,10 @@
       "category": "data-protection",
       "file": "profiles/code_agent/security.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets"
+      ]
     },
     {
       "id": "security.code-agent-encoding",
@@ -307,7 +328,11 @@
       "category": "security",
       "file": "profiles/code_agent/path_security.cedar",
       "severity": "critical",
-      "tags": ["category:security", "threat:secrets", "threat:path-traversal"]
+      "tags": [
+        "category:security",
+        "threat:secrets",
+        "threat:path-traversal"
+      ]
     },
     {
       "id": "agent-security.code-agent",
@@ -346,7 +371,11 @@
       "category": "data-protection",
       "file": "profiles/data_pipeline/data_protection.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
     },
     {
       "id": "security.data-pipeline-block-injection",
@@ -355,7 +384,11 @@
       "category": "security",
       "file": "profiles/data_pipeline/security.cedar",
       "severity": "high",
-      "tags": ["category:security", "threat:injection", "owasp:llm01"]
+      "tags": [
+        "category:security",
+        "threat:injection",
+        "owasp:llm01"
+      ]
     },
     {
       "id": "agent-security.data-pipeline",
@@ -364,7 +397,10 @@
       "category": "agent-security",
       "file": "profiles/data_pipeline/agentic_security.cedar",
       "severity": "critical",
-      "tags": ["category:agent-security", "threat:exfiltration"]
+      "tags": [
+        "category:agent-security",
+        "threat:exfiltration"
+      ]
     },
     {
       "id": "agent-identity.multi-agent-trust",
@@ -473,7 +509,11 @@
       "category": "data-protection",
       "file": "profiles/advanced_detection/secrets.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
     },
     {
       "id": "privacy.advanced-pii",
@@ -503,6 +543,62 @@
         "aarm:r3",
         "posture:deny-default"
       ]
+    },
+    {
+      "id": "privacy.output-protection",
+      "name": "Output Protection — Data Leakage",
+      "description": "Block PII, secrets and bulk disclosure in the model's own responses. Scoped to the response direction only, so prompts are unaffected.",
+      "category": "privacy",
+      "file": "profiles/output_protection/data_leakage.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:privacy",
+        "threat:data-leak",
+        "surface:process-response",
+        "detection:rule"
+      ]
+    },
+    {
+      "id": "trust-safety.output-protection",
+      "name": "Output Protection — Harmful Content",
+      "description": "Hold the model's own responses to a safety standard: toxicity, explicit content, and injection payloads carried back to the caller. Response direction only.",
+      "category": "trust-safety",
+      "file": "profiles/output_protection/harmful_content.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:trust-safety",
+        "threat:harmful",
+        "surface:process-response",
+        "detection:ml"
+      ]
+    },
+    {
+      "id": "security.output-block-injection-carried-back",
+      "name": "Output Protection — Injection Carried Back",
+      "description": "Block responses that themselves score as an injection payload — content a caller, downstream agent or renderer may execute. Response direction only.",
+      "category": "security",
+      "file": "profiles/output_protection/injection_carried_back.cedar",
+      "severity": "high",
+      "tags": [
+        "category:security",
+        "threat:injection",
+        "surface:process-response",
+        "detection:ml"
+      ]
+    },
+    {
+      "id": "data-protection.output-block-secrets",
+      "name": "Output Protection — Credentials",
+      "description": "Block responses whose own content contains credentials, API keys or tokens — the canonical way a leaked secret reaches a caller. Response direction only.",
+      "category": "data-protection",
+      "file": "profiles/output_protection/credentials.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "surface:process-response",
+        "detection:rule"
+      ]
     }
   ]
 }

package/_schemas/overwatch/context.json

@@ -333,6 +333,19 @@
           "type": "number",
           "required": false,
           "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
+        },
+        {
+          "key": "budget_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining session token budget as a percentage (0-100). Optional, so a policy must guard it: `context has budget_remaining_pct && context.budget_remaining_pct < 10` — a bare comparison fails Cedar validation. Runtime default-fills it to 100 whenever the detector runs, so a high value is not evidence that a budget rule exists.",
+          "range": "0-100"
+        },
+        {
+          "key": "budget_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the session token budget has been exceeded. Optional, so a policy must guard it with `context has budget_exceeded`. The guard is a validation requirement, not a fail-closed property: the detector emits false whenever a session loads, including when no budget rule is configured, so a grant conditioned on `!context.budget_exceeded` will fire on unbudgeted sessions."
         }
       ]
     },
@@ -854,6 +867,19 @@
           "type": "number",
           "required": false,
           "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
+        },
+        {
+          "key": "budget_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining session token budget as a percentage (0-100). Optional, so a policy must guard it: `context has budget_remaining_pct && context.budget_remaining_pct < 10` — a bare comparison fails Cedar validation. Runtime default-fills it to 100 whenever the detector runs, so a high value is not evidence that a budget rule exists.",
+          "range": "0-100"
+        },
+        {
+          "key": "budget_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the session token budget has been exceeded. Optional, so a policy must guard it with `context has budget_exceeded`. The guard is a validation requirement, not a fail-closed property: the detector emits false whenever a session loads, including when no budget rule is configured, so a grant conditioned on `!context.budget_exceeded` will fire on unbudgeted sessions."
         }
       ]
     },
@@ -1285,6 +1311,19 @@
           "type": "number",
           "required": false,
           "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
+        },
+        {
+          "key": "budget_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining session token budget as a percentage (0-100). Optional, so a policy must guard it: `context has budget_remaining_pct && context.budget_remaining_pct < 10` — a bare comparison fails Cedar validation. Runtime default-fills it to 100 whenever the detector runs, so a high value is not evidence that a budget rule exists.",
+          "range": "0-100"
+        },
+        {
+          "key": "budget_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the session token budget has been exceeded. Optional, so a policy must guard it with `context has budget_exceeded`. The guard is a validation requirement, not a fail-closed property: the detector emits false whenever a session loads, including when no budget rule is configured, so a grant conditioned on `!context.budget_exceeded` will fire on unbudgeted sessions."
         }
       ]
     },
@@ -1494,6 +1533,19 @@
           "type": "number",
           "required": false,
           "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
+        },
+        {
+          "key": "budget_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining session token budget as a percentage (0-100). Optional, so a policy must guard it: `context has budget_remaining_pct && context.budget_remaining_pct < 10` — a bare comparison fails Cedar validation. Runtime default-fills it to 100 whenever the detector runs, so a high value is not evidence that a budget rule exists.",
+          "range": "0-100"
+        },
+        {
+          "key": "budget_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the session token budget has been exceeded. Optional, so a policy must guard it with `context has budget_exceeded`. The guard is a validation requirement, not a fail-closed property: the detector emits false whenever a session loads, including when no budget rule is configured, so a grant conditioned on `!context.budget_exceeded` will fire on unbudgeted sessions."
         }
       ]
     },
@@ -1709,6 +1761,19 @@
           "type": "number",
           "required": false,
           "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
+        },
+        {
+          "key": "budget_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining session token budget as a percentage (0-100). Optional, so a policy must guard it: `context has budget_remaining_pct && context.budget_remaining_pct < 10` — a bare comparison fails Cedar validation. Runtime default-fills it to 100 whenever the detector runs, so a high value is not evidence that a budget rule exists.",
+          "range": "0-100"
+        },
+        {
+          "key": "budget_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the session token budget has been exceeded. Optional, so a policy must guard it with `context has budget_exceeded`. The guard is a validation requirement, not a fail-closed property: the detector emits false whenever a session loads, including when no budget rule is configured, so a grant conditioned on `!context.budget_exceeded` will fire on unbudgeted sessions."
         }
       ]
     }

package/_schemas/overwatch/detectors.json

@@ -299,6 +299,47 @@
         }
       ]
     },
+    {
+      "id": "budget_checker",
+      "stability": "stable",
+      "tier": "fast",
+      "description": "Tracks cumulative session token consumption against a configured budget. On the IDE surface the total is reported by the Overwatch daemon on the prompt and before-tool events (cerberus#147); only the token-budget attributes apply here, not the gateway-metered RPM/TPM ones.",
+      "producesAttrs": [
+        {
+          "name": "budget_remaining_pct",
+          "type": "Long",
+          "semantic": "severity_0_100",
+          "description": "Remaining session token budget (0-100). Default-filled to 100 when no metering ran."
+        },
+        {
+          "name": "budget_exceeded",
+          "type": "Bool",
+          "semantic": "boolean_flag",
+          "description": "True iff the session token budget has been exceeded. Absent when no metering ran, so policies must guard with `context has`."
+        }
+      ],
+      "supportedModes": [
+        "enforce",
+        "monitor",
+        "alert"
+      ],
+      "modifyContract": null,
+      "displayName": "Budget Checker",
+      "category": "agent_behavior",
+      "defendsAgainst": [
+        "unbounded_consumption"
+      ],
+      "exampleAttacks": [
+        {
+          "title": "Runaway autonomous session",
+          "vulnerabilityId": "unbounded_consumption",
+          "snippet": "(agentic) one prompt drives hundreds of tool calls, burning the session's token budget unattended",
+          "expectedSignal": {
+            "budget_exceeded": true
+          }
+        }
+      ]
+    },
     {
       "id": "tool_risk",
       "stability": "stable",
@@ -870,6 +911,12 @@
     "workspace_root"
   ],
   "fieldToDetectorIds": {
+    "budget_exceeded": [
+      "budget_checker"
+    ],
+    "budget_remaining_pct": [
+      "budget_checker"
+    ],
     "crime_score": [
       "toxicity"
     ],

package/_schemas/overwatch/schema.cedarschema

@@ -151,6 +151,24 @@ action process_prompt appliesTo {
     // --- Legacy ---
     prompt_text?: String,             // Same as content (backward compatibility)
     response_content?: String,        // Response content (if available)
+    // --- Session Token Budget --- (OWASP LLM10; CAP-ENF-009, cerberus#147)
+    // Fed by the cumulative session total the Overwatch daemon reports on the
+    // prompt and before-tool events.
+    //
+    // BOTH are optional, so BOTH need a `has` guard — a bare
+    // `context.budget_remaining_pct < 10` fails cedar validation with
+    // "unable to guarantee safety of access to optional attribute".
+    // Write: `context has budget_remaining_pct && context.budget_remaining_pct < 10`.
+    //
+    // The guard is a validation requirement, NOT a safety property. Whenever a
+    // session loads, budget_checker emits both keys — including
+    // budget_exceeded: false and budget_remaining_pct: 100 when no budget rule
+    // is configured for the scope. So a grant conditioned on
+    // `!context.budget_exceeded` fires on unbudgeted sessions, and a low
+    // percentage is evidence of spend only when a budget rule exists. Absence
+    // means the detector did not run at all (no session).
+    budget_remaining_pct?: Long,      // Remaining session token budget (0-100)
+    budget_exceeded?: Bool,           // Session token budget exceeded
   },
 };
 
@@ -270,6 +288,24 @@ action call_tool appliesTo {
 
     // --- Legacy ---
     response_content?: String,
+    // --- Session Token Budget --- (OWASP LLM10; CAP-ENF-009, cerberus#147)
+    // Fed by the cumulative session total the Overwatch daemon reports on the
+    // prompt and before-tool events.
+    //
+    // BOTH are optional, so BOTH need a `has` guard — a bare
+    // `context.budget_remaining_pct < 10` fails cedar validation with
+    // "unable to guarantee safety of access to optional attribute".
+    // Write: `context has budget_remaining_pct && context.budget_remaining_pct < 10`.
+    //
+    // The guard is a validation requirement, NOT a safety property. Whenever a
+    // session loads, budget_checker emits both keys — including
+    // budget_exceeded: false and budget_remaining_pct: 100 when no budget rule
+    // is configured for the scope. So a grant conditioned on
+    // `!context.budget_exceeded` fires on unbudgeted sessions, and a low
+    // percentage is evidence of spend only when a budget rule exists. Absence
+    // means the detector did not run at all (no session).
+    budget_remaining_pct?: Long,      // Remaining session token budget (0-100)
+    budget_exceeded?: Bool,           // Session token budget exceeded
   },
 };
 
@@ -392,6 +428,24 @@ action connect_server appliesTo {
     session_max_pii_score?: Long,
     session_max_secret_score?: Long,
     session_cumulative_risk_score?: Long,
+    // --- Session Token Budget --- (OWASP LLM10; CAP-ENF-009, cerberus#147)
+    // Fed by the cumulative session total the Overwatch daemon reports on the
+    // prompt and before-tool events.
+    //
+    // BOTH are optional, so BOTH need a `has` guard — a bare
+    // `context.budget_remaining_pct < 10` fails cedar validation with
+    // "unable to guarantee safety of access to optional attribute".
+    // Write: `context has budget_remaining_pct && context.budget_remaining_pct < 10`.
+    //
+    // The guard is a validation requirement, NOT a safety property. Whenever a
+    // session loads, budget_checker emits both keys — including
+    // budget_exceeded: false and budget_remaining_pct: 100 when no budget rule
+    // is configured for the scope. So a grant conditioned on
+    // `!context.budget_exceeded` fires on unbudgeted sessions, and a low
+    // percentage is evidence of spend only when a budget rule exists. Absence
+    // means the detector did not run at all (no session).
+    budget_remaining_pct?: Long,      // Remaining session token budget (0-100)
+    budget_exceeded?: Bool,           // Session token budget exceeded
   },
 };
 
@@ -446,6 +500,24 @@ action read_file appliesTo {
 
     // --- Agent Security ---
     indirect_injection_score?: Long,  // Indirect injection via file content
+    // --- Session Token Budget --- (OWASP LLM10; CAP-ENF-009, cerberus#147)
+    // Fed by the cumulative session total the Overwatch daemon reports on the
+    // prompt and before-tool events.
+    //
+    // BOTH are optional, so BOTH need a `has` guard — a bare
+    // `context.budget_remaining_pct < 10` fails cedar validation with
+    // "unable to guarantee safety of access to optional attribute".
+    // Write: `context has budget_remaining_pct && context.budget_remaining_pct < 10`.
+    //
+    // The guard is a validation requirement, NOT a safety property. Whenever a
+    // session loads, budget_checker emits both keys — including
+    // budget_exceeded: false and budget_remaining_pct: 100 when no budget rule
+    // is configured for the scope. So a grant conditioned on
+    // `!context.budget_exceeded` fires on unbudgeted sessions, and a low
+    // percentage is evidence of spend only when a budget rule exists. Absence
+    // means the detector did not run at all (no session).
+    budget_remaining_pct?: Long,      // Remaining session token budget (0-100)
+    budget_exceeded?: Bool,           // Session token budget exceeded
   },
 };
 
@@ -500,6 +572,24 @@ action write_file appliesTo {
 
     // --- Agent Security ---
     indirect_injection_score?: Long,  // Indirect injection via file content
+    // --- Session Token Budget --- (OWASP LLM10; CAP-ENF-009, cerberus#147)
+    // Fed by the cumulative session total the Overwatch daemon reports on the
+    // prompt and before-tool events.
+    //
+    // BOTH are optional, so BOTH need a `has` guard — a bare
+    // `context.budget_remaining_pct < 10` fails cedar validation with
+    // "unable to guarantee safety of access to optional attribute".
+    // Write: `context has budget_remaining_pct && context.budget_remaining_pct < 10`.
+    //
+    // The guard is a validation requirement, NOT a safety property. Whenever a
+    // session loads, budget_checker emits both keys — including
+    // budget_exceeded: false and budget_remaining_pct: 100 when no budget rule
+    // is configured for the scope. So a grant conditioned on
+    // `!context.budget_exceeded` fires on unbudgeted sessions, and a low
+    // percentage is evidence of spend only when a budget rule exists. Absence
+    // means the detector did not run at all (no session).
+    budget_remaining_pct?: Long,      // Remaining session token budget (0-100)
+    budget_exceeded?: Bool,           // Session token budget exceeded
   },
 };
 

package/dist/ai_gateway-entities.gen.js

@@ -7,7 +7,7 @@
 export const AI_GATEWAY_ENTITIES = {
     principals: ['MCP_Client', 'User'],
     resources: ['FilePath', 'LlmPrompt', 'LlmResponse', 'Server', 'Tool'],
-    actions: ['call_tool', 'connect_server', 'process_prompt', 'process_response', 'read_file', 'write_file'],
+    actions: ['call_tool', 'connect_server', 'list', 'process_prompt', 'process_response', 'read_file', 'write_file'],
 };
 /**
  * Per-action entity mapping for AiGateway.
@@ -22,6 +22,10 @@ export const AI_GATEWAY_ACTION_ENTITIES = {
         principals: ['MCP_Client', 'User'],
         resources: ['Server'],
     },
+    'list': {
+        principals: ['MCP_Client', 'User'],
+        resources: ['Server'],
+    },
     'process_prompt': {
         principals: ['MCP_Client', 'User'],
         resources: ['LlmPrompt'],