@highflame/policy 2.2.41 → 2.2.42

package/dist/guardrails-defaults.gen.js

@@ -3471,6 +3471,205 @@ when {
     !(["treasury@example.com", "payroll@example.com"].contains(context.action_params.recipient))
 };
 `;
+const GUARDRAILS_PRIVACY_OUTPUT_PROTECTION_CEDAR = `// =============================================================================
+// Output Protection — Data Leakage
+// =============================================================================
+// Guards what the MODEL SAYS BACK, not what the user sends in.
+//
+// Every other guardrails template binds process_response alongside
+// process_prompt and the tool/file actions, which is right for a threat that
+// is the same in both directions. Data leakage is not that: the risk is
+// specific to egress, and a tenant who wants to police only their outputs had
+// no template to enable. That gap is why one deployed tenant hand-authored a
+// rule named "Block PII in outputs" and bound it to process_prompt — the only
+// action that covered responses before the direction split (ADR 0031).
+//
+// These rules bind process_response ALONE. That is the point: ADR 0031 created
+// the distinct trigger precisely so a policy could be scoped to one direction
+// from its head, and this profile is what that is for. Enabling it cannot
+// change how prompts are treated.
+//
+// Context keys consumed:
+//   - pii_detected:      Bool
+//   - pii_count:         Long
+//
+// Compliance:
+//   - OWASP LLM02 (Sensitive Information Disclosure), OWASP LLM06
+//
+// Category:  privacy
+// Namespace: Guardrails
+// =============================================================================
+
+@id("privacy.output-block-pii")
+@name("Block PII in model responses")
+@description("Blocks process_response when the model's own output contains PII. Scoped to the response direction only — prompts are unaffected.")
+@severity("high")
+@tags("category:privacy,threat:data-leak,surface:process-response,detection:rule,owasp:llm02")
+@reject_message("Response blocked: the model's output contained personal data.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has pii_detected && context.pii_detected == true
+};
+
+// Bulk disclosure is a separate finding from a single incidental match: a
+// response carrying many distinct PII items is an exfiltration shape rather
+// than a mention, and is worth its own severity and message even though the
+// rule above already blocks it. Kept as a distinct rule so a tenant running
+// the first in monitor mode can still enforce on bulk.
+@id("privacy.output-block-bulk-pii")
+@name("Block bulk PII disclosure in model responses")
+@description("Blocks process_response when the output carries five or more PII items — a disclosure shape rather than an incidental mention.")
+@severity("critical")
+@tags("category:privacy,threat:data-leak,surface:process-response,detection:rule,owasp:llm06")
+@reject_message("Response blocked: the model's output contained bulk personal data.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has pii_count && context.pii_count >= 5
+};
+`;
+const GUARDRAILS_TRUST_SAFETY_OUTPUT_PROTECTION_CEDAR = `// =============================================================================
+// Output Protection — Harmful Content
+// =============================================================================
+// The companion to data_leakage.cedar: what the model says back, judged for
+// safety rather than for disclosure.
+//
+// Same scoping rule and same reason — process_response ALONE (ADR 0031). A
+// tenant enabling this is saying "hold my model's answers to a standard",
+// which is a different decision from "police what users send me", and the two
+// should be separately enableable.
+//
+// Thresholds match the org-wide toxicity defaults rather than tightening them.
+// An output profile that silently enforced stricter limits than the tenant's
+// existing prompt rules would surprise anyone comparing the two.
+//
+// Context keys consumed:
+//   - violence_score:     Long (0-100)
+//   - hate_speech_score:  Long (0-100)
+//   - sexual_score:       Long (0-100)
+//   - injection_score:    Long (0-100)
+//
+// Compliance:
+//   - OWASP LLM05 (Improper Output Handling), OWASP LLM01
+//
+// Category:  trust-safety
+// Namespace: Guardrails
+// =============================================================================
+
+@id("trust-safety.output-block-toxic")
+@name("Block toxic model responses")
+@description("Blocks process_response when the model's own output scores high for violence or hate speech.")
+@severity("high")
+@tags("category:trust-safety,threat:harmful,surface:process-response,detection:ml,owasp:llm05")
+@reject_message("Response blocked: the model's output was flagged as harmful.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has violence_score && context.violence_score >= 70 ||
+    context has hate_speech_score && context.hate_speech_score >= 70
+};
+
+@id("trust-safety.output-block-sexual")
+@name("Block sexual content in model responses")
+@description("Blocks process_response when the model's own output scores high for sexual content.")
+@severity("critical")
+@tags("category:trust-safety,threat:sexual,surface:process-response,detection:ml,owasp:llm05")
+@reject_message("Response blocked: the model's output was flagged as explicit.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has sexual_score && context.sexual_score >= 91
+};
+`;
+const GUARDRAILS_SECURITY_OUTPUT_BLOCK_INJECTION_CARRIED_BACK_CEDAR = `// =============================================================================
+// Output Protection — Injection Carried Back
+// =============================================================================
+// Split from harmful_content.cedar because its category is \`security\`, not
+// \`trust-safety\`, and a template wrapper may only carry rules of its own
+// category (HFP-LINT-TMPL-006). The split is the honest outcome: this is a
+// different threat with a different owner, not a toxicity variant.
+//
+// Same scoping rule as the rest of this profile — process_response ALONE.
+//
+// Context keys consumed:
+//   - injection_score:  Long (0-100)
+//
+// Compliance:
+//   - OWASP LLM05 (Improper Output Handling)
+//
+// Category:  security
+// Namespace: Guardrails
+// =============================================================================
+
+// Injection scored on an OUTPUT is a different finding from injection scored on
+// a prompt. On the way in it is a user attacking the model; on the way out it
+// is content the model is handing to the caller — a downstream agent, a
+// renderer, or another tool — which is OWASP LLM05's improper output handling.
+// Worth its own rule so the two can be tuned and reasoned about separately.
+@id("security.output-block-injection-carried-back")
+@name("Block injection payloads carried back in model responses")
+@description("Blocks process_response when the output itself scores as an injection payload — content the caller may execute or forward.")
+@severity("high")
+@tags("category:security,threat:injection,surface:process-response,detection:ml,owasp:llm05")
+@reject_message("Response blocked: the model's output contained an injection payload.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has injection_score && context.injection_score >= 80
+};
+`;
+const GUARDRAILS_DATA_PROTECTION_OUTPUT_BLOCK_SECRETS_CEDAR = `// =============================================================================
+// Output Protection — Credentials
+// =============================================================================
+// Split from data_leakage.cedar: secrets are category \`data-protection\`, PII is
+// \`privacy\`, and a template wrapper may only carry rules of its own category
+// (HFP-LINT-TMPL-006). Relabelling one to fit the other would put a wrong
+// category on the wire, where it drives signals[] and the severity rollup.
+//
+// Same scoping rule as the rest of this profile — process_response ALONE, so a
+// tenant can police what the model says without touching what users send.
+//
+// Context keys consumed:
+//   - secrets_detected:  Bool
+//
+// Compliance:
+//   - OWASP LLM02 (Sensitive Information Disclosure)
+//
+// Category:  data-protection
+// Namespace: Guardrails
+// =============================================================================
+
+@id("data-protection.output-block-secrets")
+@name("Block secrets in model responses")
+@description("Blocks process_response when the model's own output contains credentials, API keys or tokens — the canonical way a leaked secret reaches a caller.")
+@severity("critical")
+@tags("category:data-protection,threat:secrets,surface:process-response,detection:rule,owasp:llm02")
+@reject_message("Response blocked: the model's output contained credentials.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has secrets_detected && context.secrets_detected == true
+};
+`;
 // =============================================================================
 // CATEGORIES
 // =============================================================================
@@ -3810,6 +4009,42 @@ export const GUARDRAILS_TEMPLATES = [
         severity: 'high',
         tags: ['category:agent-security', 'surface:call-tool', 'aarm:r3', 'posture:deny-default'],
     },
+    {
+        id: 'privacy.output-protection',
+        name: 'Output Protection — Data Leakage',
+        description: 'Block PII, secrets and bulk disclosure in the model\'s own responses. Scoped to the response direction only, so prompts are unaffected.',
+        category: 'privacy',
+        cedarText: GUARDRAILS_PRIVACY_OUTPUT_PROTECTION_CEDAR,
+        severity: 'critical',
+        tags: ['category:privacy', 'threat:data-leak', 'surface:process-response', 'detection:rule'],
+    },
+    {
+        id: 'trust-safety.output-protection',
+        name: 'Output Protection — Harmful Content',
+        description: 'Hold the model\'s own responses to a safety standard: toxicity, explicit content, and injection payloads carried back to the caller. Response direction only.',
+        category: 'trust-safety',
+        cedarText: GUARDRAILS_TRUST_SAFETY_OUTPUT_PROTECTION_CEDAR,
+        severity: 'critical',
+        tags: ['category:trust-safety', 'threat:harmful', 'surface:process-response', 'detection:ml'],
+    },
+    {
+        id: 'security.output-block-injection-carried-back',
+        name: 'Output Protection — Injection Carried Back',
+        description: 'Block responses that themselves score as an injection payload — content a caller, downstream agent or renderer may execute. Response direction only.',
+        category: 'security',
+        cedarText: GUARDRAILS_SECURITY_OUTPUT_BLOCK_INJECTION_CARRIED_BACK_CEDAR,
+        severity: 'high',
+        tags: ['category:security', 'threat:injection', 'surface:process-response', 'detection:ml'],
+    },
+    {
+        id: 'data-protection.output-block-secrets',
+        name: 'Output Protection — Credentials',
+        description: 'Block responses whose own content contains credentials, API keys or tokens — the canonical way a leaked secret reaches a caller. Response direction only.',
+        category: 'data-protection',
+        cedarText: GUARDRAILS_DATA_PROTECTION_OUTPUT_BLOCK_SECRETS_CEDAR,
+        severity: 'critical',
+        tags: ['category:data-protection', 'threat:secrets', 'surface:process-response', 'detection:rule'],
+    },
 ];
 // =============================================================================
 // TEMPLATES METADATA
@@ -3877,7 +4112,10 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "organization",
       "file": "defaults/baseline.cedar",
       "severity": "low",
-      "tags": ["category:organization", "posture:permit-default"],
+      "tags": [
+        "category:organization",
+        "posture:permit-default"
+      ],
       "is_active": true
     }
   ],
@@ -3889,7 +4127,10 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "organization",
       "file": "defaults/baseline.cedar",
       "severity": "low",
-      "tags": ["category:organization", "posture:permit-default"],
+      "tags": [
+        "category:organization",
+        "posture:permit-default"
+      ],
       "auto_deploy": true
     },
     {
@@ -3899,7 +4140,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "data-protection",
       "file": "defaults/secrets.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
     },
     {
       "id": "security.injection",
@@ -4043,7 +4288,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "agent-identity",
       "file": "defaults/agent_identity.cedar",
       "severity": "critical",
-      "tags": ["category:agent-identity", "scope:per-agent", "owasp:llm01"]
+      "tags": [
+        "category:agent-identity",
+        "scope:per-agent",
+        "owasp:llm01"
+      ]
     },
     {
       "id": "tools.mcp-tool-permissions",
@@ -4052,7 +4301,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "tools",
       "file": "mcp_tool_permissions.cedar",
       "severity": "critical",
-      "tags": ["category:tools", "threat:supply-chain", "posture:deny-default"]
+      "tags": [
+        "category:tools",
+        "threat:supply-chain",
+        "posture:deny-default"
+      ]
     },
     {
       "id": "tools.mcp-server-allowlist",
@@ -4102,7 +4355,10 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "data-protection",
       "file": "profiles/code_agent/security.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets"
+      ]
     },
     {
       "id": "security.code-agent-encoding",
@@ -4124,7 +4380,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "security",
       "file": "profiles/code_agent/path_security.cedar",
       "severity": "critical",
-      "tags": ["category:security", "threat:secrets", "threat:path-traversal"]
+      "tags": [
+        "category:security",
+        "threat:secrets",
+        "threat:path-traversal"
+      ]
     },
     {
       "id": "agent-security.code-agent",
@@ -4163,7 +4423,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "data-protection",
       "file": "profiles/data_pipeline/data_protection.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
     },
     {
       "id": "security.data-pipeline-block-injection",
@@ -4172,7 +4436,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "security",
       "file": "profiles/data_pipeline/security.cedar",
       "severity": "high",
-      "tags": ["category:security", "threat:injection", "owasp:llm01"]
+      "tags": [
+        "category:security",
+        "threat:injection",
+        "owasp:llm01"
+      ]
     },
     {
       "id": "agent-security.data-pipeline",
@@ -4181,7 +4449,10 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "agent-security",
       "file": "profiles/data_pipeline/agentic_security.cedar",
       "severity": "critical",
-      "tags": ["category:agent-security", "threat:exfiltration"]
+      "tags": [
+        "category:agent-security",
+        "threat:exfiltration"
+      ]
     },
     {
       "id": "agent-identity.multi-agent-trust",
@@ -4290,7 +4561,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "data-protection",
       "file": "profiles/advanced_detection/secrets.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
     },
     {
       "id": "privacy.advanced-pii",
@@ -4320,6 +4595,62 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
         "aarm:r3",
         "posture:deny-default"
       ]
+    },
+    {
+      "id": "privacy.output-protection",
+      "name": "Output Protection — Data Leakage",
+      "description": "Block PII, secrets and bulk disclosure in the model's own responses. Scoped to the response direction only, so prompts are unaffected.",
+      "category": "privacy",
+      "file": "profiles/output_protection/data_leakage.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:privacy",
+        "threat:data-leak",
+        "surface:process-response",
+        "detection:rule"
+      ]
+    },
+    {
+      "id": "trust-safety.output-protection",
+      "name": "Output Protection — Harmful Content",
+      "description": "Hold the model's own responses to a safety standard: toxicity, explicit content, and injection payloads carried back to the caller. Response direction only.",
+      "category": "trust-safety",
+      "file": "profiles/output_protection/harmful_content.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:trust-safety",
+        "threat:harmful",
+        "surface:process-response",
+        "detection:ml"
+      ]
+    },
+    {
+      "id": "security.output-block-injection-carried-back",
+      "name": "Output Protection — Injection Carried Back",
+      "description": "Block responses that themselves score as an injection payload — content a caller, downstream agent or renderer may execute. Response direction only.",
+      "category": "security",
+      "file": "profiles/output_protection/injection_carried_back.cedar",
+      "severity": "high",
+      "tags": [
+        "category:security",
+        "threat:injection",
+        "surface:process-response",
+        "detection:ml"
+      ]
+    },
+    {
+      "id": "data-protection.output-block-secrets",
+      "name": "Output Protection — Credentials",
+      "description": "Block responses whose own content contains credentials, API keys or tokens — the canonical way a leaked secret reaches a caller. Response direction only.",
+      "category": "data-protection",
+      "file": "profiles/output_protection/credentials.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "surface:process-response",
+        "detection:rule"
+      ]
     }
   ]
 }

package/dist/overwatch-context.gen.d.ts

@@ -5,6 +5,8 @@
  * Overwatch Cedar schema and are used at policy evaluation time.
  */
 export declare const OverwatchContextKey: {
+    readonly BudgetExceeded: "budget_exceeded";
+    readonly BudgetRemainingPct: "budget_remaining_pct";
     readonly Content: "content";
     readonly CrimeScore: "crime_score";
     readonly Cwd: "cwd";
@@ -99,4 +101,4 @@ export type OverwatchContextKey = (typeof OverwatchContextKey)[keyof typeof Over
  * The full set of authorable context attribute keys for Overwatch.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const OverwatchContextKeys: readonly ["content", "crime_score", "cwd", "detected_threats", "event", "exec_target_paths", "exit_code", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_deep_context_score", "injection_pulse_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "path", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "prompt_text", "read_target_paths", "resolved_target_paths", "response_content", "role", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "unresolved_target", "user_email", "violence_score", "weapons_score", "workspace_root", "write_target_paths"];
+export declare const OverwatchContextKeys: readonly ["budget_exceeded", "budget_remaining_pct", "content", "crime_score", "cwd", "detected_threats", "event", "exec_target_paths", "exit_code", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_deep_context_score", "injection_pulse_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "path", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "prompt_text", "read_target_paths", "resolved_target_paths", "response_content", "role", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "unresolved_target", "user_email", "violence_score", "weapons_score", "workspace_root", "write_target_paths"];

package/dist/overwatch-context.gen.js

@@ -7,6 +7,8 @@
  * Overwatch Cedar schema and are used at policy evaluation time.
  */
 export const OverwatchContextKey = {
+    BudgetExceeded: 'budget_exceeded',
+    BudgetRemainingPct: 'budget_remaining_pct',
     Content: 'content',
     CrimeScore: 'crime_score',
     Cwd: 'cwd',
@@ -101,6 +103,8 @@ export const OverwatchContextKey = {
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
 export const OverwatchContextKeys = [
+    OverwatchContextKey.BudgetExceeded,
+    OverwatchContextKey.BudgetRemainingPct,
     OverwatchContextKey.Content,
     OverwatchContextKey.CrimeScore,
     OverwatchContextKey.Cwd,

package/dist/overwatch-detectors.gen.js

@@ -84,6 +84,20 @@ export const OVERWATCH_DETECTORS = [
         defendsAgainst: ["unbounded_consumption", "excessive_agency"],
         exampleAttacks: [{ title: "Runaway tool loop", vulnerabilityId: "unbounded_consumption", snippet: "(agentic) the same shell command is invoked 30x in a row", expectedSignal: { "loop_detected": true } }],
     },
+    {
+        id: "budget_checker",
+        displayName: "Budget Checker",
+        category: "agent_behavior",
+        stability: "stable",
+        tier: "fast",
+        inhouse: false,
+        model: null,
+        latencyP50Ms: null,
+        emits: [{ name: "budget_remaining_pct", type: "Long", modifiable: false, semantic: "severity_0_100", description: "Remaining session token budget (0-100). Default-filled to 100 when no metering ran." }, { name: "budget_exceeded", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff the session token budget has been exceeded. Absent when no metering ran, so policies must guard with `context has`." }],
+        supportedModes: ["enforce", "monitor", "alert"],
+        defendsAgainst: ["unbounded_consumption"],
+        exampleAttacks: [{ title: "Runaway autonomous session", vulnerabilityId: "unbounded_consumption", snippet: "(agentic) one prompt drives hundreds of tool calls, burning the session's token budget unattended", expectedSignal: { "budget_exceeded": true } }],
+    },
     {
         id: "tool_risk",
         displayName: "Tool Risk",
@@ -214,6 +228,8 @@ export const OVERWATCH_DETECTORS = [
 // Semantic field → contributing detector ids (producesAttrs + normalizationAliases,
 // resolved at codegen). Used by the client field→detector resolver — no Shield round-trip.
 export const OVERWATCH_FIELD_TO_DETECTORS = {
+    "budget_exceeded": ["budget_checker"],
+    "budget_remaining_pct": ["budget_checker"],
     "crime_score": ["toxicity"],
     "exec_target_paths": ["bash_ast_classifier"],
     "hate_speech_score": ["toxicity"],