@highflame/policy 2.2.41 → 2.2.43

package/_schemas/agent_ops/context.json

@@ -25,12 +25,6 @@
           "required": false,
           "description": "Principal identity class projected from the token: 'human', 'agent', 'service', or 'mcp_server'"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id)"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -817,12 +811,6 @@
           "required": false,
           "description": "Principal identity class projected from the token: 'human', 'agent', 'service', or 'mcp_server'"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id)"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -1609,12 +1597,6 @@
           "required": false,
           "description": "Principal identity class: 'human', 'agent', 'service', or 'mcp_server'"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -2372,12 +2354,6 @@
           "required": false,
           "description": "Principal identity class: 'human', 'agent', 'service', or 'mcp_server'"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -2752,12 +2728,6 @@
           "required": false,
           "description": "Principal identity class: 'human', 'agent', 'service', or 'mcp_server'"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -3145,12 +3115,6 @@
           "required": false,
           "description": "Principal identity class: 'human', 'agent', 'service', or 'mcp_server'"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -3565,12 +3529,6 @@
           "required": false,
           "description": "Principal identity class: 'human', 'agent', 'service', or 'mcp_server'"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier (ZeroID / WIMSE URI or user id)"
-        },
         {
           "key": "agent_trust_level",
           "type": "string",

package/_schemas/agent_ops/schema.cedarschema

@@ -122,6 +122,44 @@ namespace AgentOps {
     // Context Types (Action-Specific)
     // =========================================================================
 
+    /// The ZeroID NHI principal block (ADR 0009 / CAP-IDN-011).
+    ///
+    /// A record, not a string: Shield projects the whole identity block under
+    /// `context.principal`, so policies read members off it —
+    ///
+    ///   permit ... when { context has principal &&
+    ///                     context.principal.trust_level == "first_party" };
+    ///   forbid ... unless { context has principal &&
+    ///                       context.principal has act_sub };
+    ///
+    /// Declared once and shared by every action context so a new member cannot
+    /// land on one action and go missing on another.
+    ///
+    /// `act` (RFC 8693 delegation) is flattened to `act_sub` / `act_iss`
+    /// because Cedar records are flat key/value at each level; the full
+    /// delegation tree is reconstructable audit-side by joining on `mission_id`.
+    ///
+    /// Every member is optional except `delegation_depth`: the projector omits
+    /// a field whose value is empty, but always emits the depth because zero is
+    /// the meaningful base case for a direct (non-delegated) token. The record
+    /// itself is optional — it is absent, not empty, when the request carries no
+    /// NHI claims (RS256 human tokens, internal-service callers), so
+    /// `context has principal` is false rather than true-but-empty.
+    type PrincipalContext = {
+        "identity_type"?: String,      // "human" | "agent" | "service" | "mcp_server"
+        "sub_type"?: String,           // Identity subtype (e.g. "coding_agent")
+        "trust_level"?: String,        // "first_party" | "verified" | "unverified"
+        "framework"?: String,          // Agent framework (e.g. "langchain")
+        "publisher"?: String,          // Agent publisher
+        "capabilities"?: Set<String>,  // Capabilities granted to the identity
+        "scopes"?: Set<String>,        // OAuth scopes carried by the token
+        "delegation_depth": Long,      // Delegation hops; 0 for a direct token
+        "act_sub"?: String,            // RFC 8693 actor — the accountable human
+        "act_iss"?: String,            // Issuer of the actor claim
+        "mission_id"?: String,         // Correlates one delegation tree
+        "grant_type"?: String,         // How the token was obtained (e.g. "api_key")
+    };
+
     /// Context for the process_response action.
     ///
     /// An alias, not a copy: prompts and responses are inspected by the same
@@ -136,7 +174,7 @@ namespace AgentOps {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service" | "mcp_server"
-        "principal"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -331,7 +369,7 @@ namespace AgentOps {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,
-        "principal"?: String,
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -542,7 +580,7 @@ namespace AgentOps {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,
-        "principal"?: String,
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -650,7 +688,7 @@ namespace AgentOps {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,
-        "principal"?: String,
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -762,7 +800,7 @@ namespace AgentOps {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,
-        "principal"?: String,
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -895,7 +933,7 @@ namespace AgentOps {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service" | "mcp_server"
-        "principal"?: String,            // Stable principal identifier (ZeroID / WIMSE URI or user id)
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         "agent_trust_level"?: String,    // "untrusted" | "low" | "verified" | "trusted"
 
         // Core metadata (required)

package/_schemas/ai_gateway/context.json

@@ -779,6 +779,306 @@
         }
       ]
     },
+    {
+      "name": "list",
+      "description": "Enumerate a server's tools, prompts, or resources — threat focus: tool poisoning and rug pull in the returned descriptions",
+      "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011)."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011)."
+        },
+        {
+          "key": "content",
+          "type": "string",
+          "required": false,
+          "description": "The enumerated item's description — the text scanned for poisoning. Absent when the item declares none."
+        },
+        {
+          "key": "mcp_server",
+          "type": "string",
+          "required": false,
+          "description": "MCP server being enumerated"
+        },
+        {
+          "key": "tool_name",
+          "type": "string",
+          "required": false,
+          "description": "Name of the enumerated item being evaluated"
+        },
+        {
+          "key": "tool_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Tool risk score"
+        },
+        {
+          "key": "tool_category",
+          "type": "string",
+          "required": false,
+          "description": "\"safe\", \"sensitive\", \"dangerous\""
+        },
+        {
+          "key": "tool_is_sensitive",
+          "type": "boolean",
+          "required": false,
+          "description": "Tool is sensitive"
+        },
+        {
+          "key": "tool_is_builtin",
+          "type": "boolean",
+          "required": false,
+          "description": "Tool is builtin"
+        },
+        {
+          "key": "tool_operation_classes",
+          "type": "array",
+          "required": false,
+          "description": "Tool operation classes"
+        },
+        {
+          "key": "threat_count",
+          "type": "number",
+          "required": false,
+          "description": "Total threats detected"
+        },
+        {
+          "key": "highest_severity",
+          "type": "string",
+          "required": false,
+          "description": "Highest threat severity"
+        },
+        {
+          "key": "threat_categories",
+          "type": "array",
+          "required": false,
+          "description": "Threat category names"
+        },
+        {
+          "key": "detected_threats",
+          "type": "array",
+          "required": false,
+          "description": "Detection rule names that matched"
+        },
+        {
+          "key": "max_threat_severity",
+          "type": "number",
+          "required": false,
+          "description": "Numeric severity (0=none, 4=critical)"
+        },
+        {
+          "key": "tool_poisoning_score",
+          "type": "number",
+          "required": false,
+          "description": "Hidden instructions in a tool description"
+        },
+        {
+          "key": "tool_poisoning_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Hidden instructions found in the description"
+        },
+        {
+          "key": "rug_pull_score",
+          "type": "number",
+          "required": false,
+          "description": "Description drift after trust establishment"
+        },
+        {
+          "key": "rug_pull_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Description drifted after trust was established"
+        },
+        {
+          "key": "indirect_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Indirect injection score"
+        },
+        {
+          "key": "injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Prompt injection classifier confidence (0-100)"
+        },
+        {
+          "key": "jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Jailbreak classifier confidence (0-100)"
+        },
+        {
+          "key": "secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether secrets were detected in the description"
+        },
+        {
+          "key": "secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Secret types detected"
+        },
+        {
+          "key": "secret_count",
+          "type": "number",
+          "required": false,
+          "description": "Number of secrets detected"
+        },
+        {
+          "key": "pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether PII was detected"
+        },
+        {
+          "key": "pii_types",
+          "type": "array",
+          "required": false,
+          "description": "PII types detected"
+        },
+        {
+          "key": "pii_count",
+          "type": "number",
+          "required": false,
+          "description": "Number of PII entities"
+        },
+        {
+          "key": "pii_score",
+          "type": "number",
+          "required": false,
+          "description": "PII confidence (0-100)"
+        },
+        {
+          "key": "mcp_server_verified",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the server is from a verified registry"
+        },
+        {
+          "key": "mcp_config_risk",
+          "type": "boolean",
+          "required": false,
+          "description": "Server config flagged risky"
+        },
+        {
+          "key": "mcp_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Server risk score (0-100)"
+        },
+        {
+          "key": "session_threat_turns",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated threat turns across prior turns"
+        },
+        {
+          "key": "session_cumulative_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated cumulative risk score across prior turns"
+        },
+        {
+          "key": "session_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Session-aggregated injection detected across prior turns"
+        },
+        {
+          "key": "session_command_injection",
+          "type": "boolean",
+          "required": false,
+          "description": "Session-aggregated command injection across prior turns"
+        },
+        {
+          "key": "session_pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Session-aggregated pii detected across prior turns"
+        },
+        {
+          "key": "session_pii_types",
+          "type": "array",
+          "required": false,
+          "description": "Session-aggregated pii types across prior turns"
+        },
+        {
+          "key": "session_secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Session-aggregated secrets detected across prior turns"
+        },
+        {
+          "key": "session_secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Session-aggregated secret types across prior turns"
+        },
+        {
+          "key": "session_max_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated max injection score across prior turns"
+        },
+        {
+          "key": "session_max_jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated max jailbreak score across prior turns"
+        },
+        {
+          "key": "session_max_command_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated max command injection score across prior turns"
+        },
+        {
+          "key": "session_max_pii_score",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated max pii score across prior turns"
+        },
+        {
+          "key": "session_max_secret_score",
+          "type": "number",
+          "required": false,
+          "description": "Session-aggregated max secret score across prior turns"
+        },
+        {
+          "key": "rpm_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Requests-per-minute headroom remaining"
+        },
+        {
+          "key": "rpm_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "RPM limit exceeded"
+        },
+        {
+          "key": "tpm_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Tokens-per-minute headroom remaining"
+        },
+        {
+          "key": "tpm_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "TPM limit exceeded"
+        }
+      ]
+    },
     {
       "name": "process_prompt",
       "description": "Process a prompt (MCP or LLM chat completion) — threat focus: injection, jailbreak, secrets, PII, content safety",

package/_schemas/ai_gateway/schema.cedarschema

@@ -74,7 +74,7 @@ entity FilePath in [Project];
 // ACTIONS
 // =============================================================================
 
-// Call an MCP tool
+// Call an MCP tool (tools/call). Enumeration is the `list` action.
 // Threat focus: command injection, tool poisoning, rug pull, secrets, PII
 action call_tool appliesTo {
   principal: [User, MCP_Client],
@@ -274,6 +274,108 @@ action connect_server appliesTo {
   },
 };
 
+// Enumerate a server's tools, prompts, or resources
+// (tools/list, prompts/list, resources/list)
+//
+// Threat focus: tool poisoning and rug pull in the DESCRIPTIONS returned by
+// enumeration — the text a host feeds the model when it assembles the
+// session's tool schema, and the vector a rug-pull exploits between scans.
+//
+// Distinct from the actions it enumerates, and deliberately NOT default-locked
+// (highflame-shield#515 / INV-AUTHZ-003). Listing is host plumbing: the model
+// never decides to enumerate, the host does it to build the session. Folding
+// it into call_tool / process_prompt / read_file made enumeration inherit
+// their lock, and because a list names no tool, no conditioned grant
+// (`context has tool_name && ...`) can ever match it — so an agent holding a
+// correct grant for every tool it uses was still denied the enumeration step,
+// and without tools/list it cannot call anything at all. The only grant that
+// could match was an unconditioned one, which would have lifted the lock for
+// every call as well. There is no way to express "may list, may not call"
+// while a list and a call are the same action. See highflame-firehog#589.
+//
+// Authorization over WHAT may be enumerated is expressed through the list
+// CONTENTS (the grant-derived list filter), not by denying the request.
+action list appliesTo {
+  principal: [User, MCP_Client],
+  resource: [Server],
+  context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
+
+    // --- Content ---
+    // The enumerated item's description. Optional: a tool may declare none,
+    // and a policy must still evaluate when it does not.
+    content?: String,
+    mcp_server?: String,
+
+    // --- Enumerated item identity ---
+    // The list is scanned one item at a time, so the item being evaluated
+    // rides here while the resource stays the server being enumerated.
+    tool_name?: String,
+    tool_risk_score?: Long,
+    tool_category?: String,           // "safe", "sensitive", "dangerous"
+    tool_is_sensitive?: Bool,
+    tool_is_builtin?: Bool,
+    tool_operation_classes?: Set<String>,
+
+    // --- Threat Detection ---
+    threat_count?: Long,
+    highest_severity?: String,
+    threat_categories?: Set<String>,
+    detected_threats?: Set<String>,
+    max_threat_severity?: Long,
+
+    // --- Agent Security (0-100) — the reason this action scans at all ---
+    tool_poisoning_score?: Long,      // Hidden instructions in a tool description
+    tool_poisoning_detected?: Bool,
+    rug_pull_score?: Long,            // Description drift after trust establishment
+    rug_pull_detected?: Bool,
+    indirect_injection_score?: Long,
+
+    // --- ML Detector Confidence Scores (0-100) ---
+    injection_score?: Long,
+    jailbreak_score?: Long,
+
+    // --- Secrets ---
+    secrets_detected?: Bool,
+    secret_types?: Set<String>,
+    secret_count?: Long,
+
+    // --- PII Detection ---
+    pii_detected?: Bool,
+    pii_types?: Set<String>,
+    pii_count?: Long,
+    pii_score?: Long,
+
+    // --- MCP Trust & Config Risk ---
+    mcp_server_verified?: Bool,
+    mcp_config_risk?: Bool,
+    mcp_risk_score?: Long,
+
+    // --- Session-Aware Threat Aggregation ---
+    session_threat_turns?: Long,
+    session_cumulative_risk_score?: Long,
+    session_injection_detected?: Bool,
+    session_command_injection?: Bool,
+    session_pii_detected?: Bool,
+    session_pii_types?: Set<String>,
+    session_secrets_detected?: Bool,
+    session_secret_types?: Set<String>,
+    session_max_injection_score?: Long,
+    session_max_jailbreak_score?: Long,
+    session_max_command_injection_score?: Long,
+    session_max_pii_score?: Long,
+    session_max_secret_score?: Long,
+
+    // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
+    rpm_remaining_pct?: Long,
+    rpm_exceeded?: Bool,
+    tpm_remaining_pct?: Long,
+    tpm_exceeded?: Bool,
+  },
+};
+
 // Shared content-inspection context.
 //
 // Prompts and responses are inspected by the same detector pipeline and so
@@ -361,7 +463,8 @@ type ContentInspectionContext = {
     tpm_exceeded?: Bool,
 };
 
-// Process a prompt (MCP prompts/get or LLM chat completions)
+// Process a prompt (MCP prompts/get or LLM chat completions).
+// Enumeration (prompts/list) is the `list` action.
 // Threat focus: injection, jailbreak, secrets, PII, content safety
 action process_prompt appliesTo {
   principal: [User, MCP_Client],
@@ -384,7 +487,8 @@ action process_response appliesTo {
   context: ContentInspectionContext,
 };
 
-// Read an MCP resource (resources/read, resources/list)
+// Read an MCP resource (resources/read). Enumeration (resources/list)
+// is the `list` action.
 // Threat focus: secrets exposure, PII exposure, sensitive paths
 action read_file appliesTo {
   principal: [User, MCP_Client],