@highflame/policy 2.2.41 → 2.2.43

package/_schemas/guardrails/context.json

@@ -25,12 +25,6 @@
           "required": false,
           "description": "Principal identity class projected from the token: 'human', 'agent', or 'service'. Use to apply identity-class-specific policies"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id). Absent when the token carries no principal claim"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -696,12 +690,6 @@
           "required": false,
           "description": "Principal identity class projected from the token: 'human', 'agent', or 'service'. Use to apply identity-class-specific policies"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id). Absent when the token carries no principal claim"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -1367,12 +1355,6 @@
           "required": false,
           "description": "Principal identity class projected from the token: 'human', 'agent', or 'service'. Use to apply identity-class-specific policies"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id). Absent when the token carries no principal claim"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -2098,12 +2080,6 @@
           "required": false,
           "description": "Principal identity class projected from the token: 'human', 'agent', or 'service'. Use to apply identity-class-specific policies"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id). Absent when the token carries no principal claim"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -2345,12 +2321,6 @@
           "required": false,
           "description": "Principal identity class projected from the token: 'human', 'agent', or 'service'. Use to apply identity-class-specific policies"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id). Absent when the token carries no principal claim"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -2605,12 +2575,6 @@
           "required": false,
           "description": "Principal identity class projected from the token: 'human', 'agent', or 'service'. Use to apply identity-class-specific policies"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id). Absent when the token carries no principal claim"
-        },
         {
           "key": "request_id",
           "type": "string",

package/_schemas/guardrails/detectors.json

@@ -1742,7 +1742,6 @@
     "param_type_violation",
     "param_type_violations",
     "path",
-    "principal",
     "privilege_scope",
     "request_id",
     "role",

package/_schemas/guardrails/schema.cedarschema

@@ -105,6 +105,44 @@ namespace Guardrails {
     // Context Types (Action-Specific)
     // =========================================================================
 
+    /// The ZeroID NHI principal block (ADR 0009 / CAP-IDN-011).
+    ///
+    /// A record, not a string: Shield projects the whole identity block under
+    /// `context.principal`, so policies read members off it —
+    ///
+    ///   permit ... when { context has principal &&
+    ///                     context.principal.trust_level == "first_party" };
+    ///   forbid ... unless { context has principal &&
+    ///                       context.principal has act_sub };
+    ///
+    /// Declared once and shared by every action context so a new member cannot
+    /// land on one action and go missing on another.
+    ///
+    /// `act` (RFC 8693 delegation) is flattened to `act_sub` / `act_iss`
+    /// because Cedar records are flat key/value at each level; the full
+    /// delegation tree is reconstructable audit-side by joining on `mission_id`.
+    ///
+    /// Every member is optional except `delegation_depth`: the projector omits
+    /// a field whose value is empty, but always emits the depth because zero is
+    /// the meaningful base case for a direct (non-delegated) token. The record
+    /// itself is optional — it is absent, not empty, when the request carries no
+    /// NHI claims (RS256 human tokens, internal-service callers), so
+    /// `context has principal` is false rather than true-but-empty.
+    type PrincipalContext = {
+        "identity_type"?: String,      // "human" | "agent" | "service"
+        "sub_type"?: String,           // Identity subtype (e.g. "coding_agent")
+        "trust_level"?: String,        // "first_party" | "verified" | "unverified"
+        "framework"?: String,          // Agent framework (e.g. "langchain")
+        "publisher"?: String,          // Agent publisher
+        "capabilities"?: Set<String>,  // Capabilities granted to the identity
+        "scopes"?: Set<String>,        // OAuth scopes carried by the token
+        "delegation_depth": Long,      // Delegation hops; 0 for a direct token
+        "act_sub"?: String,            // RFC 8693 actor — the accountable human
+        "act_iss"?: String,            // Issuer of the actor claim
+        "mission_id"?: String,         // Correlates one delegation tree
+        "grant_type"?: String,         // How the token was obtained (e.g. "api_key")
+    };
+
     /// Context for the process_response action.
     ///
     /// An alias, not a copy: prompts and responses are inspected by the same
@@ -121,7 +159,7 @@ namespace Guardrails {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
-        "principal"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -273,7 +311,7 @@ namespace Guardrails {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
-        "principal"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -469,7 +507,7 @@ namespace Guardrails {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
-        "principal"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -542,7 +580,7 @@ namespace Guardrails {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
-        "principal"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -619,7 +657,7 @@ namespace Guardrails {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
-        "principal"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,

package/_schemas/guardrails/templates/dual_attribution.cedar

@@ -0,0 +1,110 @@
+// =============================================================================
+// Dual Attribution
+// =============================================================================
+// Blocks privileged agent actions that cannot be attributed to a human. "Which
+// agent did this?" is half an answer; the other half is "on whose behalf?" An
+// agent is not an accountable party — the person who pointed it at the work
+// is. Shield projects both sides of that pair, so the requirement can be a
+// policy rather than a reporting convention nobody enforces.
+//
+// The agent comes from the authenticated identity, never from the request
+// body: agent_id, agent_type, agent_trust_level, agent_framework. The human
+// comes from the identity claims on the credential, as the `principal` record
+// — its `act_sub` field names the party the agent is acting for.
+//
+// Deploy in MONITOR mode first. Section 2 blocks unverified agents, and a
+// service key authenticates as unverified until the agent is registered and
+// adopted in Studio. Monitor records what each rule would have blocked on
+// every event without blocking anything; register the agent, then switch to
+// enforce.
+//
+// Detection layers:
+//   - agent identity (authentication layer, always available)
+//   - tool_validator (tool_is_sensitive, tool_category, always available)
+//
+// Context keys consumed:
+//   - agent_id, agent_type, agent_trust_level: String
+//   - principal: record — act_sub names the accountable human
+//   - tool_is_sensitive: Bool
+//   - tool_category: String
+//
+// Compliance:
+//   - OWASP ASI01, OWASP ASI04
+//
+// Category:  agent-identity
+// Namespace: Guardrails
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: No unattributed privileged action
+// `unless` because the rule must fire when attribution is ABSENT, and an
+// absent field cannot be compared — only tested for.
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.require-principal-for-sensitive-tools")
+@name("Block sensitive agent tools without a principal")
+@description("Blocks call_tool on a sensitive tool by an agent unless the credential carries a principal whose act_sub names the human the agent acts for.")
+@severity("critical")
+@tags("category:agent-identity,detection:rule,surface:call-tool,scope:per-agent,posture:deny-default,owasp:asi01")
+@reject_message("Tool execution blocked: this agent invoked a sensitive tool with no accountable human attached. Every privileged agent action must name the person it acts for.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_id && context.agent_id != "" &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+}
+unless {
+    context has principal && context.principal has act_sub
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Trust level gates the blast radius
+// Start in monitor: a service key is unverified until the agent is adopted.
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.block-unverified-agent-sensitive-tools")
+@name("Block unverified agents from sensitive tools")
+@description("Blocks call_tool when agent_trust_level is unverified and the tool is sensitive or dangerous.")
+@severity("critical")
+@tags("category:agent-identity,detection:rule,surface:call-tool,scope:per-agent,posture:deny-default,owasp:asi01")
+@reject_message("Tool execution blocked: unverified agents may not call sensitive or dangerous tools. Register and adopt the agent to raise its trust level.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
+    (
+        (context has tool_is_sensitive && context.tool_is_sensitive == true) ||
+        (context has tool_category && context.tool_category == "dangerous")
+    )
+};
+
+// ---------------------------------------------------------------------------
+// Section 3: Autonomous agents get a higher bar
+// Nobody watches an autonomous agent in real time, so a sensitive tool call
+// from one requires first-party trust rather than merely "not unverified".
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.restrict-autonomous-agent-sensitive-tools")
+@name("Block non-first-party autonomous agent tool use")
+@description("Blocks call_tool on a sensitive tool when agent_type is autonomous unless agent_trust_level is first_party.")
+@severity("high")
+@tags("category:agent-identity,threat:escalation,detection:rule,surface:call-tool,scope:per-agent,owasp:asi04")
+@reject_message("Tool execution blocked: autonomous agents must be first-party to call sensitive tools. No human is in the loop to catch a mistake.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_type && context.agent_type == "autonomous" &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+}
+unless {
+    context has agent_trust_level && context.agent_trust_level == "first_party"
+};

package/_schemas/guardrails/templates/multi_turn_trajectory.cedar

@@ -0,0 +1,116 @@
+// =============================================================================
+// Multi-Turn Trajectory Escalation
+// =============================================================================
+// Blocks a conversation whose TRAJECTORY is an attack, even when no single
+// message is. A crescendo attack never sends a message alarming enough to
+// block on its own; it walks the model there in small, plausible steps and
+// asks for the payoff in a sentence that would pass any single-message filter.
+//
+// Shield scores every turn twice and exposes both scores separately:
+//   - injection_pulse_score / jailbreak_pulse_score — the single-turn
+//     classifier. Sees only the current message.
+//   - injection_deep_context_score / jailbreak_deep_context_score — the
+//     multi-turn model, which carries hidden state across turns keyed on
+//     session_id. Sees the whole conversation.
+//
+// Because they are separate keys, a rule can fire on the GAP between them:
+// high trajectory score, low message score. In plain language, "the history
+// is an attack and this message is not" — a condition a filter that only ever
+// has one number cannot express. Section 1 is that rule. Section 2 is a safety
+// net for a trajectory blatant enough to stand on its own.
+//
+// Requires a stable session_id on every request in the conversation. With no
+// session_id there is no threaded state, multi_turn_detection is false, and
+// none of these rules can fire.
+//
+// Detection layers:
+//   - injection (single-turn classifier, always available)
+//   - deepcontext (multi-turn model, always available)
+//
+// Context keys consumed:
+//   - multi_turn_detection: Bool — true only when threaded state was used
+//   - injection_deep_context_score, injection_pulse_score: Long (0-100)
+//   - jailbreak_deep_context_score, jailbreak_pulse_score: Long (0-100)
+//
+// Compliance:
+//   - OWASP LLM01, OWASP LLM02, MITRE ATLAS AML.T0051, AML.T0054
+//
+// Category:  security
+// Namespace: Guardrails
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: Trajectory/turn divergence
+// The conversation scores as an attack; this message does not.
+// ---------------------------------------------------------------------------
+
+@id("security.block-trajectory-injection-divergence")
+@name("Block multi-turn injection the current turn hides")
+@description("Blocks process_prompt and process_response when threaded state is in use, injection_deep_context_score >= 60, and injection_pulse_score <= 39.")
+@severity("critical")
+@tags("category:security,threat:injection,detection:ml,surface:process-prompt,surface:process-response,scope:multi-turn,owasp:llm01,mitre:atlas-t0051")
+@reject_message("Prompt blocked: this conversation is a progressive prompt-injection attempt. No single message crossed the line; the sequence did.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
+    resource
+)
+when {
+    context has multi_turn_detection && context.multi_turn_detection == true &&
+    context has injection_deep_context_score && context.injection_deep_context_score >= 60 &&
+    context has injection_pulse_score && context.injection_pulse_score <= 39
+};
+
+@id("security.block-trajectory-jailbreak-divergence")
+@name("Block multi-turn jailbreak the current turn hides")
+@description("Blocks process_prompt and process_response when threaded state is in use, jailbreak_deep_context_score >= 60, and jailbreak_pulse_score <= 39.")
+@severity("critical")
+@tags("category:security,threat:jailbreak,detection:ml,surface:process-prompt,surface:process-response,scope:multi-turn,owasp:llm02,mitre:atlas-t0054")
+@reject_message("Prompt blocked: this conversation is a progressive jailbreak. No single message crossed the line; the sequence did.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
+    resource
+)
+when {
+    context has multi_turn_detection && context.multi_turn_detection == true &&
+    context has jailbreak_deep_context_score && context.jailbreak_deep_context_score >= 60 &&
+    context has jailbreak_pulse_score && context.jailbreak_pulse_score <= 39
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Blatant trajectory, regardless of the message score
+// Covers the band between Section 1 and the default single-turn thresholds.
+// ---------------------------------------------------------------------------
+
+@id("security.block-trajectory-injection-high")
+@name("Block high-confidence multi-turn injection")
+@description("Blocks process_prompt and process_response when threaded state is in use and injection_deep_context_score >= 75.")
+@severity("high")
+@tags("category:security,threat:injection,detection:ml,surface:process-prompt,surface:process-response,scope:multi-turn,owasp:llm01")
+@reject_message("Prompt blocked: the multi-turn model scored this conversation as a prompt-injection attempt with high confidence.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
+    resource
+)
+when {
+    context has multi_turn_detection && context.multi_turn_detection == true &&
+    context has injection_deep_context_score && context.injection_deep_context_score >= 75
+};
+
+@id("security.block-trajectory-jailbreak-high")
+@name("Block high-confidence multi-turn jailbreak")
+@description("Blocks process_prompt and process_response when threaded state is in use and jailbreak_deep_context_score >= 75.")
+@severity("high")
+@tags("category:security,threat:jailbreak,detection:ml,surface:process-prompt,surface:process-response,scope:multi-turn,owasp:llm02")
+@reject_message("Prompt blocked: the multi-turn model scored this conversation as a jailbreak attempt with high confidence.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
+    resource
+)
+when {
+    context has multi_turn_detection && context.multi_turn_detection == true &&
+    context has jailbreak_deep_context_score && context.jailbreak_deep_context_score >= 75
+};

package/_schemas/guardrails/templates/profiles/output_protection/credentials.cedar

@@ -0,0 +1,35 @@
+// =============================================================================
+// Output Protection — Credentials
+// =============================================================================
+// Split from data_leakage.cedar: secrets are category `data-protection`, PII is
+// `privacy`, and a template wrapper may only carry rules of its own category
+// (HFP-LINT-TMPL-006). Relabelling one to fit the other would put a wrong
+// category on the wire, where it drives signals[] and the severity rollup.
+//
+// Same scoping rule as the rest of this profile — process_response ALONE, so a
+// tenant can police what the model says without touching what users send.
+//
+// Context keys consumed:
+//   - secrets_detected:  Bool
+//
+// Compliance:
+//   - OWASP LLM02 (Sensitive Information Disclosure)
+//
+// Category:  data-protection
+// Namespace: Guardrails
+// =============================================================================
+
+@id("data-protection.output-block-secrets")
+@name("Block secrets in model responses")
+@description("Blocks process_response when the model's own output contains credentials, API keys or tokens — the canonical way a leaked secret reaches a caller.")
+@severity("critical")
+@tags("category:data-protection,threat:secrets,surface:process-response,detection:rule,owasp:llm02")
+@reject_message("Response blocked: the model's output contained credentials.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has secrets_detected && context.secrets_detected == true
+};

package/_schemas/guardrails/templates/profiles/output_protection/data_leakage.cedar

@@ -0,0 +1,63 @@
+// =============================================================================
+// Output Protection — Data Leakage
+// =============================================================================
+// Guards what the MODEL SAYS BACK, not what the user sends in.
+//
+// Every other guardrails template binds process_response alongside
+// process_prompt and the tool/file actions, which is right for a threat that
+// is the same in both directions. Data leakage is not that: the risk is
+// specific to egress, and a tenant who wants to police only their outputs had
+// no template to enable. That gap is why one deployed tenant hand-authored a
+// rule named "Block PII in outputs" and bound it to process_prompt — the only
+// action that covered responses before the direction split (ADR 0031).
+//
+// These rules bind process_response ALONE. That is the point: ADR 0031 created
+// the distinct trigger precisely so a policy could be scoped to one direction
+// from its head, and this profile is what that is for. Enabling it cannot
+// change how prompts are treated.
+//
+// Context keys consumed:
+//   - pii_detected:      Bool
+//   - pii_count:         Long
+//
+// Compliance:
+//   - OWASP LLM02 (Sensitive Information Disclosure), OWASP LLM06
+//
+// Category:  privacy
+// Namespace: Guardrails
+// =============================================================================
+
+@id("privacy.output-block-pii")
+@name("Block PII in model responses")
+@description("Blocks process_response when the model's own output contains PII. Scoped to the response direction only — prompts are unaffected.")
+@severity("high")
+@tags("category:privacy,threat:data-leak,surface:process-response,detection:rule,owasp:llm02")
+@reject_message("Response blocked: the model's output contained personal data.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has pii_detected && context.pii_detected == true
+};
+
+// Bulk disclosure is a separate finding from a single incidental match: a
+// response carrying many distinct PII items is an exfiltration shape rather
+// than a mention, and is worth its own severity and message even though the
+// rule above already blocks it. Kept as a distinct rule so a tenant running
+// the first in monitor mode can still enforce on bulk.
+@id("privacy.output-block-bulk-pii")
+@name("Block bulk PII disclosure in model responses")
+@description("Blocks process_response when the output carries five or more PII items — a disclosure shape rather than an incidental mention.")
+@severity("critical")
+@tags("category:privacy,threat:data-leak,surface:process-response,detection:rule,owasp:llm06")
+@reject_message("Response blocked: the model's output contained bulk personal data.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has pii_count && context.pii_count >= 5
+};

package/_schemas/guardrails/templates/profiles/output_protection/harmful_content.cedar

@@ -0,0 +1,58 @@
+// =============================================================================
+// Output Protection — Harmful Content
+// =============================================================================
+// The companion to data_leakage.cedar: what the model says back, judged for
+// safety rather than for disclosure.
+//
+// Same scoping rule and same reason — process_response ALONE (ADR 0031). A
+// tenant enabling this is saying "hold my model's answers to a standard",
+// which is a different decision from "police what users send me", and the two
+// should be separately enableable.
+//
+// Thresholds match the org-wide toxicity defaults rather than tightening them.
+// An output profile that silently enforced stricter limits than the tenant's
+// existing prompt rules would surprise anyone comparing the two.
+//
+// Context keys consumed:
+//   - violence_score:     Long (0-100)
+//   - hate_speech_score:  Long (0-100)
+//   - sexual_score:       Long (0-100)
+//   - injection_score:    Long (0-100)
+//
+// Compliance:
+//   - OWASP LLM05 (Improper Output Handling), OWASP LLM01
+//
+// Category:  trust-safety
+// Namespace: Guardrails
+// =============================================================================
+
+@id("trust-safety.output-block-toxic")
+@name("Block toxic model responses")
+@description("Blocks process_response when the model's own output scores high for violence or hate speech.")
+@severity("high")
+@tags("category:trust-safety,threat:harmful,surface:process-response,detection:ml,owasp:llm05")
+@reject_message("Response blocked: the model's output was flagged as harmful.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has violence_score && context.violence_score >= 70 ||
+    context has hate_speech_score && context.hate_speech_score >= 70
+};
+
+@id("trust-safety.output-block-sexual")
+@name("Block sexual content in model responses")
+@description("Blocks process_response when the model's own output scores high for sexual content.")
+@severity("critical")
+@tags("category:trust-safety,threat:sexual,surface:process-response,detection:ml,owasp:llm05")
+@reject_message("Response blocked: the model's output was flagged as explicit.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has sexual_score && context.sexual_score >= 91
+};

package/_schemas/guardrails/templates/profiles/output_protection/injection_carried_back.cedar

@@ -0,0 +1,39 @@
+// =============================================================================
+// Output Protection — Injection Carried Back
+// =============================================================================
+// Split from harmful_content.cedar because its category is `security`, not
+// `trust-safety`, and a template wrapper may only carry rules of its own
+// category (HFP-LINT-TMPL-006). The split is the honest outcome: this is a
+// different threat with a different owner, not a toxicity variant.
+//
+// Same scoping rule as the rest of this profile — process_response ALONE.
+//
+// Context keys consumed:
+//   - injection_score:  Long (0-100)
+//
+// Compliance:
+//   - OWASP LLM05 (Improper Output Handling)
+//
+// Category:  security
+// Namespace: Guardrails
+// =============================================================================
+
+// Injection scored on an OUTPUT is a different finding from injection scored on
+// a prompt. On the way in it is a user attacking the model; on the way out it
+// is content the model is handing to the caller — a downstream agent, a
+// renderer, or another tool — which is OWASP LLM05's improper output handling.
+// Worth its own rule so the two can be tuned and reasoned about separately.
+@id("security.output-block-injection-carried-back")
+@name("Block injection payloads carried back in model responses")
+@description("Blocks process_response when the output itself scores as an injection payload — content the caller may execute or forward.")
+@severity("high")
+@tags("category:security,threat:injection,surface:process-response,detection:ml,owasp:llm05")
+@reject_message("Response blocked: the model's output contained an injection payload.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has injection_score && context.injection_score >= 80
+};