@highflame/policy 2.2.41 → 2.2.43

package/_schemas/guardrails/templates/session_risk_accumulation.cedar

@@ -0,0 +1,103 @@
+// =============================================================================
+// Session Risk Accumulation
+// =============================================================================
+// Blocks the privileged action a probing conversation is working toward. A
+// patient attacker expects some turns to be refused; what they want is one
+// tool call at the end — send the email, move the money, read the file. So
+// the useful question at a tool call is not "is this call suspicious?" but
+// "what has this conversation been doing up to now?"
+//
+// Shield accumulates that history on the session and projects it three ways,
+// because attackers come in three shapes:
+//   - session_max_* — a high-water mark that never decays. "Did this session
+//     EVER cross a line?" Catches the attacker who probes hard, is refused,
+//     goes quiet, then calmly asks for the tool.
+//   - session_cumulative_risk_score — an uncapped running sum. "How much
+//     total pressure has this session applied?" Catches death by a thousand
+//     cuts, where no single turn is alarming.
+//   - session_threat_turns — a count of turns that tripped a detector. "Is
+//     this sustained, or a one-off?" Separates probing from a false positive.
+//
+// Requires a stable session_id on every request, prompts AND tool calls. The
+// tool call must ride the same session as the conversation, or it reads 0.
+//
+// Detection layers:
+//   - session (aggregate over detection history, always available)
+//   - tool_validator (tool_is_sensitive, always available)
+//
+// Context keys consumed:
+//   - session_max_injection_score, session_max_jailbreak_score: Long (0-100)
+//   - session_cumulative_risk_score: Long — uncapped sum
+//   - session_threat_turns: Long — count
+//   - tool_is_sensitive: Bool
+//
+// Compliance:
+//   - OWASP LLM01, OWASP LLM06, OWASP ASI01, OWASP ASI04
+//
+// Category:  agent-security
+// Namespace: Guardrails
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: A session that ever crossed the line does not get to act
+// The conversation is what scored high; the tool call is what gets stopped.
+// ---------------------------------------------------------------------------
+
+@id("agent-security.block-tool-after-injection-in-session")
+@name("Block tools after an injection or jailbreak in the session")
+@description("Blocks call_tool when session_max_injection_score >= 60 or session_max_jailbreak_score >= 60, because an earlier turn attempted injection or jailbreak.")
+@severity("critical")
+@tags("category:agent-security,threat:escalation,detection:aggregate,surface:call-tool,scope:multi-turn,owasp:llm01")
+@reject_message("Tool execution blocked: an earlier turn in this session attempted prompt injection or jailbreak. Start a new session to use tools.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    (context has session_max_injection_score && context.session_max_injection_score >= 60) ||
+    (context has session_max_jailbreak_score && context.session_max_jailbreak_score >= 60)
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Accumulated pressure gates sensitive tools
+// No single turn set a max, but the session as a whole kept pushing.
+// ---------------------------------------------------------------------------
+
+@id("agent-security.block-sensitive-tool-on-session-risk")
+@name("Block sensitive tools once the session has accumulated risk")
+@description("Blocks call_tool when session_cumulative_risk_score >= 151 and tool_is_sensitive is true.")
+@severity("high")
+@tags("category:agent-security,threat:escalation,detection:aggregate,surface:call-tool,scope:multi-turn,owasp:asi01")
+@reject_message("Tool execution blocked: this session has accumulated significant risk across earlier turns. Sensitive tools are withheld for the remainder of the session.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has session_cumulative_risk_score &&
+    context.session_cumulative_risk_score >= 151 &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+};
+
+// ---------------------------------------------------------------------------
+// Section 3: Sustained probing, independent of any single score
+// Two is the smallest bar that separates repeated from one-off. Long-running
+// agent sessions accumulate turns faster and warrant a higher bar.
+// ---------------------------------------------------------------------------
+
+@id("agent-security.block-tool-on-repeated-threat-turns")
+@name("Block tool use in a session with repeated threat turns")
+@description("Blocks call_tool when session_threat_turns >= 2, because more than one turn in this session tripped a detector.")
+@severity("high")
+@tags("category:agent-security,threat:escalation,detection:aggregate,surface:call-tool,scope:multi-turn,owasp:asi04")
+@reject_message("Tool execution blocked: more than one turn in this session tripped a detector. This is sustained probing, not a one-off false positive.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has session_threat_turns && context.session_threat_turns >= 2
+};

package/_schemas/guardrails/templates/templates.json

@@ -60,7 +60,10 @@
       "category": "organization",
       "file": "defaults/baseline.cedar",
       "severity": "low",
-      "tags": ["category:organization", "posture:permit-default"],
+      "tags": [
+        "category:organization",
+        "posture:permit-default"
+      ],
       "is_active": true
     }
   ],
@@ -72,7 +75,10 @@
       "category": "organization",
       "file": "defaults/baseline.cedar",
       "severity": "low",
-      "tags": ["category:organization", "posture:permit-default"],
+      "tags": [
+        "category:organization",
+        "posture:permit-default"
+      ],
       "auto_deploy": true
     },
     {
@@ -82,7 +88,11 @@
       "category": "data-protection",
       "file": "defaults/secrets.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
     },
     {
       "id": "security.injection",
@@ -226,7 +236,11 @@
       "category": "agent-identity",
       "file": "defaults/agent_identity.cedar",
       "severity": "critical",
-      "tags": ["category:agent-identity", "scope:per-agent", "owasp:llm01"]
+      "tags": [
+        "category:agent-identity",
+        "scope:per-agent",
+        "owasp:llm01"
+      ]
     },
     {
       "id": "tools.mcp-tool-permissions",
@@ -235,7 +249,11 @@
       "category": "tools",
       "file": "mcp_tool_permissions.cedar",
       "severity": "critical",
-      "tags": ["category:tools", "threat:supply-chain", "posture:deny-default"]
+      "tags": [
+        "category:tools",
+        "threat:supply-chain",
+        "posture:deny-default"
+      ]
     },
     {
       "id": "tools.mcp-server-allowlist",
@@ -285,7 +303,10 @@
       "category": "data-protection",
       "file": "profiles/code_agent/security.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets"
+      ]
     },
     {
       "id": "security.code-agent-encoding",
@@ -307,7 +328,11 @@
       "category": "security",
       "file": "profiles/code_agent/path_security.cedar",
       "severity": "critical",
-      "tags": ["category:security", "threat:secrets", "threat:path-traversal"]
+      "tags": [
+        "category:security",
+        "threat:secrets",
+        "threat:path-traversal"
+      ]
     },
     {
       "id": "agent-security.code-agent",
@@ -346,7 +371,11 @@
       "category": "data-protection",
       "file": "profiles/data_pipeline/data_protection.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
     },
     {
       "id": "security.data-pipeline-block-injection",
@@ -355,7 +384,11 @@
       "category": "security",
       "file": "profiles/data_pipeline/security.cedar",
       "severity": "high",
-      "tags": ["category:security", "threat:injection", "owasp:llm01"]
+      "tags": [
+        "category:security",
+        "threat:injection",
+        "owasp:llm01"
+      ]
     },
     {
       "id": "agent-security.data-pipeline",
@@ -364,7 +397,10 @@
       "category": "agent-security",
       "file": "profiles/data_pipeline/agentic_security.cedar",
       "severity": "critical",
-      "tags": ["category:agent-security", "threat:exfiltration"]
+      "tags": [
+        "category:agent-security",
+        "threat:exfiltration"
+      ]
     },
     {
       "id": "agent-identity.multi-agent-trust",
@@ -473,7 +509,11 @@
       "category": "data-protection",
       "file": "profiles/advanced_detection/secrets.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
     },
     {
       "id": "privacy.advanced-pii",
@@ -503,6 +543,112 @@
         "aarm:r3",
         "posture:deny-default"
       ]
+    },
+    {
+      "id": "privacy.output-protection",
+      "name": "Output Protection — Data Leakage",
+      "description": "Block PII, secrets and bulk disclosure in the model's own responses. Scoped to the response direction only, so prompts are unaffected.",
+      "category": "privacy",
+      "file": "profiles/output_protection/data_leakage.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:privacy",
+        "threat:data-leak",
+        "surface:process-response",
+        "detection:rule"
+      ]
+    },
+    {
+      "id": "trust-safety.output-protection",
+      "name": "Output Protection — Harmful Content",
+      "description": "Hold the model's own responses to a safety standard: toxicity, explicit content, and injection payloads carried back to the caller. Response direction only.",
+      "category": "trust-safety",
+      "file": "profiles/output_protection/harmful_content.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:trust-safety",
+        "threat:harmful",
+        "surface:process-response",
+        "detection:ml"
+      ]
+    },
+    {
+      "id": "security.output-block-injection-carried-back",
+      "name": "Output Protection — Injection Carried Back",
+      "description": "Block responses that themselves score as an injection payload — content a caller, downstream agent or renderer may execute. Response direction only.",
+      "category": "security",
+      "file": "profiles/output_protection/injection_carried_back.cedar",
+      "severity": "high",
+      "tags": [
+        "category:security",
+        "threat:injection",
+        "surface:process-response",
+        "detection:ml"
+      ]
+    },
+    {
+      "id": "data-protection.output-block-secrets",
+      "name": "Output Protection — Credentials",
+      "description": "Block responses whose own content contains credentials, API keys or tokens — the canonical way a leaked secret reaches a caller. Response direction only.",
+      "category": "data-protection",
+      "file": "profiles/output_protection/credentials.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "surface:process-response",
+        "detection:rule"
+      ]
+    },
+    {
+      "id": "security.multi-turn-trajectory",
+      "name": "Multi-Turn Trajectory Escalation",
+      "description": "Block a conversation whose trajectory is an attack even when no single message is: fires on the gap between the multi-turn model and the single-turn classifier.",
+      "category": "security",
+      "file": "multi_turn_trajectory.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:security",
+        "threat:injection",
+        "threat:jailbreak",
+        "detection:ml",
+        "scope:multi-turn",
+        "owasp:llm01",
+        "owasp:llm02"
+      ]
+    },
+    {
+      "id": "agent-security.session-risk-accumulation",
+      "name": "Session Risk Accumulation",
+      "description": "Block the privileged action a probing conversation is working toward, using the session's high-water mark, cumulative risk, and count of threat turns.",
+      "category": "agent-security",
+      "file": "session_risk_accumulation.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-security",
+        "threat:escalation",
+        "detection:aggregate",
+        "surface:call-tool",
+        "scope:multi-turn",
+        "owasp:asi01",
+        "owasp:asi04"
+      ]
+    },
+    {
+      "id": "agent-identity.dual-attribution",
+      "name": "Dual Attribution",
+      "description": "Block privileged agent actions that cannot be attributed to a human. Deploy in monitor mode first; a service key is unverified until the agent is adopted.",
+      "category": "agent-identity",
+      "file": "dual_attribution.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-identity",
+        "detection:rule",
+        "surface:call-tool",
+        "scope:per-agent",
+        "posture:deny-default",
+        "owasp:asi01"
+      ]
     }
   ]
 }

package/_schemas/overwatch/context.json

@@ -333,6 +333,19 @@
           "type": "number",
           "required": false,
           "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
+        },
+        {
+          "key": "budget_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining session token budget as a percentage (0-100). Optional, so a policy must guard it: `context has budget_remaining_pct && context.budget_remaining_pct < 10` — a bare comparison fails Cedar validation. Runtime default-fills it to 100 whenever the detector runs, so a high value is not evidence that a budget rule exists.",
+          "range": "0-100"
+        },
+        {
+          "key": "budget_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the session token budget has been exceeded. Optional, so a policy must guard it with `context has budget_exceeded`. The guard is a validation requirement, not a fail-closed property: the detector emits false whenever a session loads, including when no budget rule is configured, so a grant conditioned on `!context.budget_exceeded` will fire on unbudgeted sessions."
         }
       ]
     },
@@ -854,6 +867,19 @@
           "type": "number",
           "required": false,
           "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
+        },
+        {
+          "key": "budget_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining session token budget as a percentage (0-100). Optional, so a policy must guard it: `context has budget_remaining_pct && context.budget_remaining_pct < 10` — a bare comparison fails Cedar validation. Runtime default-fills it to 100 whenever the detector runs, so a high value is not evidence that a budget rule exists.",
+          "range": "0-100"
+        },
+        {
+          "key": "budget_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the session token budget has been exceeded. Optional, so a policy must guard it with `context has budget_exceeded`. The guard is a validation requirement, not a fail-closed property: the detector emits false whenever a session loads, including when no budget rule is configured, so a grant conditioned on `!context.budget_exceeded` will fire on unbudgeted sessions."
         }
       ]
     },
@@ -1285,6 +1311,19 @@
           "type": "number",
           "required": false,
           "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
+        },
+        {
+          "key": "budget_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining session token budget as a percentage (0-100). Optional, so a policy must guard it: `context has budget_remaining_pct && context.budget_remaining_pct < 10` — a bare comparison fails Cedar validation. Runtime default-fills it to 100 whenever the detector runs, so a high value is not evidence that a budget rule exists.",
+          "range": "0-100"
+        },
+        {
+          "key": "budget_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the session token budget has been exceeded. Optional, so a policy must guard it with `context has budget_exceeded`. The guard is a validation requirement, not a fail-closed property: the detector emits false whenever a session loads, including when no budget rule is configured, so a grant conditioned on `!context.budget_exceeded` will fire on unbudgeted sessions."
         }
       ]
     },
@@ -1494,6 +1533,19 @@
           "type": "number",
           "required": false,
           "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
+        },
+        {
+          "key": "budget_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining session token budget as a percentage (0-100). Optional, so a policy must guard it: `context has budget_remaining_pct && context.budget_remaining_pct < 10` — a bare comparison fails Cedar validation. Runtime default-fills it to 100 whenever the detector runs, so a high value is not evidence that a budget rule exists.",
+          "range": "0-100"
+        },
+        {
+          "key": "budget_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the session token budget has been exceeded. Optional, so a policy must guard it with `context has budget_exceeded`. The guard is a validation requirement, not a fail-closed property: the detector emits false whenever a session loads, including when no budget rule is configured, so a grant conditioned on `!context.budget_exceeded` will fire on unbudgeted sessions."
         }
       ]
     },
@@ -1709,6 +1761,19 @@
           "type": "number",
           "required": false,
           "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
+        },
+        {
+          "key": "budget_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining session token budget as a percentage (0-100). Optional, so a policy must guard it: `context has budget_remaining_pct && context.budget_remaining_pct < 10` — a bare comparison fails Cedar validation. Runtime default-fills it to 100 whenever the detector runs, so a high value is not evidence that a budget rule exists.",
+          "range": "0-100"
+        },
+        {
+          "key": "budget_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the session token budget has been exceeded. Optional, so a policy must guard it with `context has budget_exceeded`. The guard is a validation requirement, not a fail-closed property: the detector emits false whenever a session loads, including when no budget rule is configured, so a grant conditioned on `!context.budget_exceeded` will fire on unbudgeted sessions."
         }
       ]
     }

package/_schemas/overwatch/detectors.json

@@ -299,6 +299,47 @@
         }
       ]
     },
+    {
+      "id": "budget_checker",
+      "stability": "stable",
+      "tier": "fast",
+      "description": "Tracks cumulative session token consumption against a configured budget. On the IDE surface the total is reported by the Overwatch daemon on the prompt and before-tool events (cerberus#147); only the token-budget attributes apply here, not the gateway-metered RPM/TPM ones.",
+      "producesAttrs": [
+        {
+          "name": "budget_remaining_pct",
+          "type": "Long",
+          "semantic": "severity_0_100",
+          "description": "Remaining session token budget (0-100). Default-filled to 100 when no metering ran."
+        },
+        {
+          "name": "budget_exceeded",
+          "type": "Bool",
+          "semantic": "boolean_flag",
+          "description": "True iff the session token budget has been exceeded. Absent when no metering ran, so policies must guard with `context has`."
+        }
+      ],
+      "supportedModes": [
+        "enforce",
+        "monitor",
+        "alert"
+      ],
+      "modifyContract": null,
+      "displayName": "Budget Checker",
+      "category": "agent_behavior",
+      "defendsAgainst": [
+        "unbounded_consumption"
+      ],
+      "exampleAttacks": [
+        {
+          "title": "Runaway autonomous session",
+          "vulnerabilityId": "unbounded_consumption",
+          "snippet": "(agentic) one prompt drives hundreds of tool calls, burning the session's token budget unattended",
+          "expectedSignal": {
+            "budget_exceeded": true
+          }
+        }
+      ]
+    },
     {
       "id": "tool_risk",
       "stability": "stable",
@@ -870,6 +911,12 @@
     "workspace_root"
   ],
   "fieldToDetectorIds": {
+    "budget_exceeded": [
+      "budget_checker"
+    ],
+    "budget_remaining_pct": [
+      "budget_checker"
+    ],
     "crime_score": [
       "toxicity"
     ],

package/_schemas/overwatch/schema.cedarschema

@@ -151,6 +151,24 @@ action process_prompt appliesTo {
     // --- Legacy ---
     prompt_text?: String,             // Same as content (backward compatibility)
     response_content?: String,        // Response content (if available)
+    // --- Session Token Budget --- (OWASP LLM10; CAP-ENF-009, cerberus#147)
+    // Fed by the cumulative session total the Overwatch daemon reports on the
+    // prompt and before-tool events.
+    //
+    // BOTH are optional, so BOTH need a `has` guard — a bare
+    // `context.budget_remaining_pct < 10` fails cedar validation with
+    // "unable to guarantee safety of access to optional attribute".
+    // Write: `context has budget_remaining_pct && context.budget_remaining_pct < 10`.
+    //
+    // The guard is a validation requirement, NOT a safety property. Whenever a
+    // session loads, budget_checker emits both keys — including
+    // budget_exceeded: false and budget_remaining_pct: 100 when no budget rule
+    // is configured for the scope. So a grant conditioned on
+    // `!context.budget_exceeded` fires on unbudgeted sessions, and a low
+    // percentage is evidence of spend only when a budget rule exists. Absence
+    // means the detector did not run at all (no session).
+    budget_remaining_pct?: Long,      // Remaining session token budget (0-100)
+    budget_exceeded?: Bool,           // Session token budget exceeded
   },
 };
 
@@ -270,6 +288,24 @@ action call_tool appliesTo {
 
     // --- Legacy ---
     response_content?: String,
+    // --- Session Token Budget --- (OWASP LLM10; CAP-ENF-009, cerberus#147)
+    // Fed by the cumulative session total the Overwatch daemon reports on the
+    // prompt and before-tool events.
+    //
+    // BOTH are optional, so BOTH need a `has` guard — a bare
+    // `context.budget_remaining_pct < 10` fails cedar validation with
+    // "unable to guarantee safety of access to optional attribute".
+    // Write: `context has budget_remaining_pct && context.budget_remaining_pct < 10`.
+    //
+    // The guard is a validation requirement, NOT a safety property. Whenever a
+    // session loads, budget_checker emits both keys — including
+    // budget_exceeded: false and budget_remaining_pct: 100 when no budget rule
+    // is configured for the scope. So a grant conditioned on
+    // `!context.budget_exceeded` fires on unbudgeted sessions, and a low
+    // percentage is evidence of spend only when a budget rule exists. Absence
+    // means the detector did not run at all (no session).
+    budget_remaining_pct?: Long,      // Remaining session token budget (0-100)
+    budget_exceeded?: Bool,           // Session token budget exceeded
   },
 };
 
@@ -392,6 +428,24 @@ action connect_server appliesTo {
     session_max_pii_score?: Long,
     session_max_secret_score?: Long,
     session_cumulative_risk_score?: Long,
+    // --- Session Token Budget --- (OWASP LLM10; CAP-ENF-009, cerberus#147)
+    // Fed by the cumulative session total the Overwatch daemon reports on the
+    // prompt and before-tool events.
+    //
+    // BOTH are optional, so BOTH need a `has` guard — a bare
+    // `context.budget_remaining_pct < 10` fails cedar validation with
+    // "unable to guarantee safety of access to optional attribute".
+    // Write: `context has budget_remaining_pct && context.budget_remaining_pct < 10`.
+    //
+    // The guard is a validation requirement, NOT a safety property. Whenever a
+    // session loads, budget_checker emits both keys — including
+    // budget_exceeded: false and budget_remaining_pct: 100 when no budget rule
+    // is configured for the scope. So a grant conditioned on
+    // `!context.budget_exceeded` fires on unbudgeted sessions, and a low
+    // percentage is evidence of spend only when a budget rule exists. Absence
+    // means the detector did not run at all (no session).
+    budget_remaining_pct?: Long,      // Remaining session token budget (0-100)
+    budget_exceeded?: Bool,           // Session token budget exceeded
   },
 };
 
@@ -446,6 +500,24 @@ action read_file appliesTo {
 
     // --- Agent Security ---
     indirect_injection_score?: Long,  // Indirect injection via file content
+    // --- Session Token Budget --- (OWASP LLM10; CAP-ENF-009, cerberus#147)
+    // Fed by the cumulative session total the Overwatch daemon reports on the
+    // prompt and before-tool events.
+    //
+    // BOTH are optional, so BOTH need a `has` guard — a bare
+    // `context.budget_remaining_pct < 10` fails cedar validation with
+    // "unable to guarantee safety of access to optional attribute".
+    // Write: `context has budget_remaining_pct && context.budget_remaining_pct < 10`.
+    //
+    // The guard is a validation requirement, NOT a safety property. Whenever a
+    // session loads, budget_checker emits both keys — including
+    // budget_exceeded: false and budget_remaining_pct: 100 when no budget rule
+    // is configured for the scope. So a grant conditioned on
+    // `!context.budget_exceeded` fires on unbudgeted sessions, and a low
+    // percentage is evidence of spend only when a budget rule exists. Absence
+    // means the detector did not run at all (no session).
+    budget_remaining_pct?: Long,      // Remaining session token budget (0-100)
+    budget_exceeded?: Bool,           // Session token budget exceeded
   },
 };
 
@@ -500,6 +572,24 @@ action write_file appliesTo {
 
     // --- Agent Security ---
     indirect_injection_score?: Long,  // Indirect injection via file content
+    // --- Session Token Budget --- (OWASP LLM10; CAP-ENF-009, cerberus#147)
+    // Fed by the cumulative session total the Overwatch daemon reports on the
+    // prompt and before-tool events.
+    //
+    // BOTH are optional, so BOTH need a `has` guard — a bare
+    // `context.budget_remaining_pct < 10` fails cedar validation with
+    // "unable to guarantee safety of access to optional attribute".
+    // Write: `context has budget_remaining_pct && context.budget_remaining_pct < 10`.
+    //
+    // The guard is a validation requirement, NOT a safety property. Whenever a
+    // session loads, budget_checker emits both keys — including
+    // budget_exceeded: false and budget_remaining_pct: 100 when no budget rule
+    // is configured for the scope. So a grant conditioned on
+    // `!context.budget_exceeded` fires on unbudgeted sessions, and a low
+    // percentage is evidence of spend only when a budget rule exists. Absence
+    // means the detector did not run at all (no session).
+    budget_remaining_pct?: Long,      // Remaining session token budget (0-100)
+    budget_exceeded?: Bool,           // Session token budget exceeded
   },
 };