@highflame/policy 2.2.41 → 2.2.43

package/dist/guardrails-defaults.gen.js

@@ -3471,6 +3471,537 @@ when {
     !(["treasury@example.com", "payroll@example.com"].contains(context.action_params.recipient))
 };
 `;
+const GUARDRAILS_PRIVACY_OUTPUT_PROTECTION_CEDAR = `// =============================================================================
+// Output Protection — Data Leakage
+// =============================================================================
+// Guards what the MODEL SAYS BACK, not what the user sends in.
+//
+// Every other guardrails template binds process_response alongside
+// process_prompt and the tool/file actions, which is right for a threat that
+// is the same in both directions. Data leakage is not that: the risk is
+// specific to egress, and a tenant who wants to police only their outputs had
+// no template to enable. That gap is why one deployed tenant hand-authored a
+// rule named "Block PII in outputs" and bound it to process_prompt — the only
+// action that covered responses before the direction split (ADR 0031).
+//
+// These rules bind process_response ALONE. That is the point: ADR 0031 created
+// the distinct trigger precisely so a policy could be scoped to one direction
+// from its head, and this profile is what that is for. Enabling it cannot
+// change how prompts are treated.
+//
+// Context keys consumed:
+//   - pii_detected:      Bool
+//   - pii_count:         Long
+//
+// Compliance:
+//   - OWASP LLM02 (Sensitive Information Disclosure), OWASP LLM06
+//
+// Category:  privacy
+// Namespace: Guardrails
+// =============================================================================
+
+@id("privacy.output-block-pii")
+@name("Block PII in model responses")
+@description("Blocks process_response when the model's own output contains PII. Scoped to the response direction only — prompts are unaffected.")
+@severity("high")
+@tags("category:privacy,threat:data-leak,surface:process-response,detection:rule,owasp:llm02")
+@reject_message("Response blocked: the model's output contained personal data.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has pii_detected && context.pii_detected == true
+};
+
+// Bulk disclosure is a separate finding from a single incidental match: a
+// response carrying many distinct PII items is an exfiltration shape rather
+// than a mention, and is worth its own severity and message even though the
+// rule above already blocks it. Kept as a distinct rule so a tenant running
+// the first in monitor mode can still enforce on bulk.
+@id("privacy.output-block-bulk-pii")
+@name("Block bulk PII disclosure in model responses")
+@description("Blocks process_response when the output carries five or more PII items — a disclosure shape rather than an incidental mention.")
+@severity("critical")
+@tags("category:privacy,threat:data-leak,surface:process-response,detection:rule,owasp:llm06")
+@reject_message("Response blocked: the model's output contained bulk personal data.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has pii_count && context.pii_count >= 5
+};
+`;
+const GUARDRAILS_TRUST_SAFETY_OUTPUT_PROTECTION_CEDAR = `// =============================================================================
+// Output Protection — Harmful Content
+// =============================================================================
+// The companion to data_leakage.cedar: what the model says back, judged for
+// safety rather than for disclosure.
+//
+// Same scoping rule and same reason — process_response ALONE (ADR 0031). A
+// tenant enabling this is saying "hold my model's answers to a standard",
+// which is a different decision from "police what users send me", and the two
+// should be separately enableable.
+//
+// Thresholds match the org-wide toxicity defaults rather than tightening them.
+// An output profile that silently enforced stricter limits than the tenant's
+// existing prompt rules would surprise anyone comparing the two.
+//
+// Context keys consumed:
+//   - violence_score:     Long (0-100)
+//   - hate_speech_score:  Long (0-100)
+//   - sexual_score:       Long (0-100)
+//   - injection_score:    Long (0-100)
+//
+// Compliance:
+//   - OWASP LLM05 (Improper Output Handling), OWASP LLM01
+//
+// Category:  trust-safety
+// Namespace: Guardrails
+// =============================================================================
+
+@id("trust-safety.output-block-toxic")
+@name("Block toxic model responses")
+@description("Blocks process_response when the model's own output scores high for violence or hate speech.")
+@severity("high")
+@tags("category:trust-safety,threat:harmful,surface:process-response,detection:ml,owasp:llm05")
+@reject_message("Response blocked: the model's output was flagged as harmful.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has violence_score && context.violence_score >= 70 ||
+    context has hate_speech_score && context.hate_speech_score >= 70
+};
+
+@id("trust-safety.output-block-sexual")
+@name("Block sexual content in model responses")
+@description("Blocks process_response when the model's own output scores high for sexual content.")
+@severity("critical")
+@tags("category:trust-safety,threat:sexual,surface:process-response,detection:ml,owasp:llm05")
+@reject_message("Response blocked: the model's output was flagged as explicit.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has sexual_score && context.sexual_score >= 91
+};
+`;
+const GUARDRAILS_SECURITY_OUTPUT_BLOCK_INJECTION_CARRIED_BACK_CEDAR = `// =============================================================================
+// Output Protection — Injection Carried Back
+// =============================================================================
+// Split from harmful_content.cedar because its category is \`security\`, not
+// \`trust-safety\`, and a template wrapper may only carry rules of its own
+// category (HFP-LINT-TMPL-006). The split is the honest outcome: this is a
+// different threat with a different owner, not a toxicity variant.
+//
+// Same scoping rule as the rest of this profile — process_response ALONE.
+//
+// Context keys consumed:
+//   - injection_score:  Long (0-100)
+//
+// Compliance:
+//   - OWASP LLM05 (Improper Output Handling)
+//
+// Category:  security
+// Namespace: Guardrails
+// =============================================================================
+
+// Injection scored on an OUTPUT is a different finding from injection scored on
+// a prompt. On the way in it is a user attacking the model; on the way out it
+// is content the model is handing to the caller — a downstream agent, a
+// renderer, or another tool — which is OWASP LLM05's improper output handling.
+// Worth its own rule so the two can be tuned and reasoned about separately.
+@id("security.output-block-injection-carried-back")
+@name("Block injection payloads carried back in model responses")
+@description("Blocks process_response when the output itself scores as an injection payload — content the caller may execute or forward.")
+@severity("high")
+@tags("category:security,threat:injection,surface:process-response,detection:ml,owasp:llm05")
+@reject_message("Response blocked: the model's output contained an injection payload.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has injection_score && context.injection_score >= 80
+};
+`;
+const GUARDRAILS_DATA_PROTECTION_OUTPUT_BLOCK_SECRETS_CEDAR = `// =============================================================================
+// Output Protection — Credentials
+// =============================================================================
+// Split from data_leakage.cedar: secrets are category \`data-protection\`, PII is
+// \`privacy\`, and a template wrapper may only carry rules of its own category
+// (HFP-LINT-TMPL-006). Relabelling one to fit the other would put a wrong
+// category on the wire, where it drives signals[] and the severity rollup.
+//
+// Same scoping rule as the rest of this profile — process_response ALONE, so a
+// tenant can police what the model says without touching what users send.
+//
+// Context keys consumed:
+//   - secrets_detected:  Bool
+//
+// Compliance:
+//   - OWASP LLM02 (Sensitive Information Disclosure)
+//
+// Category:  data-protection
+// Namespace: Guardrails
+// =============================================================================
+
+@id("data-protection.output-block-secrets")
+@name("Block secrets in model responses")
+@description("Blocks process_response when the model's own output contains credentials, API keys or tokens — the canonical way a leaked secret reaches a caller.")
+@severity("critical")
+@tags("category:data-protection,threat:secrets,surface:process-response,detection:rule,owasp:llm02")
+@reject_message("Response blocked: the model's output contained credentials.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has secrets_detected && context.secrets_detected == true
+};
+`;
+const GUARDRAILS_SECURITY_MULTI_TURN_TRAJECTORY_CEDAR = `// =============================================================================
+// Multi-Turn Trajectory Escalation
+// =============================================================================
+// Blocks a conversation whose TRAJECTORY is an attack, even when no single
+// message is. A crescendo attack never sends a message alarming enough to
+// block on its own; it walks the model there in small, plausible steps and
+// asks for the payoff in a sentence that would pass any single-message filter.
+//
+// Shield scores every turn twice and exposes both scores separately:
+//   - injection_pulse_score / jailbreak_pulse_score — the single-turn
+//     classifier. Sees only the current message.
+//   - injection_deep_context_score / jailbreak_deep_context_score — the
+//     multi-turn model, which carries hidden state across turns keyed on
+//     session_id. Sees the whole conversation.
+//
+// Because they are separate keys, a rule can fire on the GAP between them:
+// high trajectory score, low message score. In plain language, "the history
+// is an attack and this message is not" — a condition a filter that only ever
+// has one number cannot express. Section 1 is that rule. Section 2 is a safety
+// net for a trajectory blatant enough to stand on its own.
+//
+// Requires a stable session_id on every request in the conversation. With no
+// session_id there is no threaded state, multi_turn_detection is false, and
+// none of these rules can fire.
+//
+// Detection layers:
+//   - injection (single-turn classifier, always available)
+//   - deepcontext (multi-turn model, always available)
+//
+// Context keys consumed:
+//   - multi_turn_detection: Bool — true only when threaded state was used
+//   - injection_deep_context_score, injection_pulse_score: Long (0-100)
+//   - jailbreak_deep_context_score, jailbreak_pulse_score: Long (0-100)
+//
+// Compliance:
+//   - OWASP LLM01, OWASP LLM02, MITRE ATLAS AML.T0051, AML.T0054
+//
+// Category:  security
+// Namespace: Guardrails
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: Trajectory/turn divergence
+// The conversation scores as an attack; this message does not.
+// ---------------------------------------------------------------------------
+
+@id("security.block-trajectory-injection-divergence")
+@name("Block multi-turn injection the current turn hides")
+@description("Blocks process_prompt and process_response when threaded state is in use, injection_deep_context_score >= 60, and injection_pulse_score <= 39.")
+@severity("critical")
+@tags("category:security,threat:injection,detection:ml,surface:process-prompt,surface:process-response,scope:multi-turn,owasp:llm01,mitre:atlas-t0051")
+@reject_message("Prompt blocked: this conversation is a progressive prompt-injection attempt. No single message crossed the line; the sequence did.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
+    resource
+)
+when {
+    context has multi_turn_detection && context.multi_turn_detection == true &&
+    context has injection_deep_context_score && context.injection_deep_context_score >= 60 &&
+    context has injection_pulse_score && context.injection_pulse_score <= 39
+};
+
+@id("security.block-trajectory-jailbreak-divergence")
+@name("Block multi-turn jailbreak the current turn hides")
+@description("Blocks process_prompt and process_response when threaded state is in use, jailbreak_deep_context_score >= 60, and jailbreak_pulse_score <= 39.")
+@severity("critical")
+@tags("category:security,threat:jailbreak,detection:ml,surface:process-prompt,surface:process-response,scope:multi-turn,owasp:llm02,mitre:atlas-t0054")
+@reject_message("Prompt blocked: this conversation is a progressive jailbreak. No single message crossed the line; the sequence did.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
+    resource
+)
+when {
+    context has multi_turn_detection && context.multi_turn_detection == true &&
+    context has jailbreak_deep_context_score && context.jailbreak_deep_context_score >= 60 &&
+    context has jailbreak_pulse_score && context.jailbreak_pulse_score <= 39
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Blatant trajectory, regardless of the message score
+// Covers the band between Section 1 and the default single-turn thresholds.
+// ---------------------------------------------------------------------------
+
+@id("security.block-trajectory-injection-high")
+@name("Block high-confidence multi-turn injection")
+@description("Blocks process_prompt and process_response when threaded state is in use and injection_deep_context_score >= 75.")
+@severity("high")
+@tags("category:security,threat:injection,detection:ml,surface:process-prompt,surface:process-response,scope:multi-turn,owasp:llm01")
+@reject_message("Prompt blocked: the multi-turn model scored this conversation as a prompt-injection attempt with high confidence.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
+    resource
+)
+when {
+    context has multi_turn_detection && context.multi_turn_detection == true &&
+    context has injection_deep_context_score && context.injection_deep_context_score >= 75
+};
+
+@id("security.block-trajectory-jailbreak-high")
+@name("Block high-confidence multi-turn jailbreak")
+@description("Blocks process_prompt and process_response when threaded state is in use and jailbreak_deep_context_score >= 75.")
+@severity("high")
+@tags("category:security,threat:jailbreak,detection:ml,surface:process-prompt,surface:process-response,scope:multi-turn,owasp:llm02")
+@reject_message("Prompt blocked: the multi-turn model scored this conversation as a jailbreak attempt with high confidence.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
+    resource
+)
+when {
+    context has multi_turn_detection && context.multi_turn_detection == true &&
+    context has jailbreak_deep_context_score && context.jailbreak_deep_context_score >= 75
+};
+`;
+const GUARDRAILS_AGENT_SECURITY_SESSION_RISK_ACCUMULATION_CEDAR = `// =============================================================================
+// Session Risk Accumulation
+// =============================================================================
+// Blocks the privileged action a probing conversation is working toward. A
+// patient attacker expects some turns to be refused; what they want is one
+// tool call at the end — send the email, move the money, read the file. So
+// the useful question at a tool call is not "is this call suspicious?" but
+// "what has this conversation been doing up to now?"
+//
+// Shield accumulates that history on the session and projects it three ways,
+// because attackers come in three shapes:
+//   - session_max_* — a high-water mark that never decays. "Did this session
+//     EVER cross a line?" Catches the attacker who probes hard, is refused,
+//     goes quiet, then calmly asks for the tool.
+//   - session_cumulative_risk_score — an uncapped running sum. "How much
+//     total pressure has this session applied?" Catches death by a thousand
+//     cuts, where no single turn is alarming.
+//   - session_threat_turns — a count of turns that tripped a detector. "Is
+//     this sustained, or a one-off?" Separates probing from a false positive.
+//
+// Requires a stable session_id on every request, prompts AND tool calls. The
+// tool call must ride the same session as the conversation, or it reads 0.
+//
+// Detection layers:
+//   - session (aggregate over detection history, always available)
+//   - tool_validator (tool_is_sensitive, always available)
+//
+// Context keys consumed:
+//   - session_max_injection_score, session_max_jailbreak_score: Long (0-100)
+//   - session_cumulative_risk_score: Long — uncapped sum
+//   - session_threat_turns: Long — count
+//   - tool_is_sensitive: Bool
+//
+// Compliance:
+//   - OWASP LLM01, OWASP LLM06, OWASP ASI01, OWASP ASI04
+//
+// Category:  agent-security
+// Namespace: Guardrails
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: A session that ever crossed the line does not get to act
+// The conversation is what scored high; the tool call is what gets stopped.
+// ---------------------------------------------------------------------------
+
+@id("agent-security.block-tool-after-injection-in-session")
+@name("Block tools after an injection or jailbreak in the session")
+@description("Blocks call_tool when session_max_injection_score >= 60 or session_max_jailbreak_score >= 60, because an earlier turn attempted injection or jailbreak.")
+@severity("critical")
+@tags("category:agent-security,threat:escalation,detection:aggregate,surface:call-tool,scope:multi-turn,owasp:llm01")
+@reject_message("Tool execution blocked: an earlier turn in this session attempted prompt injection or jailbreak. Start a new session to use tools.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    (context has session_max_injection_score && context.session_max_injection_score >= 60) ||
+    (context has session_max_jailbreak_score && context.session_max_jailbreak_score >= 60)
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Accumulated pressure gates sensitive tools
+// No single turn set a max, but the session as a whole kept pushing.
+// ---------------------------------------------------------------------------
+
+@id("agent-security.block-sensitive-tool-on-session-risk")
+@name("Block sensitive tools once the session has accumulated risk")
+@description("Blocks call_tool when session_cumulative_risk_score >= 151 and tool_is_sensitive is true.")
+@severity("high")
+@tags("category:agent-security,threat:escalation,detection:aggregate,surface:call-tool,scope:multi-turn,owasp:asi01")
+@reject_message("Tool execution blocked: this session has accumulated significant risk across earlier turns. Sensitive tools are withheld for the remainder of the session.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has session_cumulative_risk_score &&
+    context.session_cumulative_risk_score >= 151 &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+};
+
+// ---------------------------------------------------------------------------
+// Section 3: Sustained probing, independent of any single score
+// Two is the smallest bar that separates repeated from one-off. Long-running
+// agent sessions accumulate turns faster and warrant a higher bar.
+// ---------------------------------------------------------------------------
+
+@id("agent-security.block-tool-on-repeated-threat-turns")
+@name("Block tool use in a session with repeated threat turns")
+@description("Blocks call_tool when session_threat_turns >= 2, because more than one turn in this session tripped a detector.")
+@severity("high")
+@tags("category:agent-security,threat:escalation,detection:aggregate,surface:call-tool,scope:multi-turn,owasp:asi04")
+@reject_message("Tool execution blocked: more than one turn in this session tripped a detector. This is sustained probing, not a one-off false positive.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has session_threat_turns && context.session_threat_turns >= 2
+};
+`;
+const GUARDRAILS_AGENT_IDENTITY_DUAL_ATTRIBUTION_CEDAR = `// =============================================================================
+// Dual Attribution
+// =============================================================================
+// Blocks privileged agent actions that cannot be attributed to a human. "Which
+// agent did this?" is half an answer; the other half is "on whose behalf?" An
+// agent is not an accountable party — the person who pointed it at the work
+// is. Shield projects both sides of that pair, so the requirement can be a
+// policy rather than a reporting convention nobody enforces.
+//
+// The agent comes from the authenticated identity, never from the request
+// body: agent_id, agent_type, agent_trust_level, agent_framework. The human
+// comes from the identity claims on the credential, as the \`principal\` record
+// — its \`act_sub\` field names the party the agent is acting for.
+//
+// Deploy in MONITOR mode first. Section 2 blocks unverified agents, and a
+// service key authenticates as unverified until the agent is registered and
+// adopted in Studio. Monitor records what each rule would have blocked on
+// every event without blocking anything; register the agent, then switch to
+// enforce.
+//
+// Detection layers:
+//   - agent identity (authentication layer, always available)
+//   - tool_validator (tool_is_sensitive, tool_category, always available)
+//
+// Context keys consumed:
+//   - agent_id, agent_type, agent_trust_level: String
+//   - principal: record — act_sub names the accountable human
+//   - tool_is_sensitive: Bool
+//   - tool_category: String
+//
+// Compliance:
+//   - OWASP ASI01, OWASP ASI04
+//
+// Category:  agent-identity
+// Namespace: Guardrails
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: No unattributed privileged action
+// \`unless\` because the rule must fire when attribution is ABSENT, and an
+// absent field cannot be compared — only tested for.
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.require-principal-for-sensitive-tools")
+@name("Block sensitive agent tools without a principal")
+@description("Blocks call_tool on a sensitive tool by an agent unless the credential carries a principal whose act_sub names the human the agent acts for.")
+@severity("critical")
+@tags("category:agent-identity,detection:rule,surface:call-tool,scope:per-agent,posture:deny-default,owasp:asi01")
+@reject_message("Tool execution blocked: this agent invoked a sensitive tool with no accountable human attached. Every privileged agent action must name the person it acts for.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_id && context.agent_id != "" &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+}
+unless {
+    context has principal && context.principal has act_sub
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Trust level gates the blast radius
+// Start in monitor: a service key is unverified until the agent is adopted.
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.block-unverified-agent-sensitive-tools")
+@name("Block unverified agents from sensitive tools")
+@description("Blocks call_tool when agent_trust_level is unverified and the tool is sensitive or dangerous.")
+@severity("critical")
+@tags("category:agent-identity,detection:rule,surface:call-tool,scope:per-agent,posture:deny-default,owasp:asi01")
+@reject_message("Tool execution blocked: unverified agents may not call sensitive or dangerous tools. Register and adopt the agent to raise its trust level.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
+    (
+        (context has tool_is_sensitive && context.tool_is_sensitive == true) ||
+        (context has tool_category && context.tool_category == "dangerous")
+    )
+};
+
+// ---------------------------------------------------------------------------
+// Section 3: Autonomous agents get a higher bar
+// Nobody watches an autonomous agent in real time, so a sensitive tool call
+// from one requires first-party trust rather than merely "not unverified".
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.restrict-autonomous-agent-sensitive-tools")
+@name("Block non-first-party autonomous agent tool use")
+@description("Blocks call_tool on a sensitive tool when agent_type is autonomous unless agent_trust_level is first_party.")
+@severity("high")
+@tags("category:agent-identity,threat:escalation,detection:rule,surface:call-tool,scope:per-agent,owasp:asi04")
+@reject_message("Tool execution blocked: autonomous agents must be first-party to call sensitive tools. No human is in the loop to catch a mistake.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_type && context.agent_type == "autonomous" &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+}
+unless {
+    context has agent_trust_level && context.agent_trust_level == "first_party"
+};
+`;
 // =============================================================================
 // CATEGORIES
 // =============================================================================
@@ -3810,6 +4341,69 @@ export const GUARDRAILS_TEMPLATES = [
         severity: 'high',
         tags: ['category:agent-security', 'surface:call-tool', 'aarm:r3', 'posture:deny-default'],
     },
+    {
+        id: 'privacy.output-protection',
+        name: 'Output Protection — Data Leakage',
+        description: 'Block PII, secrets and bulk disclosure in the model\'s own responses. Scoped to the response direction only, so prompts are unaffected.',
+        category: 'privacy',
+        cedarText: GUARDRAILS_PRIVACY_OUTPUT_PROTECTION_CEDAR,
+        severity: 'critical',
+        tags: ['category:privacy', 'threat:data-leak', 'surface:process-response', 'detection:rule'],
+    },
+    {
+        id: 'trust-safety.output-protection',
+        name: 'Output Protection — Harmful Content',
+        description: 'Hold the model\'s own responses to a safety standard: toxicity, explicit content, and injection payloads carried back to the caller. Response direction only.',
+        category: 'trust-safety',
+        cedarText: GUARDRAILS_TRUST_SAFETY_OUTPUT_PROTECTION_CEDAR,
+        severity: 'critical',
+        tags: ['category:trust-safety', 'threat:harmful', 'surface:process-response', 'detection:ml'],
+    },
+    {
+        id: 'security.output-block-injection-carried-back',
+        name: 'Output Protection — Injection Carried Back',
+        description: 'Block responses that themselves score as an injection payload — content a caller, downstream agent or renderer may execute. Response direction only.',
+        category: 'security',
+        cedarText: GUARDRAILS_SECURITY_OUTPUT_BLOCK_INJECTION_CARRIED_BACK_CEDAR,
+        severity: 'high',
+        tags: ['category:security', 'threat:injection', 'surface:process-response', 'detection:ml'],
+    },
+    {
+        id: 'data-protection.output-block-secrets',
+        name: 'Output Protection — Credentials',
+        description: 'Block responses whose own content contains credentials, API keys or tokens — the canonical way a leaked secret reaches a caller. Response direction only.',
+        category: 'data-protection',
+        cedarText: GUARDRAILS_DATA_PROTECTION_OUTPUT_BLOCK_SECRETS_CEDAR,
+        severity: 'critical',
+        tags: ['category:data-protection', 'threat:secrets', 'surface:process-response', 'detection:rule'],
+    },
+    {
+        id: 'security.multi-turn-trajectory',
+        name: 'Multi-Turn Trajectory Escalation',
+        description: 'Block a conversation whose trajectory is an attack even when no single message is: fires on the gap between the multi-turn model and the single-turn classifier.',
+        category: 'security',
+        cedarText: GUARDRAILS_SECURITY_MULTI_TURN_TRAJECTORY_CEDAR,
+        severity: 'critical',
+        tags: ['category:security', 'threat:injection', 'threat:jailbreak', 'detection:ml', 'scope:multi-turn', 'owasp:llm01', 'owasp:llm02'],
+    },
+    {
+        id: 'agent-security.session-risk-accumulation',
+        name: 'Session Risk Accumulation',
+        description: 'Block the privileged action a probing conversation is working toward, using the session\'s high-water mark, cumulative risk, and count of threat turns.',
+        category: 'agent-security',
+        cedarText: GUARDRAILS_AGENT_SECURITY_SESSION_RISK_ACCUMULATION_CEDAR,
+        severity: 'critical',
+        tags: ['category:agent-security', 'threat:escalation', 'detection:aggregate', 'surface:call-tool', 'scope:multi-turn', 'owasp:asi01', 'owasp:asi04'],
+    },
+    {
+        id: 'agent-identity.dual-attribution',
+        name: 'Dual Attribution',
+        description: 'Block privileged agent actions that cannot be attributed to a human. Deploy in monitor mode first; a service key is unverified until the agent is adopted.',
+        category: 'agent-identity',
+        cedarText: GUARDRAILS_AGENT_IDENTITY_DUAL_ATTRIBUTION_CEDAR,
+        severity: 'critical',
+        tags: ['category:agent-identity', 'detection:rule', 'surface:call-tool', 'scope:per-agent', 'posture:deny-default', 'owasp:asi01'],
+    },
 ];
 // =============================================================================
 // TEMPLATES METADATA
@@ -3877,7 +4471,10 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "organization",
       "file": "defaults/baseline.cedar",
       "severity": "low",
-      "tags": ["category:organization", "posture:permit-default"],
+      "tags": [
+        "category:organization",
+        "posture:permit-default"
+      ],
       "is_active": true
     }
   ],
@@ -3889,7 +4486,10 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "organization",
       "file": "defaults/baseline.cedar",
       "severity": "low",
-      "tags": ["category:organization", "posture:permit-default"],
+      "tags": [
+        "category:organization",
+        "posture:permit-default"
+      ],
       "auto_deploy": true
     },
     {
@@ -3899,7 +4499,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "data-protection",
       "file": "defaults/secrets.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
     },
     {
       "id": "security.injection",
@@ -4043,7 +4647,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "agent-identity",
       "file": "defaults/agent_identity.cedar",
       "severity": "critical",
-      "tags": ["category:agent-identity", "scope:per-agent", "owasp:llm01"]
+      "tags": [
+        "category:agent-identity",
+        "scope:per-agent",
+        "owasp:llm01"
+      ]
     },
     {
       "id": "tools.mcp-tool-permissions",
@@ -4052,7 +4660,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "tools",
       "file": "mcp_tool_permissions.cedar",
       "severity": "critical",
-      "tags": ["category:tools", "threat:supply-chain", "posture:deny-default"]
+      "tags": [
+        "category:tools",
+        "threat:supply-chain",
+        "posture:deny-default"
+      ]
     },
     {
       "id": "tools.mcp-server-allowlist",
@@ -4102,7 +4714,10 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "data-protection",
       "file": "profiles/code_agent/security.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets"
+      ]
     },
     {
       "id": "security.code-agent-encoding",
@@ -4124,7 +4739,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "security",
       "file": "profiles/code_agent/path_security.cedar",
       "severity": "critical",
-      "tags": ["category:security", "threat:secrets", "threat:path-traversal"]
+      "tags": [
+        "category:security",
+        "threat:secrets",
+        "threat:path-traversal"
+      ]
     },
     {
       "id": "agent-security.code-agent",
@@ -4163,7 +4782,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "data-protection",
       "file": "profiles/data_pipeline/data_protection.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
     },
     {
       "id": "security.data-pipeline-block-injection",
@@ -4172,7 +4795,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "security",
       "file": "profiles/data_pipeline/security.cedar",
       "severity": "high",
-      "tags": ["category:security", "threat:injection", "owasp:llm01"]
+      "tags": [
+        "category:security",
+        "threat:injection",
+        "owasp:llm01"
+      ]
     },
     {
       "id": "agent-security.data-pipeline",
@@ -4181,7 +4808,10 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "agent-security",
       "file": "profiles/data_pipeline/agentic_security.cedar",
       "severity": "critical",
-      "tags": ["category:agent-security", "threat:exfiltration"]
+      "tags": [
+        "category:agent-security",
+        "threat:exfiltration"
+      ]
     },
     {
       "id": "agent-identity.multi-agent-trust",
@@ -4290,7 +4920,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "data-protection",
       "file": "profiles/advanced_detection/secrets.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
     },
     {
       "id": "privacy.advanced-pii",
@@ -4320,6 +4954,112 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
         "aarm:r3",
         "posture:deny-default"
       ]
+    },
+    {
+      "id": "privacy.output-protection",
+      "name": "Output Protection — Data Leakage",
+      "description": "Block PII, secrets and bulk disclosure in the model's own responses. Scoped to the response direction only, so prompts are unaffected.",
+      "category": "privacy",
+      "file": "profiles/output_protection/data_leakage.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:privacy",
+        "threat:data-leak",
+        "surface:process-response",
+        "detection:rule"
+      ]
+    },
+    {
+      "id": "trust-safety.output-protection",
+      "name": "Output Protection — Harmful Content",
+      "description": "Hold the model's own responses to a safety standard: toxicity, explicit content, and injection payloads carried back to the caller. Response direction only.",
+      "category": "trust-safety",
+      "file": "profiles/output_protection/harmful_content.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:trust-safety",
+        "threat:harmful",
+        "surface:process-response",
+        "detection:ml"
+      ]
+    },
+    {
+      "id": "security.output-block-injection-carried-back",
+      "name": "Output Protection — Injection Carried Back",
+      "description": "Block responses that themselves score as an injection payload — content a caller, downstream agent or renderer may execute. Response direction only.",
+      "category": "security",
+      "file": "profiles/output_protection/injection_carried_back.cedar",
+      "severity": "high",
+      "tags": [
+        "category:security",
+        "threat:injection",
+        "surface:process-response",
+        "detection:ml"
+      ]
+    },
+    {
+      "id": "data-protection.output-block-secrets",
+      "name": "Output Protection — Credentials",
+      "description": "Block responses whose own content contains credentials, API keys or tokens — the canonical way a leaked secret reaches a caller. Response direction only.",
+      "category": "data-protection",
+      "file": "profiles/output_protection/credentials.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "surface:process-response",
+        "detection:rule"
+      ]
+    },
+    {
+      "id": "security.multi-turn-trajectory",
+      "name": "Multi-Turn Trajectory Escalation",
+      "description": "Block a conversation whose trajectory is an attack even when no single message is: fires on the gap between the multi-turn model and the single-turn classifier.",
+      "category": "security",
+      "file": "multi_turn_trajectory.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:security",
+        "threat:injection",
+        "threat:jailbreak",
+        "detection:ml",
+        "scope:multi-turn",
+        "owasp:llm01",
+        "owasp:llm02"
+      ]
+    },
+    {
+      "id": "agent-security.session-risk-accumulation",
+      "name": "Session Risk Accumulation",
+      "description": "Block the privileged action a probing conversation is working toward, using the session's high-water mark, cumulative risk, and count of threat turns.",
+      "category": "agent-security",
+      "file": "session_risk_accumulation.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-security",
+        "threat:escalation",
+        "detection:aggregate",
+        "surface:call-tool",
+        "scope:multi-turn",
+        "owasp:asi01",
+        "owasp:asi04"
+      ]
+    },
+    {
+      "id": "agent-identity.dual-attribution",
+      "name": "Dual Attribution",
+      "description": "Block privileged agent actions that cannot be attributed to a human. Deploy in monitor mode first; a service key is unverified until the agent is adopted.",
+      "category": "agent-identity",
+      "file": "dual_attribution.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-identity",
+        "detection:rule",
+        "surface:call-tool",
+        "scope:per-agent",
+        "posture:deny-default",
+        "owasp:asi01"
+      ]
     }
   ]
 }