@highflame/policy 2.2.42 → 2.2.43

package/_schemas/agent_ops/context.json

@@ -25,12 +25,6 @@
           "required": false,
           "description": "Principal identity class projected from the token: 'human', 'agent', 'service', or 'mcp_server'"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id)"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -817,12 +811,6 @@
           "required": false,
           "description": "Principal identity class projected from the token: 'human', 'agent', 'service', or 'mcp_server'"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id)"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -1609,12 +1597,6 @@
           "required": false,
           "description": "Principal identity class: 'human', 'agent', 'service', or 'mcp_server'"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -2372,12 +2354,6 @@
           "required": false,
           "description": "Principal identity class: 'human', 'agent', 'service', or 'mcp_server'"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -2752,12 +2728,6 @@
           "required": false,
           "description": "Principal identity class: 'human', 'agent', 'service', or 'mcp_server'"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -3145,12 +3115,6 @@
           "required": false,
           "description": "Principal identity class: 'human', 'agent', 'service', or 'mcp_server'"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -3565,12 +3529,6 @@
           "required": false,
           "description": "Principal identity class: 'human', 'agent', 'service', or 'mcp_server'"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier (ZeroID / WIMSE URI or user id)"
-        },
         {
           "key": "agent_trust_level",
           "type": "string",

package/_schemas/agent_ops/schema.cedarschema

@@ -122,6 +122,44 @@ namespace AgentOps {
     // Context Types (Action-Specific)
     // =========================================================================
 
+    /// The ZeroID NHI principal block (ADR 0009 / CAP-IDN-011).
+    ///
+    /// A record, not a string: Shield projects the whole identity block under
+    /// `context.principal`, so policies read members off it —
+    ///
+    ///   permit ... when { context has principal &&
+    ///                     context.principal.trust_level == "first_party" };
+    ///   forbid ... unless { context has principal &&
+    ///                       context.principal has act_sub };
+    ///
+    /// Declared once and shared by every action context so a new member cannot
+    /// land on one action and go missing on another.
+    ///
+    /// `act` (RFC 8693 delegation) is flattened to `act_sub` / `act_iss`
+    /// because Cedar records are flat key/value at each level; the full
+    /// delegation tree is reconstructable audit-side by joining on `mission_id`.
+    ///
+    /// Every member is optional except `delegation_depth`: the projector omits
+    /// a field whose value is empty, but always emits the depth because zero is
+    /// the meaningful base case for a direct (non-delegated) token. The record
+    /// itself is optional — it is absent, not empty, when the request carries no
+    /// NHI claims (RS256 human tokens, internal-service callers), so
+    /// `context has principal` is false rather than true-but-empty.
+    type PrincipalContext = {
+        "identity_type"?: String,      // "human" | "agent" | "service" | "mcp_server"
+        "sub_type"?: String,           // Identity subtype (e.g. "coding_agent")
+        "trust_level"?: String,        // "first_party" | "verified" | "unverified"
+        "framework"?: String,          // Agent framework (e.g. "langchain")
+        "publisher"?: String,          // Agent publisher
+        "capabilities"?: Set<String>,  // Capabilities granted to the identity
+        "scopes"?: Set<String>,        // OAuth scopes carried by the token
+        "delegation_depth": Long,      // Delegation hops; 0 for a direct token
+        "act_sub"?: String,            // RFC 8693 actor — the accountable human
+        "act_iss"?: String,            // Issuer of the actor claim
+        "mission_id"?: String,         // Correlates one delegation tree
+        "grant_type"?: String,         // How the token was obtained (e.g. "api_key")
+    };
+
     /// Context for the process_response action.
     ///
     /// An alias, not a copy: prompts and responses are inspected by the same
@@ -136,7 +174,7 @@ namespace AgentOps {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service" | "mcp_server"
-        "principal"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -331,7 +369,7 @@ namespace AgentOps {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,
-        "principal"?: String,
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -542,7 +580,7 @@ namespace AgentOps {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,
-        "principal"?: String,
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -650,7 +688,7 @@ namespace AgentOps {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,
-        "principal"?: String,
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -762,7 +800,7 @@ namespace AgentOps {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,
-        "principal"?: String,
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -895,7 +933,7 @@ namespace AgentOps {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service" | "mcp_server"
-        "principal"?: String,            // Stable principal identifier (ZeroID / WIMSE URI or user id)
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         "agent_trust_level"?: String,    // "untrusted" | "low" | "verified" | "trusted"
 
         // Core metadata (required)

package/_schemas/guardrails/context.json

@@ -25,12 +25,6 @@
           "required": false,
           "description": "Principal identity class projected from the token: 'human', 'agent', or 'service'. Use to apply identity-class-specific policies"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id). Absent when the token carries no principal claim"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -696,12 +690,6 @@
           "required": false,
           "description": "Principal identity class projected from the token: 'human', 'agent', or 'service'. Use to apply identity-class-specific policies"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id). Absent when the token carries no principal claim"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -1367,12 +1355,6 @@
           "required": false,
           "description": "Principal identity class projected from the token: 'human', 'agent', or 'service'. Use to apply identity-class-specific policies"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id). Absent when the token carries no principal claim"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -2098,12 +2080,6 @@
           "required": false,
           "description": "Principal identity class projected from the token: 'human', 'agent', or 'service'. Use to apply identity-class-specific policies"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id). Absent when the token carries no principal claim"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -2345,12 +2321,6 @@
           "required": false,
           "description": "Principal identity class projected from the token: 'human', 'agent', or 'service'. Use to apply identity-class-specific policies"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id). Absent when the token carries no principal claim"
-        },
         {
           "key": "request_id",
           "type": "string",
@@ -2605,12 +2575,6 @@
           "required": false,
           "description": "Principal identity class projected from the token: 'human', 'agent', or 'service'. Use to apply identity-class-specific policies"
         },
-        {
-          "key": "principal",
-          "type": "string",
-          "required": false,
-          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id). Absent when the token carries no principal claim"
-        },
         {
           "key": "request_id",
           "type": "string",

package/_schemas/guardrails/detectors.json

@@ -1742,7 +1742,6 @@
     "param_type_violation",
     "param_type_violations",
     "path",
-    "principal",
     "privilege_scope",
     "request_id",
     "role",

package/_schemas/guardrails/schema.cedarschema

@@ -105,6 +105,44 @@ namespace Guardrails {
     // Context Types (Action-Specific)
     // =========================================================================
 
+    /// The ZeroID NHI principal block (ADR 0009 / CAP-IDN-011).
+    ///
+    /// A record, not a string: Shield projects the whole identity block under
+    /// `context.principal`, so policies read members off it —
+    ///
+    ///   permit ... when { context has principal &&
+    ///                     context.principal.trust_level == "first_party" };
+    ///   forbid ... unless { context has principal &&
+    ///                       context.principal has act_sub };
+    ///
+    /// Declared once and shared by every action context so a new member cannot
+    /// land on one action and go missing on another.
+    ///
+    /// `act` (RFC 8693 delegation) is flattened to `act_sub` / `act_iss`
+    /// because Cedar records are flat key/value at each level; the full
+    /// delegation tree is reconstructable audit-side by joining on `mission_id`.
+    ///
+    /// Every member is optional except `delegation_depth`: the projector omits
+    /// a field whose value is empty, but always emits the depth because zero is
+    /// the meaningful base case for a direct (non-delegated) token. The record
+    /// itself is optional — it is absent, not empty, when the request carries no
+    /// NHI claims (RS256 human tokens, internal-service callers), so
+    /// `context has principal` is false rather than true-but-empty.
+    type PrincipalContext = {
+        "identity_type"?: String,      // "human" | "agent" | "service"
+        "sub_type"?: String,           // Identity subtype (e.g. "coding_agent")
+        "trust_level"?: String,        // "first_party" | "verified" | "unverified"
+        "framework"?: String,          // Agent framework (e.g. "langchain")
+        "publisher"?: String,          // Agent publisher
+        "capabilities"?: Set<String>,  // Capabilities granted to the identity
+        "scopes"?: Set<String>,        // OAuth scopes carried by the token
+        "delegation_depth": Long,      // Delegation hops; 0 for a direct token
+        "act_sub"?: String,            // RFC 8693 actor — the accountable human
+        "act_iss"?: String,            // Issuer of the actor claim
+        "mission_id"?: String,         // Correlates one delegation tree
+        "grant_type"?: String,         // How the token was obtained (e.g. "api_key")
+    };
+
     /// Context for the process_response action.
     ///
     /// An alias, not a copy: prompts and responses are inspected by the same
@@ -121,7 +159,7 @@ namespace Guardrails {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
-        "principal"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -273,7 +311,7 @@ namespace Guardrails {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
-        "principal"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -469,7 +507,7 @@ namespace Guardrails {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
-        "principal"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -542,7 +580,7 @@ namespace Guardrails {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
-        "principal"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -619,7 +657,7 @@ namespace Guardrails {
         "role"?: String,
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
-        "principal"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)
+        "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,

package/_schemas/guardrails/templates/dual_attribution.cedar

@@ -0,0 +1,110 @@
+// =============================================================================
+// Dual Attribution
+// =============================================================================
+// Blocks privileged agent actions that cannot be attributed to a human. "Which
+// agent did this?" is half an answer; the other half is "on whose behalf?" An
+// agent is not an accountable party — the person who pointed it at the work
+// is. Shield projects both sides of that pair, so the requirement can be a
+// policy rather than a reporting convention nobody enforces.
+//
+// The agent comes from the authenticated identity, never from the request
+// body: agent_id, agent_type, agent_trust_level, agent_framework. The human
+// comes from the identity claims on the credential, as the `principal` record
+// — its `act_sub` field names the party the agent is acting for.
+//
+// Deploy in MONITOR mode first. Section 2 blocks unverified agents, and a
+// service key authenticates as unverified until the agent is registered and
+// adopted in Studio. Monitor records what each rule would have blocked on
+// every event without blocking anything; register the agent, then switch to
+// enforce.
+//
+// Detection layers:
+//   - agent identity (authentication layer, always available)
+//   - tool_validator (tool_is_sensitive, tool_category, always available)
+//
+// Context keys consumed:
+//   - agent_id, agent_type, agent_trust_level: String
+//   - principal: record — act_sub names the accountable human
+//   - tool_is_sensitive: Bool
+//   - tool_category: String
+//
+// Compliance:
+//   - OWASP ASI01, OWASP ASI04
+//
+// Category:  agent-identity
+// Namespace: Guardrails
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: No unattributed privileged action
+// `unless` because the rule must fire when attribution is ABSENT, and an
+// absent field cannot be compared — only tested for.
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.require-principal-for-sensitive-tools")
+@name("Block sensitive agent tools without a principal")
+@description("Blocks call_tool on a sensitive tool by an agent unless the credential carries a principal whose act_sub names the human the agent acts for.")
+@severity("critical")
+@tags("category:agent-identity,detection:rule,surface:call-tool,scope:per-agent,posture:deny-default,owasp:asi01")
+@reject_message("Tool execution blocked: this agent invoked a sensitive tool with no accountable human attached. Every privileged agent action must name the person it acts for.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_id && context.agent_id != "" &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+}
+unless {
+    context has principal && context.principal has act_sub
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Trust level gates the blast radius
+// Start in monitor: a service key is unverified until the agent is adopted.
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.block-unverified-agent-sensitive-tools")
+@name("Block unverified agents from sensitive tools")
+@description("Blocks call_tool when agent_trust_level is unverified and the tool is sensitive or dangerous.")
+@severity("critical")
+@tags("category:agent-identity,detection:rule,surface:call-tool,scope:per-agent,posture:deny-default,owasp:asi01")
+@reject_message("Tool execution blocked: unverified agents may not call sensitive or dangerous tools. Register and adopt the agent to raise its trust level.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
+    (
+        (context has tool_is_sensitive && context.tool_is_sensitive == true) ||
+        (context has tool_category && context.tool_category == "dangerous")
+    )
+};
+
+// ---------------------------------------------------------------------------
+// Section 3: Autonomous agents get a higher bar
+// Nobody watches an autonomous agent in real time, so a sensitive tool call
+// from one requires first-party trust rather than merely "not unverified".
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.restrict-autonomous-agent-sensitive-tools")
+@name("Block non-first-party autonomous agent tool use")
+@description("Blocks call_tool on a sensitive tool when agent_type is autonomous unless agent_trust_level is first_party.")
+@severity("high")
+@tags("category:agent-identity,threat:escalation,detection:rule,surface:call-tool,scope:per-agent,owasp:asi04")
+@reject_message("Tool execution blocked: autonomous agents must be first-party to call sensitive tools. No human is in the loop to catch a mistake.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_type && context.agent_type == "autonomous" &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+}
+unless {
+    context has agent_trust_level && context.agent_trust_level == "first_party"
+};

package/_schemas/guardrails/templates/multi_turn_trajectory.cedar

@@ -0,0 +1,116 @@
+// =============================================================================
+// Multi-Turn Trajectory Escalation
+// =============================================================================
+// Blocks a conversation whose TRAJECTORY is an attack, even when no single
+// message is. A crescendo attack never sends a message alarming enough to
+// block on its own; it walks the model there in small, plausible steps and
+// asks for the payoff in a sentence that would pass any single-message filter.
+//
+// Shield scores every turn twice and exposes both scores separately:
+//   - injection_pulse_score / jailbreak_pulse_score — the single-turn
+//     classifier. Sees only the current message.
+//   - injection_deep_context_score / jailbreak_deep_context_score — the
+//     multi-turn model, which carries hidden state across turns keyed on
+//     session_id. Sees the whole conversation.
+//
+// Because they are separate keys, a rule can fire on the GAP between them:
+// high trajectory score, low message score. In plain language, "the history
+// is an attack and this message is not" — a condition a filter that only ever
+// has one number cannot express. Section 1 is that rule. Section 2 is a safety
+// net for a trajectory blatant enough to stand on its own.
+//
+// Requires a stable session_id on every request in the conversation. With no
+// session_id there is no threaded state, multi_turn_detection is false, and
+// none of these rules can fire.
+//
+// Detection layers:
+//   - injection (single-turn classifier, always available)
+//   - deepcontext (multi-turn model, always available)
+//
+// Context keys consumed:
+//   - multi_turn_detection: Bool — true only when threaded state was used
+//   - injection_deep_context_score, injection_pulse_score: Long (0-100)
+//   - jailbreak_deep_context_score, jailbreak_pulse_score: Long (0-100)
+//
+// Compliance:
+//   - OWASP LLM01, OWASP LLM02, MITRE ATLAS AML.T0051, AML.T0054
+//
+// Category:  security
+// Namespace: Guardrails
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: Trajectory/turn divergence
+// The conversation scores as an attack; this message does not.
+// ---------------------------------------------------------------------------
+
+@id("security.block-trajectory-injection-divergence")
+@name("Block multi-turn injection the current turn hides")
+@description("Blocks process_prompt and process_response when threaded state is in use, injection_deep_context_score >= 60, and injection_pulse_score <= 39.")
+@severity("critical")
+@tags("category:security,threat:injection,detection:ml,surface:process-prompt,surface:process-response,scope:multi-turn,owasp:llm01,mitre:atlas-t0051")
+@reject_message("Prompt blocked: this conversation is a progressive prompt-injection attempt. No single message crossed the line; the sequence did.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
+    resource
+)
+when {
+    context has multi_turn_detection && context.multi_turn_detection == true &&
+    context has injection_deep_context_score && context.injection_deep_context_score >= 60 &&
+    context has injection_pulse_score && context.injection_pulse_score <= 39
+};
+
+@id("security.block-trajectory-jailbreak-divergence")
+@name("Block multi-turn jailbreak the current turn hides")
+@description("Blocks process_prompt and process_response when threaded state is in use, jailbreak_deep_context_score >= 60, and jailbreak_pulse_score <= 39.")
+@severity("critical")
+@tags("category:security,threat:jailbreak,detection:ml,surface:process-prompt,surface:process-response,scope:multi-turn,owasp:llm02,mitre:atlas-t0054")
+@reject_message("Prompt blocked: this conversation is a progressive jailbreak. No single message crossed the line; the sequence did.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
+    resource
+)
+when {
+    context has multi_turn_detection && context.multi_turn_detection == true &&
+    context has jailbreak_deep_context_score && context.jailbreak_deep_context_score >= 60 &&
+    context has jailbreak_pulse_score && context.jailbreak_pulse_score <= 39
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Blatant trajectory, regardless of the message score
+// Covers the band between Section 1 and the default single-turn thresholds.
+// ---------------------------------------------------------------------------
+
+@id("security.block-trajectory-injection-high")
+@name("Block high-confidence multi-turn injection")
+@description("Blocks process_prompt and process_response when threaded state is in use and injection_deep_context_score >= 75.")
+@severity("high")
+@tags("category:security,threat:injection,detection:ml,surface:process-prompt,surface:process-response,scope:multi-turn,owasp:llm01")
+@reject_message("Prompt blocked: the multi-turn model scored this conversation as a prompt-injection attempt with high confidence.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
+    resource
+)
+when {
+    context has multi_turn_detection && context.multi_turn_detection == true &&
+    context has injection_deep_context_score && context.injection_deep_context_score >= 75
+};
+
+@id("security.block-trajectory-jailbreak-high")
+@name("Block high-confidence multi-turn jailbreak")
+@description("Blocks process_prompt and process_response when threaded state is in use and jailbreak_deep_context_score >= 75.")
+@severity("high")
+@tags("category:security,threat:jailbreak,detection:ml,surface:process-prompt,surface:process-response,scope:multi-turn,owasp:llm02")
+@reject_message("Prompt blocked: the multi-turn model scored this conversation as a jailbreak attempt with high confidence.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
+    resource
+)
+when {
+    context has multi_turn_detection && context.multi_turn_detection == true &&
+    context has jailbreak_deep_context_score && context.jailbreak_deep_context_score >= 75
+};