@highflame/policy 2.2.42 → 2.2.43

package/_schemas/guardrails/templates/session_risk_accumulation.cedar

@@ -0,0 +1,103 @@
+// =============================================================================
+// Session Risk Accumulation
+// =============================================================================
+// Blocks the privileged action a probing conversation is working toward. A
+// patient attacker expects some turns to be refused; what they want is one
+// tool call at the end — send the email, move the money, read the file. So
+// the useful question at a tool call is not "is this call suspicious?" but
+// "what has this conversation been doing up to now?"
+//
+// Shield accumulates that history on the session and projects it three ways,
+// because attackers come in three shapes:
+//   - session_max_* — a high-water mark that never decays. "Did this session
+//     EVER cross a line?" Catches the attacker who probes hard, is refused,
+//     goes quiet, then calmly asks for the tool.
+//   - session_cumulative_risk_score — an uncapped running sum. "How much
+//     total pressure has this session applied?" Catches death by a thousand
+//     cuts, where no single turn is alarming.
+//   - session_threat_turns — a count of turns that tripped a detector. "Is
+//     this sustained, or a one-off?" Separates probing from a false positive.
+//
+// Requires a stable session_id on every request, prompts AND tool calls. The
+// tool call must ride the same session as the conversation, or it reads 0.
+//
+// Detection layers:
+//   - session (aggregate over detection history, always available)
+//   - tool_validator (tool_is_sensitive, always available)
+//
+// Context keys consumed:
+//   - session_max_injection_score, session_max_jailbreak_score: Long (0-100)
+//   - session_cumulative_risk_score: Long — uncapped sum
+//   - session_threat_turns: Long — count
+//   - tool_is_sensitive: Bool
+//
+// Compliance:
+//   - OWASP LLM01, OWASP LLM06, OWASP ASI01, OWASP ASI04
+//
+// Category:  agent-security
+// Namespace: Guardrails
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: A session that ever crossed the line does not get to act
+// The conversation is what scored high; the tool call is what gets stopped.
+// ---------------------------------------------------------------------------
+
+@id("agent-security.block-tool-after-injection-in-session")
+@name("Block tools after an injection or jailbreak in the session")
+@description("Blocks call_tool when session_max_injection_score >= 60 or session_max_jailbreak_score >= 60, because an earlier turn attempted injection or jailbreak.")
+@severity("critical")
+@tags("category:agent-security,threat:escalation,detection:aggregate,surface:call-tool,scope:multi-turn,owasp:llm01")
+@reject_message("Tool execution blocked: an earlier turn in this session attempted prompt injection or jailbreak. Start a new session to use tools.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    (context has session_max_injection_score && context.session_max_injection_score >= 60) ||
+    (context has session_max_jailbreak_score && context.session_max_jailbreak_score >= 60)
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Accumulated pressure gates sensitive tools
+// No single turn set a max, but the session as a whole kept pushing.
+// ---------------------------------------------------------------------------
+
+@id("agent-security.block-sensitive-tool-on-session-risk")
+@name("Block sensitive tools once the session has accumulated risk")
+@description("Blocks call_tool when session_cumulative_risk_score >= 151 and tool_is_sensitive is true.")
+@severity("high")
+@tags("category:agent-security,threat:escalation,detection:aggregate,surface:call-tool,scope:multi-turn,owasp:asi01")
+@reject_message("Tool execution blocked: this session has accumulated significant risk across earlier turns. Sensitive tools are withheld for the remainder of the session.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has session_cumulative_risk_score &&
+    context.session_cumulative_risk_score >= 151 &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+};
+
+// ---------------------------------------------------------------------------
+// Section 3: Sustained probing, independent of any single score
+// Two is the smallest bar that separates repeated from one-off. Long-running
+// agent sessions accumulate turns faster and warrant a higher bar.
+// ---------------------------------------------------------------------------
+
+@id("agent-security.block-tool-on-repeated-threat-turns")
+@name("Block tool use in a session with repeated threat turns")
+@description("Blocks call_tool when session_threat_turns >= 2, because more than one turn in this session tripped a detector.")
+@severity("high")
+@tags("category:agent-security,threat:escalation,detection:aggregate,surface:call-tool,scope:multi-turn,owasp:asi04")
+@reject_message("Tool execution blocked: more than one turn in this session tripped a detector. This is sustained probing, not a one-off false positive.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has session_threat_turns && context.session_threat_turns >= 2
+};

package/_schemas/guardrails/templates/templates.json

@@ -599,6 +599,56 @@
         "surface:process-response",
         "detection:rule"
       ]
+    },
+    {
+      "id": "security.multi-turn-trajectory",
+      "name": "Multi-Turn Trajectory Escalation",
+      "description": "Block a conversation whose trajectory is an attack even when no single message is: fires on the gap between the multi-turn model and the single-turn classifier.",
+      "category": "security",
+      "file": "multi_turn_trajectory.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:security",
+        "threat:injection",
+        "threat:jailbreak",
+        "detection:ml",
+        "scope:multi-turn",
+        "owasp:llm01",
+        "owasp:llm02"
+      ]
+    },
+    {
+      "id": "agent-security.session-risk-accumulation",
+      "name": "Session Risk Accumulation",
+      "description": "Block the privileged action a probing conversation is working toward, using the session's high-water mark, cumulative risk, and count of threat turns.",
+      "category": "agent-security",
+      "file": "session_risk_accumulation.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-security",
+        "threat:escalation",
+        "detection:aggregate",
+        "surface:call-tool",
+        "scope:multi-turn",
+        "owasp:asi01",
+        "owasp:asi04"
+      ]
+    },
+    {
+      "id": "agent-identity.dual-attribution",
+      "name": "Dual Attribution",
+      "description": "Block privileged agent actions that cannot be attributed to a human. Deploy in monitor mode first; a service key is unverified until the agent is adopted.",
+      "category": "agent-identity",
+      "file": "dual_attribution.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-identity",
+        "detection:rule",
+        "surface:call-tool",
+        "scope:per-agent",
+        "posture:deny-default",
+        "owasp:asi01"
+      ]
     }
   ]
 }

package/dist/agent_ops-context.gen.d.ts

@@ -104,7 +104,6 @@ export declare const AgentOpsContextKey: {
     readonly PiiDetected: "pii_detected";
     readonly PiiScore: "pii_score";
     readonly PiiTypes: "pii_types";
-    readonly Principal: "principal";
     readonly PrincipalClearances: "principal_clearances";
     readonly PrincipalCompartments: "principal_compartments";
     readonly PrivilegeScope: "privilege_scope";
@@ -174,4 +173,4 @@ export type AgentOpsContextKey = (typeof AgentOpsContextKey)[keyof typeof AgentO
  * The full set of authorable context attribute keys for AgentOps.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const AgentOpsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "cwd", "detected_language", "detected_script", "detected_threats", "detector_count", "direction", "egress_hosts", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "event", "exec_allowlist", "exec_target_paths", "factuality_score", "flow_compartments", "flow_confidentiality", "flow_data_types", "flow_integrity", "flow_origins", "flow_resolution_status", "flow_sink", "flow_sink_effects", "flow_sink_is_external", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "isolation_tier", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "mechanism_capabilities", "model_name", "model_provider", "multi_turn_detection", "network_egress", "package_check_status", "package_install_detected", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "principal_clearances", "principal_compartments", "privilege_scope", "profanity_score", "read_target_paths", "request_id", "resolved_target_paths", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "surface", "suspicious_pattern", "threat_categories", "threat_count", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "unresolved_target", "user_email", "violence_score", "weapons_score", "workspace_root", "writable_paths", "write_target_paths"];
+export declare const AgentOpsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "cwd", "detected_language", "detected_script", "detected_threats", "detector_count", "direction", "egress_hosts", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "event", "exec_allowlist", "exec_target_paths", "factuality_score", "flow_compartments", "flow_confidentiality", "flow_data_types", "flow_integrity", "flow_origins", "flow_resolution_status", "flow_sink", "flow_sink_effects", "flow_sink_is_external", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "isolation_tier", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "mechanism_capabilities", "model_name", "model_provider", "multi_turn_detection", "network_egress", "package_check_status", "package_install_detected", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal_clearances", "principal_compartments", "privilege_scope", "profanity_score", "read_target_paths", "request_id", "resolved_target_paths", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "surface", "suspicious_pattern", "threat_categories", "threat_count", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "unresolved_target", "user_email", "violence_score", "weapons_score", "workspace_root", "writable_paths", "write_target_paths"];

package/dist/agent_ops-context.gen.js

@@ -106,7 +106,6 @@ export const AgentOpsContextKey = {
     PiiDetected: 'pii_detected',
     PiiScore: 'pii_score',
     PiiTypes: 'pii_types',
-    Principal: 'principal',
     PrincipalClearances: 'principal_clearances',
     PrincipalCompartments: 'principal_compartments',
     PrivilegeScope: 'privilege_scope',
@@ -275,7 +274,6 @@ export const AgentOpsContextKeys = [
     AgentOpsContextKey.PiiDetected,
     AgentOpsContextKey.PiiScore,
     AgentOpsContextKey.PiiTypes,
-    AgentOpsContextKey.Principal,
     AgentOpsContextKey.PrincipalClearances,
     AgentOpsContextKey.PrincipalCompartments,
     AgentOpsContextKey.PrivilegeScope,

package/dist/guardrails-context.gen.d.ts

@@ -95,7 +95,6 @@ export declare const GuardrailsContextKey: {
     readonly PiiDetected: "pii_detected";
     readonly PiiScore: "pii_score";
     readonly PiiTypes: "pii_types";
-    readonly Principal: "principal";
     readonly PrivilegeScope: "privilege_scope";
     readonly ProfanityScore: "profanity_score";
     readonly ReadTargetPaths: "read_target_paths";
@@ -156,4 +155,4 @@ export type GuardrailsContextKey = (typeof GuardrailsContextKey)[keyof typeof Gu
  * The full set of authorable context attribute keys for Guardrails.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const GuardrailsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "detected_language", "detected_script", "detector_count", "direction", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "exec_target_paths", "factuality_score", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "mcp_config_risk", "mcp_input_request_detected", "mcp_input_request_methods", "mcp_input_request_score", "mcp_input_request_types", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "multi_turn_detection", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "privilege_scope", "profanity_score", "read_target_paths", "request_id", "resolved_target_paths", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "suspicious_pattern", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "unresolved_target", "violence_score", "weapons_score", "write_target_paths"];
+export declare const GuardrailsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "detected_language", "detected_script", "detector_count", "direction", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "exec_target_paths", "factuality_score", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "mcp_config_risk", "mcp_input_request_detected", "mcp_input_request_methods", "mcp_input_request_score", "mcp_input_request_types", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "multi_turn_detection", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "read_target_paths", "request_id", "resolved_target_paths", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "suspicious_pattern", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "unresolved_target", "violence_score", "weapons_score", "write_target_paths"];

package/dist/guardrails-context.gen.js

@@ -97,7 +97,6 @@ export const GuardrailsContextKey = {
     PiiDetected: 'pii_detected',
     PiiScore: 'pii_score',
     PiiTypes: 'pii_types',
-    Principal: 'principal',
     PrivilegeScope: 'privilege_scope',
     ProfanityScore: 'profanity_score',
     ReadTargetPaths: 'read_target_paths',
@@ -248,7 +247,6 @@ export const GuardrailsContextKeys = [
     GuardrailsContextKey.PiiDetected,
     GuardrailsContextKey.PiiScore,
     GuardrailsContextKey.PiiTypes,
-    GuardrailsContextKey.Principal,
     GuardrailsContextKey.PrivilegeScope,
     GuardrailsContextKey.ProfanityScore,
     GuardrailsContextKey.ReadTargetPaths,