@highflame/policy 2.2.42 → 2.2.43

package/dist/guardrails-defaults.gen.js

@@ -3670,6 +3670,338 @@ when {
     context has secrets_detected && context.secrets_detected == true
 };
 `;
+const GUARDRAILS_SECURITY_MULTI_TURN_TRAJECTORY_CEDAR = `// =============================================================================
+// Multi-Turn Trajectory Escalation
+// =============================================================================
+// Blocks a conversation whose TRAJECTORY is an attack, even when no single
+// message is. A crescendo attack never sends a message alarming enough to
+// block on its own; it walks the model there in small, plausible steps and
+// asks for the payoff in a sentence that would pass any single-message filter.
+//
+// Shield scores every turn twice and exposes both scores separately:
+//   - injection_pulse_score / jailbreak_pulse_score — the single-turn
+//     classifier. Sees only the current message.
+//   - injection_deep_context_score / jailbreak_deep_context_score — the
+//     multi-turn model, which carries hidden state across turns keyed on
+//     session_id. Sees the whole conversation.
+//
+// Because they are separate keys, a rule can fire on the GAP between them:
+// high trajectory score, low message score. In plain language, "the history
+// is an attack and this message is not" — a condition a filter that only ever
+// has one number cannot express. Section 1 is that rule. Section 2 is a safety
+// net for a trajectory blatant enough to stand on its own.
+//
+// Requires a stable session_id on every request in the conversation. With no
+// session_id there is no threaded state, multi_turn_detection is false, and
+// none of these rules can fire.
+//
+// Detection layers:
+//   - injection (single-turn classifier, always available)
+//   - deepcontext (multi-turn model, always available)
+//
+// Context keys consumed:
+//   - multi_turn_detection: Bool — true only when threaded state was used
+//   - injection_deep_context_score, injection_pulse_score: Long (0-100)
+//   - jailbreak_deep_context_score, jailbreak_pulse_score: Long (0-100)
+//
+// Compliance:
+//   - OWASP LLM01, OWASP LLM02, MITRE ATLAS AML.T0051, AML.T0054
+//
+// Category:  security
+// Namespace: Guardrails
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: Trajectory/turn divergence
+// The conversation scores as an attack; this message does not.
+// ---------------------------------------------------------------------------
+
+@id("security.block-trajectory-injection-divergence")
+@name("Block multi-turn injection the current turn hides")
+@description("Blocks process_prompt and process_response when threaded state is in use, injection_deep_context_score >= 60, and injection_pulse_score <= 39.")
+@severity("critical")
+@tags("category:security,threat:injection,detection:ml,surface:process-prompt,surface:process-response,scope:multi-turn,owasp:llm01,mitre:atlas-t0051")
+@reject_message("Prompt blocked: this conversation is a progressive prompt-injection attempt. No single message crossed the line; the sequence did.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
+    resource
+)
+when {
+    context has multi_turn_detection && context.multi_turn_detection == true &&
+    context has injection_deep_context_score && context.injection_deep_context_score >= 60 &&
+    context has injection_pulse_score && context.injection_pulse_score <= 39
+};
+
+@id("security.block-trajectory-jailbreak-divergence")
+@name("Block multi-turn jailbreak the current turn hides")
+@description("Blocks process_prompt and process_response when threaded state is in use, jailbreak_deep_context_score >= 60, and jailbreak_pulse_score <= 39.")
+@severity("critical")
+@tags("category:security,threat:jailbreak,detection:ml,surface:process-prompt,surface:process-response,scope:multi-turn,owasp:llm02,mitre:atlas-t0054")
+@reject_message("Prompt blocked: this conversation is a progressive jailbreak. No single message crossed the line; the sequence did.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
+    resource
+)
+when {
+    context has multi_turn_detection && context.multi_turn_detection == true &&
+    context has jailbreak_deep_context_score && context.jailbreak_deep_context_score >= 60 &&
+    context has jailbreak_pulse_score && context.jailbreak_pulse_score <= 39
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Blatant trajectory, regardless of the message score
+// Covers the band between Section 1 and the default single-turn thresholds.
+// ---------------------------------------------------------------------------
+
+@id("security.block-trajectory-injection-high")
+@name("Block high-confidence multi-turn injection")
+@description("Blocks process_prompt and process_response when threaded state is in use and injection_deep_context_score >= 75.")
+@severity("high")
+@tags("category:security,threat:injection,detection:ml,surface:process-prompt,surface:process-response,scope:multi-turn,owasp:llm01")
+@reject_message("Prompt blocked: the multi-turn model scored this conversation as a prompt-injection attempt with high confidence.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
+    resource
+)
+when {
+    context has multi_turn_detection && context.multi_turn_detection == true &&
+    context has injection_deep_context_score && context.injection_deep_context_score >= 75
+};
+
+@id("security.block-trajectory-jailbreak-high")
+@name("Block high-confidence multi-turn jailbreak")
+@description("Blocks process_prompt and process_response when threaded state is in use and jailbreak_deep_context_score >= 75.")
+@severity("high")
+@tags("category:security,threat:jailbreak,detection:ml,surface:process-prompt,surface:process-response,scope:multi-turn,owasp:llm02")
+@reject_message("Prompt blocked: the multi-turn model scored this conversation as a jailbreak attempt with high confidence.")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
+    resource
+)
+when {
+    context has multi_turn_detection && context.multi_turn_detection == true &&
+    context has jailbreak_deep_context_score && context.jailbreak_deep_context_score >= 75
+};
+`;
+const GUARDRAILS_AGENT_SECURITY_SESSION_RISK_ACCUMULATION_CEDAR = `// =============================================================================
+// Session Risk Accumulation
+// =============================================================================
+// Blocks the privileged action a probing conversation is working toward. A
+// patient attacker expects some turns to be refused; what they want is one
+// tool call at the end — send the email, move the money, read the file. So
+// the useful question at a tool call is not "is this call suspicious?" but
+// "what has this conversation been doing up to now?"
+//
+// Shield accumulates that history on the session and projects it three ways,
+// because attackers come in three shapes:
+//   - session_max_* — a high-water mark that never decays. "Did this session
+//     EVER cross a line?" Catches the attacker who probes hard, is refused,
+//     goes quiet, then calmly asks for the tool.
+//   - session_cumulative_risk_score — an uncapped running sum. "How much
+//     total pressure has this session applied?" Catches death by a thousand
+//     cuts, where no single turn is alarming.
+//   - session_threat_turns — a count of turns that tripped a detector. "Is
+//     this sustained, or a one-off?" Separates probing from a false positive.
+//
+// Requires a stable session_id on every request, prompts AND tool calls. The
+// tool call must ride the same session as the conversation, or it reads 0.
+//
+// Detection layers:
+//   - session (aggregate over detection history, always available)
+//   - tool_validator (tool_is_sensitive, always available)
+//
+// Context keys consumed:
+//   - session_max_injection_score, session_max_jailbreak_score: Long (0-100)
+//   - session_cumulative_risk_score: Long — uncapped sum
+//   - session_threat_turns: Long — count
+//   - tool_is_sensitive: Bool
+//
+// Compliance:
+//   - OWASP LLM01, OWASP LLM06, OWASP ASI01, OWASP ASI04
+//
+// Category:  agent-security
+// Namespace: Guardrails
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: A session that ever crossed the line does not get to act
+// The conversation is what scored high; the tool call is what gets stopped.
+// ---------------------------------------------------------------------------
+
+@id("agent-security.block-tool-after-injection-in-session")
+@name("Block tools after an injection or jailbreak in the session")
+@description("Blocks call_tool when session_max_injection_score >= 60 or session_max_jailbreak_score >= 60, because an earlier turn attempted injection or jailbreak.")
+@severity("critical")
+@tags("category:agent-security,threat:escalation,detection:aggregate,surface:call-tool,scope:multi-turn,owasp:llm01")
+@reject_message("Tool execution blocked: an earlier turn in this session attempted prompt injection or jailbreak. Start a new session to use tools.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    (context has session_max_injection_score && context.session_max_injection_score >= 60) ||
+    (context has session_max_jailbreak_score && context.session_max_jailbreak_score >= 60)
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Accumulated pressure gates sensitive tools
+// No single turn set a max, but the session as a whole kept pushing.
+// ---------------------------------------------------------------------------
+
+@id("agent-security.block-sensitive-tool-on-session-risk")
+@name("Block sensitive tools once the session has accumulated risk")
+@description("Blocks call_tool when session_cumulative_risk_score >= 151 and tool_is_sensitive is true.")
+@severity("high")
+@tags("category:agent-security,threat:escalation,detection:aggregate,surface:call-tool,scope:multi-turn,owasp:asi01")
+@reject_message("Tool execution blocked: this session has accumulated significant risk across earlier turns. Sensitive tools are withheld for the remainder of the session.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has session_cumulative_risk_score &&
+    context.session_cumulative_risk_score >= 151 &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+};
+
+// ---------------------------------------------------------------------------
+// Section 3: Sustained probing, independent of any single score
+// Two is the smallest bar that separates repeated from one-off. Long-running
+// agent sessions accumulate turns faster and warrant a higher bar.
+// ---------------------------------------------------------------------------
+
+@id("agent-security.block-tool-on-repeated-threat-turns")
+@name("Block tool use in a session with repeated threat turns")
+@description("Blocks call_tool when session_threat_turns >= 2, because more than one turn in this session tripped a detector.")
+@severity("high")
+@tags("category:agent-security,threat:escalation,detection:aggregate,surface:call-tool,scope:multi-turn,owasp:asi04")
+@reject_message("Tool execution blocked: more than one turn in this session tripped a detector. This is sustained probing, not a one-off false positive.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has session_threat_turns && context.session_threat_turns >= 2
+};
+`;
+const GUARDRAILS_AGENT_IDENTITY_DUAL_ATTRIBUTION_CEDAR = `// =============================================================================
+// Dual Attribution
+// =============================================================================
+// Blocks privileged agent actions that cannot be attributed to a human. "Which
+// agent did this?" is half an answer; the other half is "on whose behalf?" An
+// agent is not an accountable party — the person who pointed it at the work
+// is. Shield projects both sides of that pair, so the requirement can be a
+// policy rather than a reporting convention nobody enforces.
+//
+// The agent comes from the authenticated identity, never from the request
+// body: agent_id, agent_type, agent_trust_level, agent_framework. The human
+// comes from the identity claims on the credential, as the \`principal\` record
+// — its \`act_sub\` field names the party the agent is acting for.
+//
+// Deploy in MONITOR mode first. Section 2 blocks unverified agents, and a
+// service key authenticates as unverified until the agent is registered and
+// adopted in Studio. Monitor records what each rule would have blocked on
+// every event without blocking anything; register the agent, then switch to
+// enforce.
+//
+// Detection layers:
+//   - agent identity (authentication layer, always available)
+//   - tool_validator (tool_is_sensitive, tool_category, always available)
+//
+// Context keys consumed:
+//   - agent_id, agent_type, agent_trust_level: String
+//   - principal: record — act_sub names the accountable human
+//   - tool_is_sensitive: Bool
+//   - tool_category: String
+//
+// Compliance:
+//   - OWASP ASI01, OWASP ASI04
+//
+// Category:  agent-identity
+// Namespace: Guardrails
+// =============================================================================
+
+// ---------------------------------------------------------------------------
+// Section 1: No unattributed privileged action
+// \`unless\` because the rule must fire when attribution is ABSENT, and an
+// absent field cannot be compared — only tested for.
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.require-principal-for-sensitive-tools")
+@name("Block sensitive agent tools without a principal")
+@description("Blocks call_tool on a sensitive tool by an agent unless the credential carries a principal whose act_sub names the human the agent acts for.")
+@severity("critical")
+@tags("category:agent-identity,detection:rule,surface:call-tool,scope:per-agent,posture:deny-default,owasp:asi01")
+@reject_message("Tool execution blocked: this agent invoked a sensitive tool with no accountable human attached. Every privileged agent action must name the person it acts for.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_id && context.agent_id != "" &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+}
+unless {
+    context has principal && context.principal has act_sub
+};
+
+// ---------------------------------------------------------------------------
+// Section 2: Trust level gates the blast radius
+// Start in monitor: a service key is unverified until the agent is adopted.
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.block-unverified-agent-sensitive-tools")
+@name("Block unverified agents from sensitive tools")
+@description("Blocks call_tool when agent_trust_level is unverified and the tool is sensitive or dangerous.")
+@severity("critical")
+@tags("category:agent-identity,detection:rule,surface:call-tool,scope:per-agent,posture:deny-default,owasp:asi01")
+@reject_message("Tool execution blocked: unverified agents may not call sensitive or dangerous tools. Register and adopt the agent to raise its trust level.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_trust_level && context.agent_trust_level == "unverified" &&
+    (
+        (context has tool_is_sensitive && context.tool_is_sensitive == true) ||
+        (context has tool_category && context.tool_category == "dangerous")
+    )
+};
+
+// ---------------------------------------------------------------------------
+// Section 3: Autonomous agents get a higher bar
+// Nobody watches an autonomous agent in real time, so a sensitive tool call
+// from one requires first-party trust rather than merely "not unverified".
+// ---------------------------------------------------------------------------
+
+@id("agent-identity.restrict-autonomous-agent-sensitive-tools")
+@name("Block non-first-party autonomous agent tool use")
+@description("Blocks call_tool on a sensitive tool when agent_type is autonomous unless agent_trust_level is first_party.")
+@severity("high")
+@tags("category:agent-identity,threat:escalation,detection:rule,surface:call-tool,scope:per-agent,owasp:asi04")
+@reject_message("Tool execution blocked: autonomous agents must be first-party to call sensitive tools. No human is in the loop to catch a mistake.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has agent_type && context.agent_type == "autonomous" &&
+    context has tool_is_sensitive && context.tool_is_sensitive == true
+}
+unless {
+    context has agent_trust_level && context.agent_trust_level == "first_party"
+};
+`;
 // =============================================================================
 // CATEGORIES
 // =============================================================================
@@ -4045,6 +4377,33 @@ export const GUARDRAILS_TEMPLATES = [
         severity: 'critical',
         tags: ['category:data-protection', 'threat:secrets', 'surface:process-response', 'detection:rule'],
     },
+    {
+        id: 'security.multi-turn-trajectory',
+        name: 'Multi-Turn Trajectory Escalation',
+        description: 'Block a conversation whose trajectory is an attack even when no single message is: fires on the gap between the multi-turn model and the single-turn classifier.',
+        category: 'security',
+        cedarText: GUARDRAILS_SECURITY_MULTI_TURN_TRAJECTORY_CEDAR,
+        severity: 'critical',
+        tags: ['category:security', 'threat:injection', 'threat:jailbreak', 'detection:ml', 'scope:multi-turn', 'owasp:llm01', 'owasp:llm02'],
+    },
+    {
+        id: 'agent-security.session-risk-accumulation',
+        name: 'Session Risk Accumulation',
+        description: 'Block the privileged action a probing conversation is working toward, using the session\'s high-water mark, cumulative risk, and count of threat turns.',
+        category: 'agent-security',
+        cedarText: GUARDRAILS_AGENT_SECURITY_SESSION_RISK_ACCUMULATION_CEDAR,
+        severity: 'critical',
+        tags: ['category:agent-security', 'threat:escalation', 'detection:aggregate', 'surface:call-tool', 'scope:multi-turn', 'owasp:asi01', 'owasp:asi04'],
+    },
+    {
+        id: 'agent-identity.dual-attribution',
+        name: 'Dual Attribution',
+        description: 'Block privileged agent actions that cannot be attributed to a human. Deploy in monitor mode first; a service key is unverified until the agent is adopted.',
+        category: 'agent-identity',
+        cedarText: GUARDRAILS_AGENT_IDENTITY_DUAL_ATTRIBUTION_CEDAR,
+        severity: 'critical',
+        tags: ['category:agent-identity', 'detection:rule', 'surface:call-tool', 'scope:per-agent', 'posture:deny-default', 'owasp:asi01'],
+    },
 ];
 // =============================================================================
 // TEMPLATES METADATA
@@ -4651,6 +5010,56 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
         "surface:process-response",
         "detection:rule"
       ]
+    },
+    {
+      "id": "security.multi-turn-trajectory",
+      "name": "Multi-Turn Trajectory Escalation",
+      "description": "Block a conversation whose trajectory is an attack even when no single message is: fires on the gap between the multi-turn model and the single-turn classifier.",
+      "category": "security",
+      "file": "multi_turn_trajectory.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:security",
+        "threat:injection",
+        "threat:jailbreak",
+        "detection:ml",
+        "scope:multi-turn",
+        "owasp:llm01",
+        "owasp:llm02"
+      ]
+    },
+    {
+      "id": "agent-security.session-risk-accumulation",
+      "name": "Session Risk Accumulation",
+      "description": "Block the privileged action a probing conversation is working toward, using the session's high-water mark, cumulative risk, and count of threat turns.",
+      "category": "agent-security",
+      "file": "session_risk_accumulation.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-security",
+        "threat:escalation",
+        "detection:aggregate",
+        "surface:call-tool",
+        "scope:multi-turn",
+        "owasp:asi01",
+        "owasp:asi04"
+      ]
+    },
+    {
+      "id": "agent-identity.dual-attribution",
+      "name": "Dual Attribution",
+      "description": "Block privileged agent actions that cannot be attributed to a human. Deploy in monitor mode first; a service key is unverified until the agent is adopted.",
+      "category": "agent-identity",
+      "file": "dual_attribution.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-identity",
+        "detection:rule",
+        "surface:call-tool",
+        "scope:per-agent",
+        "posture:deny-default",
+        "owasp:asi01"
+      ]
     }
   ]
 }

package/dist/parser.d.ts

@@ -25,7 +25,8 @@ export interface ParseResult {
  *
  * Uses the official cedar-wasm engine for parsing, ensuring correctness.
  * Policies with features that can't be represented as PolicyRule (e.g.,
- * unless clauses, complex expressions) are returned in the unstructured array.
+ * template slots) are returned in the unstructured array. Cedar `unless`
+ * clauses are represented as negated condition expressions.
  *
  * @param cedarText - Cedar policy text to parse
  * @returns ParseResult with structured rules, unstructured policies, and errors

package/dist/parser.js

@@ -25,7 +25,8 @@ function normalizeEntityRef(ref) {
  *
  * Uses the official cedar-wasm engine for parsing, ensuring correctness.
  * Policies with features that can't be represented as PolicyRule (e.g.,
- * unless clauses, complex expressions) are returned in the unstructured array.
+ * template slots) are returned in the unstructured array. Cedar `unless`
+ * clauses are represented as negated condition expressions.
  *
  * @param cedarText - Cedar policy text to parse
  * @returns ParseResult with structured rules, unstructured policies, and errors
@@ -154,12 +155,6 @@ function cedarJsonToRule(policy, policyId, index, originalText) {
  * Check if a Cedar policy can be represented as PolicyRule
  */
 function canRepresentAsRule(policy) {
-    // Unless clauses can't be represented
-    for (const cond of policy.conditions) {
-        if (cond.kind === "unless") {
-            return false;
-        }
-    }
     // Template slots can't be represented
     if (hasSlot(policy.principal) || hasSlot(policy.resource)) {
         return false;
@@ -289,27 +284,38 @@ function mapActionScope(scope) {
 function mapConditions(conditions, originalText) {
     const result = [];
     let hasUnmapped = false;
-    // Collect condition expressions from all when clauses
+    // Collect condition expressions from all when/unless clauses.
     const expressions = [];
+    // A policy may carry several `when` clauses, which Cedar ANDs together.
+    // Each clause must recover ITS OWN text: a previous version always read the
+    // first clause, so a second clause that fell through to the `raw` fallback
+    // was stored as a duplicate of the first and its real content was lost.
+    const clauses = originalText ? extractConditionClauses(originalText) : [];
+    let clauseIndex = 0;
     for (const cond of conditions) {
-        if (cond.kind !== "when") {
-            continue;
-        }
+        const clauseText = clauses[clauseIndex]?.text;
+        clauseIndex++;
         // Flat mapping (backward compat)
         const parsed = mapConditionBody(cond.body);
-        if (parsed.condition) {
+        if (cond.kind === "when" && parsed.condition) {
             result.push(parsed.condition);
         }
-        else if (parsed.raw) {
+        else if (parsed.raw || cond.kind === "unless") {
             hasUnmapped = true;
         }
-        // Recursive mapping (new)
-        expressions.push(mapConditionBodyToExpression(cond.body, originalText));
+        const expression = mapConditionBodyToExpression(cond.body, clauseText);
+        expressions.push(cond.kind === "unless" ? { kind: 'not', child: expression } : expression);
     }
-    // Extract readable Cedar condition text instead of storing JSON AST
+    // Extract readable Cedar condition text instead of storing JSON AST.
+    // With several clauses, join them — `when { A } when { B }` is `A && B`, so
+    // collapsing them into one guard keeps the regenerated policy equivalent
+    // rather than silently dropping every clause after the first.
     let rawCondition;
-    if (hasUnmapped && originalText) {
-        rawCondition = extractWhenClause(originalText);
+    if (hasUnmapped && clauses.length > 0) {
+        const equivalent = clauses.map(({ kind, text }) => kind === 'unless' ? `!(${text})` : `(${text})`);
+        rawCondition = clauses.length === 1 && clauses[0].kind === 'when'
+            ? clauses[0].text
+            : equivalent.join(" && ");
     }
     // Build the final condition expression
     let conditionExpression;
@@ -326,29 +332,105 @@ function mapConditions(conditions, originalText) {
     };
 }
 /**
- * Extract the readable condition text from a Cedar policy's when clause.
- * Given: `forbid (...)\nwhen { context.path like "/etc/*" };`
- * Returns: `context.path like "/etc/*"`
+ * Extract the readable condition text of every `when` clause, in source order.
+ *
+ * Given: `forbid (...)\nwhen { context.path like "/etc/*" }\nwhen { resource in X };`
+ * Returns: `['context.path like "/etc/*"', 'resource in X']`
+ *
+ * Scanning is string-literal aware, which matters for correctness rather than
+ * tidiness — a naive brace count mis-reads a clause in two ways, and this text
+ * is re-emitted into policy Cedar via `rawCondition`:
+ *
+ *   when { context.path like "/etc/}" && context.a == 1 }
+ *     → a `}` inside the literal ends the clause early, yielding text that is
+ *       cut mid-string and is not valid Cedar.
+ *   when { context.msg == "when { x" }
+ *     → the `{` inside the literal unbalances the count, so the scan runs past
+ *       the clause and swallows the `;` and whatever follows.
+ *
+ * The builder's dangerous-pattern guard rejects the second shape, but a
+ * rejected rawCondition with no flat conditions to fall back on emits the rule
+ * with NO `when` clause at all — an unconditional permit or forbid. Getting the
+ * boundaries right is what keeps that path unreachable.
+ *
+ * Brace depth still applies outside literals, so record literals (`{ a: 1 }`)
+ * inside a clause do not terminate it early.
  */
-function extractWhenClause(cedarText) {
-    const whenPrefix = "when {";
-    const idx = cedarText.indexOf(whenPrefix);
-    if (idx < 0) {
-        return "";
+function extractWhenClauses(cedarText) {
+    return extractConditionClauses(cedarText)
+        .filter(({ kind }) => kind === 'when')
+        .map(({ text }) => text);
+}
+function extractConditionClauses(cedarText) {
+    const result = [];
+    let i = 0;
+    let inString = false;
+    while (i < cedarText.length) {
+        const ch = cedarText[i];
+        if (inString) {
+            if (ch === "\\") {
+                i += 2;
+                continue;
+            }
+            if (ch === '"')
+                inString = false;
+            i++;
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+            i++;
+            continue;
+        }
+        const precededByIdent = i > 0 && /[A-Za-z0-9_]/.test(cedarText[i - 1]);
+        const kind = cedarText.startsWith('when {', i)
+            ? 'when'
+            : cedarText.startsWith('unless {', i)
+                ? 'unless'
+                : undefined;
+        if (!precededByIdent && kind) {
+            const start = i + `${kind} {`.length;
+            const end = findClauseEnd(cedarText, start);
+            result.push({ kind, text: cedarText.substring(start, end).trim() });
+            i = Math.min(end + 1, cedarText.length);
+            continue;
+        }
+        i++;
     }
-    const body = cedarText.substring(idx + whenPrefix.length);
+    return result;
+}
+/**
+ * Index of the `}` closing a clause body that starts at `start`, or the end of
+ * the text when the braces never balance. String-literal aware — see
+ * `extractWhenClauses`.
+ */
+function findClauseEnd(cedarText, start) {
     let depth = 1;
-    for (let i = 0; i < body.length; i++) {
-        if (body[i] === "{")
+    let inString = false;
+    for (let i = start; i < cedarText.length; i++) {
+        const ch = cedarText[i];
+        if (inString) {
+            if (ch === "\\") {
+                i++;
+                continue;
+            }
+            if (ch === '"')
+                inString = false;
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+            continue;
+        }
+        if (ch === "{")
             depth++;
-        if (body[i] === "}") {
+        if (ch === "}") {
             depth--;
-            if (depth === 0) {
-                return body.substring(0, i).trim();
-            }
+            if (depth === 0)
+                return i;
         }
     }
-    return body.trim();
+    return cedarText.length;
 }
 /**
  * Map a Cedar expression body to PolicyCondition
@@ -388,8 +470,13 @@ function mapConditionBody(body) {
 /**
  * Recursively walk the Cedar JSON AST to build a ConditionExpression tree.
  * Flattens binary && / || chains into n-ary and/or nodes.
+ *
+ * `clauseText` is the source text of the `when` clause this expression came
+ * from — already extracted by the caller, never the whole policy. It is only
+ * used for the `raw` fallback below, so a clause the walker cannot model keeps
+ * its own text instead of borrowing another clause's.
  */
-function mapConditionBodyToExpression(expr, originalText) {
+function mapConditionBodyToExpression(expr, clauseText) {
     // Logical AND — flatten binary chain
     if (expr["&&"]) {
         const children = flattenBinaryChain("&&", expr);
@@ -402,7 +489,7 @@ function mapConditionBodyToExpression(expr, originalText) {
     }
     // Negation
     if (expr["!"]) {
-        const child = mapConditionBodyToExpression(expr["!"].arg, originalText);
+        const child = mapConditionBodyToExpression(expr["!"].arg, clauseText);
         return { kind: 'not', child };
     }
     // Has (existence check): { has: { left: { Var: "context" }, attr: "field" } }
@@ -434,7 +521,7 @@ function mapConditionBodyToExpression(expr, originalText) {
             return mapped;
     }
     // Fallback — extract readable text if possible
-    const text = originalText ? extractWhenClause(originalText) : JSON.stringify(expr);
+    const text = clauseText ?? JSON.stringify(expr);
     return { kind: 'raw', text };
 }
 /**