@highflame/policy 2.2.44 → 2.3.0

package/_schemas/agent_ops/schema.cedarschema

@@ -118,6 +118,18 @@ namespace AgentOps {
         context: ProvisionSandboxContext
     };
 
+    /// The acting agent's lifecycle and IdP provenance, projected as
+    /// `context.actor`. Same four attributes, names and types as the legacy
+    /// members on PrincipalContext (which keeps them). Every member is optional
+    /// and the record is absent when none is supplied; absence means unknown,
+    /// not "active".
+    type ActorContext = {
+        "status"?: String,             // Agent lifecycle: "discovered" | "pending" | "active"
+        "origin"?: String,             // "native" | "entra" | "okta" | ...
+        "idp_iss"?: String,            // Upstream IdP issuer for IdP-registered agents
+        "idp_parent"?: String,         // Upstream parent object (e.g. Entra blueprint app id)
+    };
+
     // =========================================================================
     // Context Types (Action-Specific)
     // =========================================================================
@@ -158,6 +170,10 @@ namespace AgentOps {
         "act_iss"?: String,            // Issuer of the actor claim
         "mission_id"?: String,         // Correlates one delegation tree
         "grant_type"?: String,         // How the token was obtained (e.g. "api_key")
+        "status"?: String,             // Agent lifecycle: "discovered" | "pending" | "active"; absent = unknown, not active
+        "origin"?: String,             // Where the identity came from: "native" | "entra" | "okta" | ...
+        "idp_iss"?: String,            // Upstream IdP issuer for IdP-registered agents
+        "idp_parent"?: String,         // Upstream parent object (e.g. Entra blueprint app id)
     };
 
     /// Context for the process_response action.
@@ -175,6 +191,7 @@ namespace AgentOps {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service" | "mcp_server"
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -370,6 +387,7 @@ namespace AgentOps {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -581,6 +599,7 @@ namespace AgentOps {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -689,6 +708,7 @@ namespace AgentOps {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -801,6 +821,7 @@ namespace AgentOps {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -934,6 +955,7 @@ namespace AgentOps {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service" | "mcp_server"
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         "agent_trust_level"?: String,    // "untrusted" | "low" | "verified" | "trusted"
 
         // Core metadata (required)

package/_schemas/ai_gateway/schema.cedarschema

@@ -83,6 +83,8 @@ action call_tool appliesTo {
     // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
     role?: String,
     privilege_scope?: Set<String>,
+    "principal"?: PrincipalContext,   // ZeroID NHI identity block; absent when the token carries no NHI claims
+    "actor"?: ActorContext,           // Acting agent status/origin/IdP provenance; absent when none supplied
     // --- Content ---
     content: String,                  // Raw content being scanned
 
@@ -205,6 +207,8 @@ action connect_server appliesTo {
     // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
     role?: String,
     privilege_scope?: Set<String>,
+    "principal"?: PrincipalContext,   // ZeroID NHI identity block; absent when the token carries no NHI claims
+    "actor"?: ActorContext,           // Acting agent status/origin/IdP provenance; absent when none supplied
     content?: String,                 // Server config content (if available)
     mcp_server?: String,
 
@@ -302,6 +306,8 @@ action list appliesTo {
     // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
     role?: String,
     privilege_scope?: Set<String>,
+    "principal"?: PrincipalContext,   // ZeroID NHI identity block; absent when the token carries no NHI claims
+    "actor"?: ActorContext,           // Acting agent status/origin/IdP provenance; absent when none supplied
 
     // --- Content ---
     // The enumerated item's description. Optional: a tool may declare none,
@@ -376,6 +382,43 @@ action list appliesTo {
   },
 };
 
+// ZeroID NHI principal block, projected by Shield as `context.principal` when
+// the caller's token carries NHI claims. Same shape as the Guardrails and
+// AgentOps PrincipalContext, so one policy text reads the same keys on every
+// product. Every member is optional except `delegation_depth` (always emitted;
+// 0 for a direct token). The record is absent, not empty, when the request
+// carries no NHI claims, so `context has principal` is false.
+type PrincipalContext = {
+  "identity_type"?: String,      // "human" | "agent" | "service" | "mcp_server"
+  "sub_type"?: String,           // Identity subtype (e.g. "coding_agent")
+  "trust_level"?: String,        // "first_party" | "verified" | "unverified"
+  "framework"?: String,          // Agent framework (e.g. "langchain")
+  "publisher"?: String,          // Agent publisher
+  "capabilities"?: Set<String>,  // Capabilities granted to the identity
+  "scopes"?: Set<String>,        // OAuth scopes carried by the token
+  "delegation_depth": Long,      // Delegation hops; 0 for a direct token
+  "act_sub"?: String,            // RFC 8693 actor: the accountable human
+  "act_iss"?: String,            // Issuer of the actor claim
+  "mission_id"?: String,         // Correlates one delegation tree
+  "grant_type"?: String,         // How the token was obtained (e.g. "api_key")
+  "status"?: String,             // Agent lifecycle: "discovered" | "pending" | "active"; absent = unknown, not active
+  "origin"?: String,             // Where the identity came from: "native" | "entra" | "okta" | ...
+  "idp_iss"?: String,            // Upstream IdP issuer for IdP-registered agents
+  "idp_parent"?: String,         // Upstream parent object (e.g. Entra blueprint app id)
+};
+
+// The acting agent's lifecycle and IdP provenance, projected as
+// `context.actor`. Firehog traffic is evaluated in this namespace, which is
+// where agents registered in Okta or Entra reach Shield (ADR 0041 D5,
+// ADR 0042). Every member is optional and the record is absent when none is
+// supplied; absence means unknown, not "active".
+type ActorContext = {
+  "status"?: String,             // Agent lifecycle: "discovered" | "pending" | "active"
+  "origin"?: String,             // "native" | "entra" | "okta" | ...
+  "idp_iss"?: String,            // Upstream IdP issuer for IdP-registered agents
+  "idp_parent"?: String,         // Upstream parent object (e.g. Entra blueprint app id)
+};
+
 // Shared content-inspection context.
 //
 // Prompts and responses are inspected by the same detector pipeline and so
@@ -386,6 +429,8 @@ type ContentInspectionContext = {
     // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
     role?: String,
     privilege_scope?: Set<String>,
+    "principal"?: PrincipalContext,   // ZeroID NHI identity block; absent when the token carries no NHI claims
+    "actor"?: ActorContext,           // Acting agent status/origin/IdP provenance; absent when none supplied
     content: String,
     mcp_server?: String,
 
@@ -497,6 +542,8 @@ action read_file appliesTo {
     // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
     role?: String,
     privilege_scope?: Set<String>,
+    "principal"?: PrincipalContext,   // ZeroID NHI identity block; absent when the token carries no NHI claims
+    "actor"?: ActorContext,           // Acting agent status/origin/IdP provenance; absent when none supplied
     content: String,
     mcp_server?: String,
 
@@ -564,6 +611,8 @@ action write_file appliesTo {
     // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
     role?: String,
     privilege_scope?: Set<String>,
+    "principal"?: PrincipalContext,   // ZeroID NHI identity block; absent when the token carries no NHI claims
+    "actor"?: ActorContext,           // Acting agent status/origin/IdP provenance; absent when none supplied
     content: String,
     mcp_server?: String,
 

package/_schemas/ai_gateway/templates/defaults/semantic.cedar

@@ -28,6 +28,21 @@
 // Section 1: Prompt injection
 // ---------------------------------------------------------------------------
 
+@id("semantic.block-injection-prompt-ml")
+@name("Block prompt injection in LLM prompts (ML)")
+@description("Blocks process_prompt when injection_score >= 75.")
+@severity("critical")
+@tags("category:semantic,threat:injection,detection:ml,surface:process-prompt,owasp:llm01,mitre:atlas-t0051")
+@reject_message("Prompt blocked: the ML classifier detected prompt injection with high confidence.")
+forbid (
+    principal,
+    action == AIGateway::Action::"process_prompt",
+    resource
+)
+when {
+    context has injection_score && context.injection_score >= 75
+};
+
 @id("semantic.block-injection-ml")
 @name("Block injection (ML)")
 @description("Blocks call_tool when injection_score >= 75.")
@@ -47,6 +62,21 @@ when {
 // Section 2: Jailbreak
 // ---------------------------------------------------------------------------
 
+@id("semantic.block-jailbreak-prompt-ml")
+@name("Block jailbreak in LLM prompts (ML)")
+@description("Blocks process_prompt when jailbreak_score >= 75.")
+@severity("critical")
+@tags("category:semantic,threat:jailbreak,detection:ml,surface:process-prompt,owasp:llm02,mitre:atlas-t0054")
+@reject_message("Prompt blocked: the ML classifier detected a jailbreak attempt with high confidence.")
+forbid (
+    principal,
+    action == AIGateway::Action::"process_prompt",
+    resource
+)
+when {
+    context has jailbreak_score && context.jailbreak_score >= 75
+};
+
 @id("semantic.block-jailbreak-ml")
 @name("Block jailbreak (ML)")
 @description("Blocks call_tool when jailbreak_score >= 75.")

package/_schemas/ai_gateway/templates/single_use_sensitive_tools.cedar

@@ -0,0 +1,54 @@
+// =============================================================================
+// Single-Use for Sensitive Tools
+// =============================================================================
+// Permits sensitive tool calls, but only once per grant. @single_use makes
+// Shield record the first allow in an atomic consume store and deny any replay
+// of the same grant ("grant_consumed"). Bare @single_use means per tool: one
+// allow covers any call to the same action and tool. Use
+// @single_use("request") instead to bind the allow to one exact set of
+// arguments.
+//
+// @single_use is only valid on a permit. Deny, DEFER and step-up outcomes
+// never consume. If the consume store is unavailable the request is denied
+// ("single_use_store_unavailable") unless the operator opted into fail-open.
+//
+// Requests that carry no bearer token, such as gateway and internal-service
+// traffic, have no token id to record the use against. Shield denies every
+// sensitive call_tool from them ("single_use_unbound"), whatever the
+// fail-open setting. Until the gateway forwards the caller's token to Shield
+// (ADR 0041 D16, ADR 0042 D10), that means every sensitive gateway call.
+//
+// Try it with request-level monitor mode (guard requests sent with
+// mode=monitor): single_use.would_deny on each response shows what enforcing
+// would deny. Per-policy monitor mode does NOT exercise @single_use, because
+// Shield reads it only from enforcing policies; a monitor-mode copy of this
+// template reports nothing, and switching it to enforce takes effect at once.
+//
+// Adopted alone, this permit also allows every sensitive call_tool (once per
+// grant). Pair it with the policies that decide which sensitive calls are
+// allowed at all.
+//
+// Context keys consumed:
+//   - tool_is_sensitive: Bool
+//
+// Compliance:
+//   - OWASP ASI02
+//
+// Category:  agent-identity
+// Namespace: AIGateway
+// =============================================================================
+
+@id("agent-identity.permit-single-use-sensitive-tools")
+@name("Permit sensitive tools once per grant")
+@description("Permits call_tool on a sensitive tool once per grant.")
+@severity("medium")
+@tags("category:agent-identity,surface:call-tool,scope:per-tool,owasp:asi02,single-use")
+@single_use
+permit (
+    principal,
+    action == AIGateway::Action::"call_tool",
+    resource
+)
+when {
+    context has tool_is_sensitive && context.tool_is_sensitive
+};

package/_schemas/ai_gateway/templates/templates.json

@@ -33,6 +33,12 @@
       "description": "Block personally identifiable information (PII) in LLM prompts and MCP tool calls.",
       "layer": "guardrail"
     },
+    {
+      "id": "agent-identity",
+      "name": "Agent Identity",
+      "description": "Agent lifecycle and provenance controls for gateway traffic: unadopted agents, single-use sensitive tools.",
+      "layer": "guardrail"
+    },
     {
       "id": "organization",
       "name": "Organization",
@@ -197,6 +203,37 @@
         "compliance:pci-dss",
         "compliance:hipaa"
       ]
+    },
+    {
+      "id": "agent-identity.block-unadopted-agent-sensitive-tools",
+      "name": "Unadopted Agents: No Sensitive Tool Calls",
+      "description": "Block sensitive tool calls from agents whose lifecycle status is not active (discovered or pending). Deploy in monitor mode first to see which discovered agents already call sensitive tools.",
+      "category": "agent-identity",
+      "file": "unadopted_agents.cedar",
+      "severity": "high",
+      "tags": [
+        "category:agent-identity",
+        "detection:rule",
+        "surface:call-tool",
+        "scope:per-agent",
+        "posture:deny-default",
+        "owasp:asi04"
+      ]
+    },
+    {
+      "id": "agent-identity.permit-single-use-sensitive-tools",
+      "name": "Single-Use for Sensitive Tools",
+      "description": "Permit sensitive tool calls once per grant: the first allow is recorded and a replay of the same grant is denied. Bare @single_use means per tool; use @single_use(\"request\") to bind to one set of arguments. Requests without a bearer token (gateway and internal-service traffic, until the gateway forwards the caller token) are denied (single_use_unbound). Try it with request-level mode=monitor: per-policy monitor mode does not exercise @single_use. Adopted alone, it also permits every sensitive call.",
+      "category": "agent-identity",
+      "file": "single_use_sensitive_tools.cedar",
+      "severity": "medium",
+      "tags": [
+        "category:agent-identity",
+        "surface:call-tool",
+        "scope:per-tool",
+        "owasp:asi02",
+        "single-use"
+      ]
     }
   ]
 }

package/_schemas/ai_gateway/templates/unadopted_agents.cedar

@@ -0,0 +1,64 @@
+// =============================================================================
+// Unadopted Agents: No Sensitive Tool Calls
+// =============================================================================
+// Agents that an enterprise registers in its own IdP (Entra Agent ID, Okta AI
+// agents) are discovered by Highflame before anyone adopts them. A discovered
+// or pending agent has an identity but no owner-reviewed policy, so it should
+// not reach sensitive tools until it is adopted (status "active").
+//
+// `context.actor.status` carries the agent lifecycle status. When no actor
+// record is present the rule falls back to the legacy `context.principal.status`
+// profile. Absence means "unknown", not "active": the has-guards below make a
+// request with no status fall through to the other rules instead of being
+// matched here. Any status other than "active" is matched, so suspended and
+// deactivated agents are blocked too. The comparison is case-sensitive, like
+// ZeroID's lowercase status values.
+//
+// Today this template is forward-looking. ZeroID mints tokens only for active
+// identities and stamps "active" at mint, and every caller of Shield forwards
+// that value, so no live path reports another status yet. It takes effect when
+// a non-active status reaches Shield, as ADR 0042 plans for agents registered
+// in a customer IdP. The status is a mint-time snapshot: an identity suspended
+// after its token was minted reads "active" until the token expires.
+//
+// `tool_is_sensitive` is set by Shield's tool_validator from a fixed list of
+// tool names (shell, execute_command, write_file, http_post, send_email,
+// delete_file, run_sql, plus Shield's configured list); other tools are not
+// sensitive and are not matched.
+//
+// This copy covers gateway traffic (Firehog), which Shield evaluates in the
+// AIGateway namespace. The Guardrails copy covers Guardrails traffic.
+//
+// Deploy in MONITOR mode first to see which discovered agents already call
+// sensitive tools, adopt them, then switch to enforce.
+//
+// Context keys consumed:
+//   - actor, principal: records - status is the agent lifecycle status
+//   - tool_is_sensitive: Bool
+//
+// Compliance:
+//   - OWASP ASI04
+//
+// Category:  agent-identity
+// Namespace: AIGateway
+// =============================================================================
+
+@id("agent-identity.block-unadopted-agent-sensitive-tools")
+@name("Block unadopted agents from sensitive tools")
+@description("Blocks call_tool on a sensitive tool when actor.status (or, without an actor record, principal.status) is present and is not active.")
+@severity("high")
+@tags("category:agent-identity,detection:rule,surface:call-tool,scope:per-agent,posture:deny-default,owasp:asi04")
+@reject_message("Tool execution blocked: this agent has not been adopted, so it may not call sensitive tools. Adopt the agent to activate it.")
+forbid (
+    principal,
+    action == AIGateway::Action::"call_tool",
+    resource
+)
+when {
+    (
+        (context has actor && context.actor has status && context.actor.status != "active") ||
+        (!(context has actor) && context has principal && context.principal has status &&
+         context.principal.status != "active")
+    ) &&
+    context has tool_is_sensitive && context.tool_is_sensitive
+};

package/_schemas/guardrails/schema.cedarschema

@@ -141,6 +141,22 @@ namespace Guardrails {
         "act_iss"?: String,            // Issuer of the actor claim
         "mission_id"?: String,         // Correlates one delegation tree
         "grant_type"?: String,         // How the token was obtained (e.g. "api_key")
+        "status"?: String,             // Agent lifecycle: "discovered" | "pending" | "active"; absent = unknown, not active
+        "origin"?: String,             // Where the identity came from: "native" | "entra" | "okta" | ...
+        "idp_iss"?: String,            // Upstream IdP issuer for IdP-registered agents
+        "idp_parent"?: String,         // Upstream parent object (e.g. Entra blueprint app id)
+    };
+
+    /// The acting agent's lifecycle and IdP provenance, projected as
+    /// `context.actor`. Same four attributes, names and types as the legacy
+    /// members on PrincipalContext (which keeps them). Every member is optional
+    /// and the record is absent when none is supplied; absence means unknown,
+    /// not "active".
+    type ActorContext = {
+        "status"?: String,             // Agent lifecycle: "discovered" | "pending" | "active"
+        "origin"?: String,             // "native" | "entra" | "okta" | ...
+        "idp_iss"?: String,            // Upstream IdP issuer for IdP-registered agents
+        "idp_parent"?: String,         // Upstream parent object (e.g. Entra blueprint app id)
     };
 
     /// Context for the process_response action.
@@ -160,6 +176,7 @@ namespace Guardrails {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -312,6 +329,7 @@ namespace Guardrails {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -508,6 +526,7 @@ namespace Guardrails {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -581,6 +600,7 @@ namespace Guardrails {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -658,6 +678,7 @@ namespace Guardrails {
         "privilege_scope"?: Set<String>,
         "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
         "principal"?: PrincipalContext, // ZeroID NHI identity block; absent when the token carries no NHI claims
+        "actor"?: ActorContext,         // Acting agent attributes (status/origin/IdP provenance); absent when none supplied
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,

package/_schemas/guardrails/templates/single_use_sensitive_tools.cedar

@@ -0,0 +1,54 @@
+// =============================================================================
+// Single-Use for Sensitive Tools
+// =============================================================================
+// Permits sensitive tool calls, but only once per grant. @single_use makes
+// Shield record the first allow in an atomic consume store and deny any replay
+// of the same grant ("grant_consumed"). Bare @single_use means per tool: one
+// allow covers any call to the same action and tool. Use
+// @single_use("request") instead to bind the allow to one exact set of
+// arguments.
+//
+// @single_use is only valid on a permit. Deny, DEFER and step-up outcomes
+// never consume. If the consume store is unavailable the request is denied
+// ("single_use_store_unavailable") unless the operator opted into fail-open.
+//
+// Requests that carry no bearer token, such as gateway and internal-service
+// traffic, have no token id to record the use against. Shield denies every
+// sensitive call_tool from them ("single_use_unbound"), whatever the
+// fail-open setting. Until the gateway forwards the caller's token to Shield
+// (ADR 0041 D16, ADR 0042 D10), that means every sensitive gateway call.
+//
+// Try it with request-level monitor mode (guard requests sent with
+// mode=monitor): single_use.would_deny on each response shows what enforcing
+// would deny. Per-policy monitor mode does NOT exercise @single_use, because
+// Shield reads it only from enforcing policies; a monitor-mode copy of this
+// template reports nothing, and switching it to enforce takes effect at once.
+//
+// Adopted alone, this permit also allows every sensitive call_tool (once per
+// grant). Pair it with the policies that decide which sensitive calls are
+// allowed at all.
+//
+// Context keys consumed:
+//   - tool_is_sensitive: Bool
+//
+// Compliance:
+//   - OWASP ASI02
+//
+// Category:  agent-identity
+// Namespace: Guardrails
+// =============================================================================
+
+@id("agent-identity.permit-single-use-sensitive-tools")
+@name("Permit sensitive tools once per grant")
+@description("Permits call_tool on a sensitive tool once per grant.")
+@severity("medium")
+@tags("category:agent-identity,surface:call-tool,scope:per-tool,owasp:asi02,single-use")
+@single_use
+permit (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    context has tool_is_sensitive && context.tool_is_sensitive
+};

package/_schemas/guardrails/templates/templates.json

@@ -649,6 +649,37 @@
         "posture:deny-default",
         "owasp:asi01"
       ]
+    },
+    {
+      "id": "agent-identity.block-unadopted-agent-sensitive-tools",
+      "name": "Unadopted Agents: No Sensitive Tool Calls",
+      "description": "Block sensitive tool calls from agents whose lifecycle status is not active (discovered or pending). Deploy in monitor mode first to see which discovered agents already call sensitive tools.",
+      "category": "agent-identity",
+      "file": "unadopted_agents.cedar",
+      "severity": "high",
+      "tags": [
+        "category:agent-identity",
+        "detection:rule",
+        "surface:call-tool",
+        "scope:per-agent",
+        "posture:deny-default",
+        "owasp:asi04"
+      ]
+    },
+    {
+      "id": "agent-identity.permit-single-use-sensitive-tools",
+      "name": "Single-Use for Sensitive Tools",
+      "description": "Permit sensitive tool calls once per grant: the first allow is recorded and a replay of the same grant is denied. Bare @single_use means per tool; use @single_use(\"request\") to bind to one set of arguments. Requests without a bearer token (gateway and internal-service traffic, until the gateway forwards the caller token) are denied (single_use_unbound). Try it with request-level mode=monitor: per-policy monitor mode does not exercise @single_use. Adopted alone, it also permits every sensitive call.",
+      "category": "agent-identity",
+      "file": "single_use_sensitive_tools.cedar",
+      "severity": "medium",
+      "tags": [
+        "category:agent-identity",
+        "surface:call-tool",
+        "scope:per-tool",
+        "owasp:asi02",
+        "single-use"
+      ]
     }
   ]
 }

package/_schemas/guardrails/templates/unadopted_agents.cedar

@@ -0,0 +1,64 @@
+// =============================================================================
+// Unadopted Agents: No Sensitive Tool Calls
+// =============================================================================
+// Agents that an enterprise registers in its own IdP (Entra Agent ID, Okta AI
+// agents) are discovered by Highflame before anyone adopts them. A discovered
+// or pending agent has an identity but no owner-reviewed policy, so it should
+// not reach sensitive tools until it is adopted (status "active").
+//
+// `context.actor.status` carries the agent lifecycle status. When no actor
+// record is present the rule falls back to the legacy `context.principal.status`
+// profile. Absence means "unknown", not "active": the has-guards below make a
+// request with no status fall through to the other rules instead of being
+// matched here. Any status other than "active" is matched, so suspended and
+// deactivated agents are blocked too. The comparison is case-sensitive, like
+// ZeroID's lowercase status values.
+//
+// Today this template is forward-looking. ZeroID mints tokens only for active
+// identities and stamps "active" at mint, and every caller of Shield forwards
+// that value, so no live path reports another status yet. It takes effect when
+// a non-active status reaches Shield, as ADR 0042 plans for agents registered
+// in a customer IdP. The status is a mint-time snapshot: an identity suspended
+// after its token was minted reads "active" until the token expires.
+//
+// `tool_is_sensitive` is set by Shield's tool_validator from a fixed list of
+// tool names (shell, execute_command, write_file, http_post, send_email,
+// delete_file, run_sql, plus Shield's configured list); other tools are not
+// sensitive and are not matched.
+//
+// This copy covers Guardrails traffic. Gateway traffic (Firehog) is evaluated
+// in the AIGateway namespace; use the AIGateway copy for it.
+//
+// Deploy in MONITOR mode first to see which discovered agents already call
+// sensitive tools, adopt them, then switch to enforce.
+//
+// Context keys consumed:
+//   - actor, principal: records - status is the agent lifecycle status
+//   - tool_is_sensitive: Bool
+//
+// Compliance:
+//   - OWASP ASI04
+//
+// Category:  agent-identity
+// Namespace: Guardrails
+// =============================================================================
+
+@id("agent-identity.block-unadopted-agent-sensitive-tools")
+@name("Block unadopted agents from sensitive tools")
+@description("Blocks call_tool on a sensitive tool when actor.status (or, without an actor record, principal.status) is present and is not active.")
+@severity("high")
+@tags("category:agent-identity,detection:rule,surface:call-tool,scope:per-agent,posture:deny-default,owasp:asi04")
+@reject_message("Tool execution blocked: this agent has not been adopted, so it may not call sensitive tools. Adopt the agent to activate it.")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+)
+when {
+    (
+        (context has actor && context.actor has status && context.actor.status != "active") ||
+        (!(context has actor) && context has principal && context.principal has status &&
+         context.principal.status != "active")
+    ) &&
+    context has tool_is_sensitive && context.tool_is_sensitive
+};