@highflame/policy 2.2.6 → 2.2.8

package/_schemas/agent_ops/schema.cedarschema

@@ -0,0 +1,666 @@
+// =============================================================================
+// AgentOps Cedar Schema
+// =============================================================================
+// Unified schema for all agent guardrail policies. Covers every request path
+// where an AI agent touches the Highflame platform:
+//   - LLM prompt/response (Guardrails path)
+//   - IDE tool calls and file access (Overwatch path)
+//   - MCP server connections (AI Gateway path)
+//
+// The context types are a superset of Guardrails, Overwatch, and AI Gateway
+// schemas. All extra fields are optional — Shield projects only what is present
+// in the request, Cedar ignores absent optional attributes.
+//
+// Service: highflame-shield (agent_ops product)
+// Namespace: AgentOps
+// =============================================================================
+
+namespace AgentOps {
+    // =========================================================================
+    // Entity Types — ReBAC Hierarchy
+    // =========================================================================
+    // Entity hierarchy enables Cedar's `in` operator for policy scoping:
+    //   Account (org root)
+    //     └── Project in [Account]
+    //           ├── App in [Project]
+    //           │     └── Session in [App, Agent]
+    //           └── Agent in [Project]
+    //                 └── Session in [App, Agent]
+    //
+    // Policy scoping examples:
+    //   resource in AgentOps::Project::"<uuid>"          → project-wide (all agents)
+    //   resource in AgentOps::Agent::"<external_id>"     → named agent + its sessions
+    //   resource == AgentOps::Agent::"<external_id>"     → named agent only (exact match)
+    //   resource in AgentOps::Account::"<uuid>"          → org-wide
+    // =========================================================================
+
+    /// Account represents an organization (top-level tenant)
+    entity Account;
+
+    /// Project represents a project within an account
+    entity Project in [Account];
+
+    /// User represents a principal (human or service) making requests
+    entity User;
+
+    /// Agent represents an AI agent (Claude, Cursor, Copilot, MCP client, etc.)
+    /// Used as both principal (who is acting) and resource (policy scoping target).
+    /// Agent + sessions: resource in AgentOps::Agent::"<external_id>" (hierarchy match)
+    /// Agent only:       resource == AgentOps::Agent::"<external_id>" (exact match)
+    entity Agent in [Project];
+
+    /// App represents a protected application (guardrails-enabled LLM app)
+    entity App in [Project];
+
+    /// Session represents an agentic conversation session with state tracking.
+    /// Sessions can belong to either an App or an Agent.
+    entity Session in [App, Agent];
+
+    // =========================================================================
+    // Actions
+    // =========================================================================
+
+    /// Process user prompts and AI responses for security threats and content violations
+    action "process_prompt" appliesTo {
+        principal: [User, Agent],
+        resource: [App, Agent, Session],
+        context: ProcessPromptContext
+    };
+
+    /// Execute tool calls (shell, file operations, MCP tools)
+    action "call_tool" appliesTo {
+        principal: [User, Agent],
+        resource: [Agent, Session],
+        context: CallToolContext
+    };
+
+    /// Read file operations
+    action "read_file" appliesTo {
+        principal: [User, Agent],
+        resource: [Agent, Session],
+        context: FileReadContext
+    };
+
+    /// Write file operations
+    action "write_file" appliesTo {
+        principal: [User, Agent],
+        resource: [Agent, Session],
+        context: FileWriteContext
+    };
+
+    /// Connect to an MCP server
+    action "connect_server" appliesTo {
+        principal: [User, Agent],
+        resource: [Agent, Session],
+        context: ConnectServerContext
+    };
+
+    // =========================================================================
+    // Context Types (Action-Specific)
+    // =========================================================================
+
+    /// Context for process_prompt action (user prompts & AI responses)
+    type ProcessPromptContext = {
+        // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+        "role"?: String,
+        "privilege_scope"?: Set<String>,
+        "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service" | "mcp_server"
+        "principal"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)
+        // Core metadata (required)
+        "request_id": String,
+        "timestamp": Long,
+        "direction": String,        // "input" | "output"
+        "content_type": String,     // "prompt" | "response" | "tool_call" | "file"
+        "detector_count": Long,
+
+        // IDE / workspace context (optional — present for Overwatch/code-agent traffic)
+        "source"?: String,           // Traffic origin: "ide" | "cli" | "api" | "browser"
+        "event"?: String,            // Event type: "prompt" | "tool_call" | "file_read" | ...
+        "user_email"?: String,       // Human operator email (IDE sessions)
+        "cwd"?: String,              // Current working directory
+        "workspace_root"?: String,   // IDE workspace root path
+
+        // Model context (optional — present for AI Gateway traffic)
+        "model_name"?: String,       // LLM model name: "claude-3-5-sonnet", "gpt-4o", ...
+        "model_provider"?: String,   // Model provider: "anthropic" | "openai" | "google" | ...
+
+        // Security - Injection & Jailbreak (optional)
+        "injection_score"?: Long,  // Combined injection confidence: MAX(pulse, deep_context)
+        "jailbreak_score"?: Long,  // Combined jailbreak confidence: MAX(pulse, deep_context)
+        "injection_pulse_score"?: Long,  // 0-100 Pulse single-turn classifier
+        "injection_deep_context_score"?: Long, // 0-100 DeepContext multi-turn
+        "jailbreak_pulse_score"?: Long,  // 0-100 Pulse single-turn classifier
+        "jailbreak_deep_context_score"?: Long, // 0-100 DeepContext multi-turn
+        "injection_type"?: String,       // "prompt" | "sql" | "command" | "none"
+        "indirect_injection_score"?: Long, // Indirect injection via tool outputs (0-100)
+
+        // Privacy - Secrets (optional)
+        "secrets_detected"?: Boolean,
+        "secret_count"?: Long,
+        "secret_types"?: Set<String>,    // ["aws_access_key", "github_token", ...]
+
+        // Privacy - PII (optional)
+        "pii_detected"?: Boolean,
+        "pii_count"?: Long,
+        "pii_types"?: Set<String>,       // ["email", "phone", "ssn", "credit_card", ...]
+        "pii_score"?: Long,         // PII ML classifier confidence (0-100)
+
+        // Aggregated threat summary (optional — populated by aggregation detectors)
+        "highest_severity"?: String,     // "critical" | "high" | "medium" | "low" | "none"
+        "threat_count"?: Long,
+        "threat_categories"?: Set<String>,
+        "detected_threats"?: Set<String>,
+
+        // Trust & Safety - Toxicity (optional)
+        "violence_score"?: Long,         // 0-100
+        "hate_speech_score"?: Long,      // 0-100
+        "sexual_score"?: Long,           // 0-100
+        "weapons_score"?: Long,          // 0-100
+        "crime_score"?: Long,            // 0-100
+        "profanity_score"?: Long,        // 0-100
+
+        // Semantic - Topic Classification (optional)
+        "content_topics"?: Set<String>,      // ["controlled_substances", "weapons_manufacturing", ...]
+        "topic_confidence"?: Long,           // 0-100
+
+        // Security - Invisible Character Detection (optional)
+        "invisible_chars_detected"?: Boolean,
+        "invisible_chars_score"?: Long,      // 0-100
+
+        // Security - Pattern Detection (optional)
+        "command_injection_detected"?: Boolean,
+        "command_injection_type"?: String,       // "reverse_shell" | "privilege_escalation" | ...
+        "command_injection_score"?: Long,        // 0-100
+        "path_traversal_detected"?: Boolean,
+        "path_traversal_severity"?: String,      // "critical" | "high" | "medium" | "low" | "none"
+        "path_traversal_type"?: String,
+        "sql_injection_detected"?: Boolean,
+        "sql_injection_type"?: String,           // "tautology" | "union_based" | "destructive" | ...
+        "sql_injection_score"?: Long,            // 0-100
+
+        // Security - Cross-Origin Escalation (optional)
+        "cross_origin_detected"?: Boolean,
+        "cross_origin_type"?: String,            // "cross_origin_tool" | "cross_origin_server" | "none"
+        "cross_origin_score"?: Long,             // 0-100
+
+        // Security - Encoded Injection (optional)
+        "encoded_content_detected"?: Boolean,
+        "encoded_types"?: Set<String>,           // ["base64", "hex", "unicode", "url", ...]
+        "encoded_count"?: Long,
+        "encoded_score"?: Long,                  // 0-100
+
+        // Language & Script Detection (optional)
+        "detected_language"?: String,            // ISO language code
+        "is_english"?: Boolean,
+        "language_confidence"?: Long,            // 0-100
+        "detected_script"?: String,              // "latin" | "cyrillic" | "arabic" | "unknown" | ...
+        "is_latin_script"?: Boolean,
+        "script_confidence"?: Long,              // 0-100
+
+        // Content Analysis (optional)
+        "hallucination_score"?: Long,
+        "factuality_score"?: Long,               // 0-100
+        "sentiment_score"?: Long,
+        "contains_code"?: Boolean,
+        "code_languages"?: Set<String>,
+        "code_ratio"?: Long,                     // 0-100
+        "keyword_matched"?: Boolean,
+        "keyword_categories"?: Set<String>,
+        "keyword_count"?: Long,
+        "contains_non_ascii"?: Boolean,
+        "phishing_detected"?: Boolean,
+        "content_safety_score"?: Long,           // 0-100
+        "content_safety_blocked"?: Boolean,
+
+        // Agentic - Multi-Turn Context (optional)
+        "conversation_turn"?: Long,
+        "multi_turn_detection"?: Boolean,
+
+        // Session Detection History — cross-turn sticky flags (optional)
+        "session_pii_detected"?: Boolean,
+        "session_pii_types"?: Set<String>,
+        "session_secrets_detected"?: Boolean,
+        "session_secret_types"?: Set<String>,
+        "session_injection_detected"?: Boolean,
+        "session_command_injection"?: Boolean,
+        "session_threat_turns"?: Long,
+        "session_max_injection_score"?: Long,
+        "session_max_jailbreak_score"?: Long,
+        "session_max_command_injection_score"?: Long,
+        "session_max_pii_score"?: Long,
+        "session_max_secret_score"?: Long,
+        "session_cumulative_risk_score"?: Long,
+        "session_original_request"?: String,
+        "session_max_sensitivity"?: String,
+
+        // Usage Budget — multi-window token & cost enforcement (optional)
+        "budget_remaining_pct"?: Long,
+        "budget_exceeded"?: Boolean,
+        "budget_cost_micros_this_turn"?: Long,
+        "budget_model"?: String,
+        "budget_tokens_pct_session"?: Long,
+        "budget_tokens_pct_daily"?: Long,
+        "budget_tokens_pct_monthly"?: Long,
+        "budget_cost_pct_daily"?: Long,
+        "budget_cost_pct_monthly"?: Long,
+        "budget_exceeded_session"?: Boolean,
+        "budget_exceeded_daily"?: Boolean,
+        "budget_exceeded_monthly"?: Boolean,
+
+        // Agent Identity — authenticated agent principal metadata (optional)
+        "agent_id"?: String,
+        "agent_type"?: String,           // "orchestrator" | "autonomous" | "tool_agent" | "human_proxy"
+        "agent_trust_level"?: String,    // "first_party" | "verified_third_party" | "unverified"
+        "agent_framework"?: String,
+        "agent_publisher"?: String,
+
+    };
+
+    /// Context for call_tool action (agentic tool execution)
+    type CallToolContext = {
+        // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+        "role"?: String,
+        "privilege_scope"?: Set<String>,
+        "identity_type"?: String,
+        "principal"?: String,
+        // Core metadata (required)
+        "request_id": String,
+        "timestamp": Long,
+
+        // IDE / workspace context (optional)
+        "source"?: String,
+        "event"?: String,
+        "user_email"?: String,
+        "cwd"?: String,
+        "workspace_root"?: String,
+
+        // Tool Risk (optional)
+        "tool_name"?: String,
+        "tool_risk_score"?: Long,        // 0-100
+        "tool_is_sensitive"?: Boolean,
+        "tool_category"?: String,        // "safe" | "sensitive" | "dangerous"
+        "tool_is_builtin"?: Boolean,
+
+        // AARM R3 (CAP-ENF-007) — Action Parameter Validation
+        "action_params"?: {
+            "amount"?: Long,
+            "count"?: Long,
+            "command"?: String,
+            "path"?: String,
+            "url"?: String,
+            "recipient"?: String,
+            "target"?: String,
+            "query"?: String,
+        },
+        "param_type_violation"?: Boolean,
+        "param_type_violations"?: Set<String>,
+
+        // MCP context (optional)
+        "mcp_server"?: String,
+        "mcp_tool"?: String,
+        "mcp_server_verified"?: Boolean,
+
+        // Agentic - Behavioral Patterns (optional)
+        "suspicious_pattern"?: Boolean,
+        "pattern_type"?: String,         // "data_exfiltration" | "secret_exfiltration" | ...
+        "sequence_risk"?: Long,          // 0-100
+
+        // Agentic - Loop Detection (optional)
+        "loop_detected"?: Boolean,
+        "loop_count"?: Long,
+        "loop_tool"?: String,
+
+        // Security checks on tool arguments (optional)
+        "secrets_detected"?: Boolean,
+        "secret_count"?: Long,
+        "secret_types"?: Set<String>,
+        "pii_detected"?: Boolean,
+        "pii_types"?: Set<String>,
+        "pii_count"?: Long,
+        "pii_score"?: Long,
+        "injection_score"?: Long,
+        "injection_pulse_score"?: Long,
+        "injection_deep_context_score"?: Long,
+        "indirect_injection_score"?: Long,
+        "indirect_injection_type"?: String,      // Type of indirect injection detected
+
+        // Semantic - Topic Classification (optional)
+        "content_topics"?: Set<String>,      // ["controlled_substances", "weapons_manufacturing", ...]
+        "topic_confidence"?: Long,           // 0-100
+
+        // Security - Pattern Detection (optional)
+        "command_injection_detected"?: Boolean,
+        "command_injection_type"?: String,
+        "command_injection_score"?: Long,
+        "path_traversal_detected"?: Boolean,
+        "path_traversal_severity"?: String,
+        "path_traversal_type"?: String,
+        "sql_injection_detected"?: Boolean,
+        "sql_injection_type"?: String,
+        "sql_injection_score"?: Long,
+
+        // Security - Cross-Origin Escalation (optional)
+        "cross_origin_detected"?: Boolean,
+        "cross_origin_type"?: String,
+        "cross_origin_score"?: Long,
+
+        // Security - Invisible Character Detection (optional)
+        "invisible_chars_detected"?: Boolean,
+        "invisible_chars_score"?: Long,
+
+        // Security - Encoded Injection (optional)
+        "encoded_content_detected"?: Boolean,
+        "encoded_types"?: Set<String>,
+        "encoded_count"?: Long,
+        "encoded_score"?: Long,
+
+        // Agentic - Agent Security (optional)
+        "tool_poisoning_detected"?: Boolean,
+        "tool_poisoning_score"?: Long,
+        "tool_poisoning_type"?: String,
+        "rug_pull_detected"?: Boolean,
+        "rug_pull_score"?: Long,
+        "rug_pull_type"?: String,
+
+        // Agentic - MCP Risk (optional)
+        "mcp_config_risk"?: Boolean,
+        "mcp_risk_type"?: String,
+        "mcp_risk_score"?: Long,
+
+        // Tool Operation Classifier (optional)
+        "tool_operation_classes"?: Set<String>,
+
+        // Agentic - Multi-Turn Context (optional)
+        "conversation_turn"?: Long,
+        "multi_turn_detection"?: Boolean,
+
+        // Session Detection History — cross-turn sticky flags (optional)
+        "session_pii_detected"?: Boolean,
+        "session_pii_types"?: Set<String>,
+        "session_secrets_detected"?: Boolean,
+        "session_secret_types"?: Set<String>,
+        "session_injection_detected"?: Boolean,
+        "session_command_injection"?: Boolean,
+        "session_threat_turns"?: Long,
+        "session_max_injection_score"?: Long,
+        "session_max_jailbreak_score"?: Long,
+        "session_max_command_injection_score"?: Long,
+        "session_max_pii_score"?: Long,
+        "session_max_secret_score"?: Long,
+        "session_cumulative_risk_score"?: Long,
+        "session_original_request"?: String,
+        "session_max_sensitivity"?: String,
+
+        // Usage Budget (optional)
+        "budget_remaining_pct"?: Long,
+        "budget_exceeded"?: Boolean,
+        "budget_cost_micros_this_turn"?: Long,
+        "budget_model"?: String,
+        "budget_tokens_pct_session"?: Long,
+        "budget_tokens_pct_daily"?: Long,
+        "budget_tokens_pct_monthly"?: Long,
+        "budget_cost_pct_daily"?: Long,
+        "budget_cost_pct_monthly"?: Long,
+        "budget_exceeded_session"?: Boolean,
+        "budget_exceeded_daily"?: Boolean,
+        "budget_exceeded_monthly"?: Boolean,
+
+        // Aggregated threat summary (optional)
+        "highest_severity"?: String,
+        "threat_count"?: Long,
+        "detected_threats"?: Set<String>,
+
+        // Agent Identity (optional)
+        "agent_id"?: String,
+        "agent_type"?: String,
+        "agent_trust_level"?: String,
+        "agent_framework"?: String,
+        "agent_publisher"?: String,
+
+        // File & Path (optional)
+        "path"?: String,
+
+    };
+
+    /// Context for read_file action
+    type FileReadContext = {
+        // Identity (optional)
+        "role"?: String,
+        "privilege_scope"?: Set<String>,
+        "identity_type"?: String,
+        "principal"?: String,
+        // Core metadata (required)
+        "request_id": String,
+        "timestamp": Long,
+
+        // IDE / workspace context (optional)
+        "source"?: String,
+        "event"?: String,
+        "user_email"?: String,
+        "cwd"?: String,
+        "workspace_root"?: String,
+
+        // File path (optional)
+        "path"?: String,
+
+        // Security checks on file content (optional)
+        "secrets_detected"?: Boolean,
+        "secret_count"?: Long,
+        "secret_types"?: Set<String>,
+        "pii_detected"?: Boolean,
+        "pii_types"?: Set<String>,
+
+        // Security - Path Traversal (optional)
+        "path_traversal_detected"?: Boolean,
+        "path_traversal_severity"?: String,
+        "path_traversal_type"?: String,
+
+        // Aggregated threat summary (optional)
+        "highest_severity"?: String,
+        "threat_count"?: Long,
+        "detected_threats"?: Set<String>,
+
+        // Session Detection History (optional)
+        "session_pii_detected"?: Boolean,
+        "session_pii_types"?: Set<String>,
+        "session_secrets_detected"?: Boolean,
+        "session_secret_types"?: Set<String>,
+        "session_injection_detected"?: Boolean,
+        "session_command_injection"?: Boolean,
+        "session_threat_turns"?: Long,
+        "session_max_injection_score"?: Long,
+        "session_max_jailbreak_score"?: Long,
+        "session_max_command_injection_score"?: Long,
+        "session_max_pii_score"?: Long,
+        "session_max_secret_score"?: Long,
+        "session_cumulative_risk_score"?: Long,
+        "session_original_request"?: String,
+        "session_max_sensitivity"?: String,
+
+        // Usage Budget (optional)
+        "budget_remaining_pct"?: Long,
+        "budget_exceeded"?: Boolean,
+        "budget_cost_micros_this_turn"?: Long,
+        "budget_model"?: String,
+        "budget_tokens_pct_session"?: Long,
+        "budget_tokens_pct_daily"?: Long,
+        "budget_tokens_pct_monthly"?: Long,
+        "budget_cost_pct_daily"?: Long,
+        "budget_cost_pct_monthly"?: Long,
+        "budget_exceeded_session"?: Boolean,
+        "budget_exceeded_daily"?: Boolean,
+        "budget_exceeded_monthly"?: Boolean,
+
+        // Agent Identity (optional)
+        "agent_id"?: String,
+        "agent_type"?: String,
+        "agent_trust_level"?: String,
+        "agent_framework"?: String,
+        "agent_publisher"?: String,
+
+    };
+
+    /// Context for write_file action
+    type FileWriteContext = {
+        // Identity (optional)
+        "role"?: String,
+        "privilege_scope"?: Set<String>,
+        "identity_type"?: String,
+        "principal"?: String,
+        // Core metadata (required)
+        "request_id": String,
+        "timestamp": Long,
+
+        // IDE / workspace context (optional)
+        "source"?: String,
+        "event"?: String,
+        "user_email"?: String,
+        "cwd"?: String,
+        "workspace_root"?: String,
+
+        // File path (optional)
+        "path"?: String,
+
+        // Security - Invisible Character Detection in write content (optional)
+        "invisible_chars_detected"?: Boolean,
+        "invisible_chars_score"?: Long,
+
+        // Security checks on content being written (optional)
+        "secrets_detected"?: Boolean,
+        "secret_count"?: Long,
+        "secret_types"?: Set<String>,
+        "pii_detected"?: Boolean,
+        "pii_types"?: Set<String>,
+
+        // Security - Path Traversal (optional)
+        "path_traversal_detected"?: Boolean,
+        "path_traversal_severity"?: String,
+        "path_traversal_type"?: String,
+
+        // Aggregated threat summary (optional)
+        "highest_severity"?: String,
+        "threat_count"?: Long,
+        "detected_threats"?: Set<String>,
+
+        // Session Detection History (optional)
+        "session_pii_detected"?: Boolean,
+        "session_pii_types"?: Set<String>,
+        "session_secrets_detected"?: Boolean,
+        "session_secret_types"?: Set<String>,
+        "session_injection_detected"?: Boolean,
+        "session_command_injection"?: Boolean,
+        "session_threat_turns"?: Long,
+        "session_max_injection_score"?: Long,
+        "session_max_jailbreak_score"?: Long,
+        "session_max_command_injection_score"?: Long,
+        "session_max_pii_score"?: Long,
+        "session_max_secret_score"?: Long,
+        "session_cumulative_risk_score"?: Long,
+        "session_original_request"?: String,
+        "session_max_sensitivity"?: String,
+
+        // Usage Budget (optional)
+        "budget_remaining_pct"?: Long,
+        "budget_exceeded"?: Boolean,
+        "budget_cost_micros_this_turn"?: Long,
+        "budget_model"?: String,
+        "budget_tokens_pct_session"?: Long,
+        "budget_tokens_pct_daily"?: Long,
+        "budget_tokens_pct_monthly"?: Long,
+        "budget_cost_pct_daily"?: Long,
+        "budget_cost_pct_monthly"?: Long,
+        "budget_exceeded_session"?: Boolean,
+        "budget_exceeded_daily"?: Boolean,
+        "budget_exceeded_monthly"?: Boolean,
+
+        // Agent Identity (optional)
+        "agent_id"?: String,
+        "agent_type"?: String,
+        "agent_trust_level"?: String,
+        "agent_framework"?: String,
+        "agent_publisher"?: String,
+
+    };
+
+    /// Context for connect_server action (MCP server connections)
+    type ConnectServerContext = {
+        // Identity (optional)
+        "role"?: String,
+        "privilege_scope"?: Set<String>,
+        "identity_type"?: String,
+        "principal"?: String,
+        // Core metadata (required)
+        "request_id": String,
+        "timestamp": Long,
+
+        // IDE / workspace context (optional)
+        "source"?: String,
+        "event"?: String,
+        "user_email"?: String,
+        "cwd"?: String,
+        "workspace_root"?: String,
+
+        // MCP context (optional)
+        "mcp_server"?: String,
+        "mcp_server_verified"?: Boolean,
+
+        // Agentic - Agent Security (optional)
+        "tool_poisoning_detected"?: Boolean,
+        "tool_poisoning_score"?: Long,
+        "tool_poisoning_type"?: String,
+
+        // Agentic - MCP Risk (optional)
+        "mcp_config_risk"?: Boolean,
+        "mcp_risk_type"?: String,
+        "mcp_risk_score"?: Long,
+
+        // Security - Cross-Origin Escalation (optional)
+        "cross_origin_detected"?: Boolean,
+        "cross_origin_type"?: String,
+        "cross_origin_score"?: Long,
+
+        // Aggregated threat summary (optional)
+        "highest_severity"?: String,
+        "threat_count"?: Long,
+        "detected_threats"?: Set<String>,
+
+        // Session Detection History (optional)
+        "session_pii_detected"?: Boolean,
+        "session_pii_types"?: Set<String>,
+        "session_secrets_detected"?: Boolean,
+        "session_secret_types"?: Set<String>,
+        "session_injection_detected"?: Boolean,
+        "session_command_injection"?: Boolean,
+        "session_threat_turns"?: Long,
+        "session_max_injection_score"?: Long,
+        "session_max_jailbreak_score"?: Long,
+        "session_max_command_injection_score"?: Long,
+        "session_max_pii_score"?: Long,
+        "session_max_secret_score"?: Long,
+        "session_cumulative_risk_score"?: Long,
+        "session_original_request"?: String,
+        "session_max_sensitivity"?: String,
+
+        // Usage Budget (optional)
+        "budget_remaining_pct"?: Long,
+        "budget_exceeded"?: Boolean,
+        "budget_cost_micros_this_turn"?: Long,
+        "budget_model"?: String,
+        "budget_tokens_pct_session"?: Long,
+        "budget_tokens_pct_daily"?: Long,
+        "budget_tokens_pct_monthly"?: Long,
+        "budget_cost_pct_daily"?: Long,
+        "budget_cost_pct_monthly"?: Long,
+        "budget_exceeded_session"?: Boolean,
+        "budget_exceeded_daily"?: Boolean,
+        "budget_exceeded_monthly"?: Boolean,
+
+        // Agent Identity (optional)
+        "agent_id"?: String,
+        "agent_type"?: String,
+        "agent_trust_level"?: String,
+        "agent_framework"?: String,
+        "agent_publisher"?: String,
+
+    };
+}

package/_schemas/agent_ops/templates/defaults/baseline.cedar

@@ -0,0 +1,21 @@
+// =============================================================================
+// Baseline Permit (Default)
+// =============================================================================
+// Permits all AgentOps actions by default. Threat-specific forbid policies
+// override this when detectors fire. Cedar is default-deny: without at least
+// one permit rule, every request is denied regardless of forbid rules.
+//
+// Category:  organization
+// Namespace: AgentOps
+// =============================================================================
+
+@id("organization.permit-baseline")
+@name("Permit baseline")
+@description("Permits all AgentOps actions.")
+@severity("low")
+@tags("category:organization,posture:permit-default")
+permit (
+    principal,
+    action,
+    resource
+);