@highflame/policy 2.2.6 → 2.2.8

package/_schemas/agent_ops/templates/templates.json

@@ -0,0 +1,66 @@
+{
+  "service": "agent_ops",
+  "version": "1.0.0",
+  "description": "AgentOps policy templates — unified agent guardrails for code agents, MCP tools, and AI Gateway traffic",
+  "categories": [
+    {
+      "id": "threat-detection",
+      "name": "Threat Detection",
+      "description": "Detect and block injection, jailbreak, and adversarial attacks across all agent traffic."
+    },
+    {
+      "id": "data-protection",
+      "name": "Data Protection",
+      "description": "Prevent secrets, PII, and sensitive data from leaking in prompts, responses, or tool calls."
+    },
+    {
+      "id": "agent-security",
+      "name": "Agent Security",
+      "description": "Guard against tool poisoning, rug-pull attacks, and multi-agent delegation abuse."
+    },
+    {
+      "id": "tool-permissioning",
+      "name": "Tool Permissioning",
+      "description": "Allow-list or block-list specific tools, MCP servers, and shell operations by risk tier."
+    },
+    {
+      "id": "code-security",
+      "name": "Code Security",
+      "description": "Enforce safe coding patterns: no exfiltration commands, no destructive write operations."
+    },
+    {
+      "id": "content-safety",
+      "name": "Content Safety",
+      "description": "Block harmful, toxic, or policy-violating content in agent inputs and outputs."
+    },
+    {
+      "id": "organization",
+      "name": "Organization",
+      "description": "Organization-wide baselines and default permit/deny policies."
+    }
+  ],
+  "defaults": [
+    {
+      "id": "organization.permit-baseline",
+      "name": "Baseline Permit",
+      "description": "Permits all AgentOps actions by default; threat-specific forbid policies override this when detectors fire.",
+      "category": "organization",
+      "file": "defaults/baseline.cedar",
+      "severity": "low",
+      "tags": ["category:organization", "posture:permit-default"],
+      "is_active": true
+    }
+  ],
+  "templates": [
+    {
+      "id": "organization.permit-baseline",
+      "name": "Baseline Permit",
+      "description": "Permits all AgentOps actions by default; threat-specific forbid policies override this when detectors fire.",
+      "category": "organization",
+      "file": "defaults/baseline.cedar",
+      "severity": "low",
+      "tags": ["category:organization", "posture:permit-default"],
+      "auto_deploy": true
+    }
+  ]
+}

package/_schemas/ai_gateway/schema.cedarschema

@@ -173,6 +173,12 @@ action call_tool appliesTo {
     budget_exceeded_session?: Bool,
     budget_exceeded_daily?: Bool,
     budget_exceeded_monthly?: Bool,
+
+    // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
+    rpm_remaining_pct?: Long,
+    rpm_exceeded?: Bool,
+    tpm_remaining_pct?: Long,
+    tpm_exceeded?: Bool,
   },
 };
 
@@ -245,6 +251,12 @@ action connect_server appliesTo {
     budget_exceeded_session?: Bool,
     budget_exceeded_daily?: Bool,
     budget_exceeded_monthly?: Bool,
+
+    // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
+    rpm_remaining_pct?: Long,
+    rpm_exceeded?: Bool,
+    tpm_remaining_pct?: Long,
+    tpm_exceeded?: Bool,
   },
 };
 
@@ -326,6 +338,12 @@ action process_prompt appliesTo {
     budget_exceeded_session?: Bool,
     budget_exceeded_daily?: Bool,
     budget_exceeded_monthly?: Bool,
+
+    // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
+    rpm_remaining_pct?: Long,
+    rpm_exceeded?: Bool,
+    tpm_remaining_pct?: Long,
+    tpm_exceeded?: Bool,
   },
 };
 
@@ -387,6 +405,12 @@ action read_file appliesTo {
     budget_exceeded_session?: Bool,
     budget_exceeded_daily?: Bool,
     budget_exceeded_monthly?: Bool,
+
+    // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
+    rpm_remaining_pct?: Long,
+    rpm_exceeded?: Bool,
+    tpm_remaining_pct?: Long,
+    tpm_exceeded?: Bool,
   },
 };
 
@@ -448,6 +472,12 @@ action write_file appliesTo {
     budget_exceeded_session?: Bool,
     budget_exceeded_daily?: Bool,
     budget_exceeded_monthly?: Bool,
+
+    // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
+    rpm_remaining_pct?: Long,
+    rpm_exceeded?: Bool,
+    tpm_remaining_pct?: Long,
+    tpm_exceeded?: Bool,
   },
 };
 

package/_schemas/guardrails/schema.cedarschema

@@ -229,6 +229,12 @@ namespace Guardrails {
         "budget_exceeded_daily"?: Bool,         // Any daily-scoped budget exceeded
         "budget_exceeded_monthly"?: Bool,       // Any monthly-scoped budget exceeded
 
+        // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
+        "rpm_remaining_pct"?: Long,
+        "rpm_exceeded"?: Bool,
+        "tpm_remaining_pct"?: Long,
+        "tpm_exceeded"?: Bool,
+
         // Agent Identity — authenticated agent principal metadata (optional)
         // Present when the request is made by an AI agent (API key or JWT with agent claims).
         // Empty strings for human user requests. Use these to write agent-specific policies.
@@ -315,6 +321,12 @@ namespace Guardrails {
         "budget_exceeded_daily"?: Bool,
         "budget_exceeded_monthly"?: Bool,
 
+        // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
+        "rpm_remaining_pct"?: Long,
+        "rpm_exceeded"?: Bool,
+        "tpm_remaining_pct"?: Long,
+        "tpm_exceeded"?: Bool,
+
         // Semantic - Topic Classification (optional)
         "content_topics"?: Set<String>,      // ["controlled_substances", "weapons_manufacturing", ...]
         "topic_confidence"?: Long,           // 0-100
@@ -468,6 +480,12 @@ namespace Guardrails {
         "budget_exceeded_daily"?: Bool,
         "budget_exceeded_monthly"?: Bool,
 
+        // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
+        "rpm_remaining_pct"?: Long,
+        "rpm_exceeded"?: Bool,
+        "tpm_remaining_pct"?: Long,
+        "tpm_exceeded"?: Bool,
+
         // Agent Identity — authenticated agent principal metadata (optional)
         "agent_id"?: String,
         "agent_type"?: String,
@@ -539,6 +557,12 @@ namespace Guardrails {
         "budget_exceeded_daily"?: Bool,
         "budget_exceeded_monthly"?: Bool,
 
+        // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
+        "rpm_remaining_pct"?: Long,
+        "rpm_exceeded"?: Bool,
+        "tpm_remaining_pct"?: Long,
+        "tpm_exceeded"?: Bool,
+
         // Agent Identity — authenticated agent principal metadata (optional)
         "agent_id"?: String,
         "agent_type"?: String,
@@ -610,6 +634,12 @@ namespace Guardrails {
         "budget_exceeded_daily"?: Bool,
         "budget_exceeded_monthly"?: Bool,
 
+        // Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
+        "rpm_remaining_pct"?: Long,
+        "rpm_exceeded"?: Bool,
+        "tpm_remaining_pct"?: Long,
+        "tpm_exceeded"?: Bool,
+
         // Agent Identity — authenticated agent principal metadata (optional)
         "agent_id"?: String,
         "agent_type"?: String,

package/dist/agent_ops-context.gen.d.ts

@@ -0,0 +1,150 @@
+/**
+ * Context attribute keys for AgentOps AgentOps unified agent guardrail policy enforcement — superset of Guardrails, Overwatch, and AI Gateway.
+ *
+ * These constants correspond to the context attributes defined in the
+ * AgentOps Cedar schema and are used at policy evaluation time.
+ */
+export declare const AgentOpsContextKey: {
+    readonly AgentFramework: "agent_framework";
+    readonly AgentId: "agent_id";
+    readonly AgentPublisher: "agent_publisher";
+    readonly AgentTrustLevel: "agent_trust_level";
+    readonly AgentType: "agent_type";
+    readonly BudgetExceeded: "budget_exceeded";
+    readonly BudgetRemainingPct: "budget_remaining_pct";
+    readonly CodeLanguages: "code_languages";
+    readonly CodeRatio: "code_ratio";
+    readonly CommandInjectionDetected: "command_injection_detected";
+    readonly CommandInjectionScore: "command_injection_score";
+    readonly CommandInjectionType: "command_injection_type";
+    readonly ContainsCode: "contains_code";
+    readonly ContainsNonAscii: "contains_non_ascii";
+    readonly ContentSafetyBlocked: "content_safety_blocked";
+    readonly ContentSafetyScore: "content_safety_score";
+    readonly ContentTopics: "content_topics";
+    readonly ContentType: "content_type";
+    readonly ConversationTurn: "conversation_turn";
+    readonly CrimeScore: "crime_score";
+    readonly CrossOriginDetected: "cross_origin_detected";
+    readonly CrossOriginScore: "cross_origin_score";
+    readonly CrossOriginType: "cross_origin_type";
+    readonly Cwd: "cwd";
+    readonly DetectedLanguage: "detected_language";
+    readonly DetectedScript: "detected_script";
+    readonly DetectedThreats: "detected_threats";
+    readonly DetectorCount: "detector_count";
+    readonly Direction: "direction";
+    readonly EncodedContentDetected: "encoded_content_detected";
+    readonly EncodedCount: "encoded_count";
+    readonly EncodedScore: "encoded_score";
+    readonly EncodedTypes: "encoded_types";
+    readonly Event: "event";
+    readonly FactualityScore: "factuality_score";
+    readonly HallucinationScore: "hallucination_score";
+    readonly HateSpeechScore: "hate_speech_score";
+    readonly HighestSeverity: "highest_severity";
+    readonly IdentityType: "identity_type";
+    readonly IndirectInjectionScore: "indirect_injection_score";
+    readonly IndirectInjectionType: "indirect_injection_type";
+    readonly InjectionDeepContextScore: "injection_deep_context_score";
+    readonly InjectionPulseScore: "injection_pulse_score";
+    readonly InjectionScore: "injection_score";
+    readonly InjectionType: "injection_type";
+    readonly InvisibleCharsDetected: "invisible_chars_detected";
+    readonly InvisibleCharsScore: "invisible_chars_score";
+    readonly IsEnglish: "is_english";
+    readonly IsLatinScript: "is_latin_script";
+    readonly JailbreakDeepContextScore: "jailbreak_deep_context_score";
+    readonly JailbreakPulseScore: "jailbreak_pulse_score";
+    readonly JailbreakScore: "jailbreak_score";
+    readonly KeywordCategories: "keyword_categories";
+    readonly KeywordCount: "keyword_count";
+    readonly KeywordMatched: "keyword_matched";
+    readonly LanguageConfidence: "language_confidence";
+    readonly LoopCount: "loop_count";
+    readonly LoopDetected: "loop_detected";
+    readonly LoopTool: "loop_tool";
+    readonly McpConfigRisk: "mcp_config_risk";
+    readonly McpRiskScore: "mcp_risk_score";
+    readonly McpRiskType: "mcp_risk_type";
+    readonly McpServer: "mcp_server";
+    readonly McpServerVerified: "mcp_server_verified";
+    readonly McpTool: "mcp_tool";
+    readonly ModelName: "model_name";
+    readonly ModelProvider: "model_provider";
+    readonly MultiTurnDetection: "multi_turn_detection";
+    readonly ParamTypeViolation: "param_type_violation";
+    readonly ParamTypeViolations: "param_type_violations";
+    readonly Path: "path";
+    readonly PathTraversalDetected: "path_traversal_detected";
+    readonly PathTraversalSeverity: "path_traversal_severity";
+    readonly PathTraversalType: "path_traversal_type";
+    readonly PatternType: "pattern_type";
+    readonly PhishingDetected: "phishing_detected";
+    readonly PiiCount: "pii_count";
+    readonly PiiDetected: "pii_detected";
+    readonly PiiScore: "pii_score";
+    readonly PiiTypes: "pii_types";
+    readonly Principal: "principal";
+    readonly PrivilegeScope: "privilege_scope";
+    readonly ProfanityScore: "profanity_score";
+    readonly RequestId: "request_id";
+    readonly Role: "role";
+    readonly RpmExceeded: "rpm_exceeded";
+    readonly RpmRemainingPct: "rpm_remaining_pct";
+    readonly RugPullDetected: "rug_pull_detected";
+    readonly RugPullScore: "rug_pull_score";
+    readonly RugPullType: "rug_pull_type";
+    readonly ScriptConfidence: "script_confidence";
+    readonly SecretCount: "secret_count";
+    readonly SecretTypes: "secret_types";
+    readonly SecretsDetected: "secrets_detected";
+    readonly SentimentScore: "sentiment_score";
+    readonly SequenceRisk: "sequence_risk";
+    readonly SessionCommandInjection: "session_command_injection";
+    readonly SessionCumulativeRiskScore: "session_cumulative_risk_score";
+    readonly SessionInjectionDetected: "session_injection_detected";
+    readonly SessionMaxCommandInjectionScore: "session_max_command_injection_score";
+    readonly SessionMaxInjectionScore: "session_max_injection_score";
+    readonly SessionMaxJailbreakScore: "session_max_jailbreak_score";
+    readonly SessionMaxPiiScore: "session_max_pii_score";
+    readonly SessionMaxSecretScore: "session_max_secret_score";
+    readonly SessionMaxSensitivity: "session_max_sensitivity";
+    readonly SessionOriginalRequest: "session_original_request";
+    readonly SessionPiiDetected: "session_pii_detected";
+    readonly SessionPiiTypes: "session_pii_types";
+    readonly SessionSecretTypes: "session_secret_types";
+    readonly SessionSecretsDetected: "session_secrets_detected";
+    readonly SessionThreatTurns: "session_threat_turns";
+    readonly SexualScore: "sexual_score";
+    readonly Source: "source";
+    readonly SqlInjectionDetected: "sql_injection_detected";
+    readonly SqlInjectionScore: "sql_injection_score";
+    readonly SqlInjectionType: "sql_injection_type";
+    readonly SuspiciousPattern: "suspicious_pattern";
+    readonly ThreatCategories: "threat_categories";
+    readonly ThreatCount: "threat_count";
+    readonly Timestamp: "timestamp";
+    readonly ToolCategory: "tool_category";
+    readonly ToolIsBuiltin: "tool_is_builtin";
+    readonly ToolIsSensitive: "tool_is_sensitive";
+    readonly ToolName: "tool_name";
+    readonly ToolOperationClasses: "tool_operation_classes";
+    readonly ToolPoisoningDetected: "tool_poisoning_detected";
+    readonly ToolPoisoningScore: "tool_poisoning_score";
+    readonly ToolPoisoningType: "tool_poisoning_type";
+    readonly ToolRiskScore: "tool_risk_score";
+    readonly TopicConfidence: "topic_confidence";
+    readonly TpmExceeded: "tpm_exceeded";
+    readonly TpmRemainingPct: "tpm_remaining_pct";
+    readonly UserEmail: "user_email";
+    readonly ViolenceScore: "violence_score";
+    readonly WeaponsScore: "weapons_score";
+    readonly WorkspaceRoot: "workspace_root";
+};
+export type AgentOpsContextKey = (typeof AgentOpsContextKey)[keyof typeof AgentOpsContextKey];
+/**
+ * The full set of authorable context attribute keys for AgentOps.
+ * Iterate this to enumerate the authorable surface (cockpit, conformance).
+ */
+export declare const AgentOpsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "cwd", "detected_language", "detected_script", "detected_threats", "detector_count", "direction", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "event", "factuality_score", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "mcp_config_risk", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "model_name", "model_provider", "multi_turn_detection", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "privilege_scope", "profanity_score", "request_id", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "suspicious_pattern", "threat_categories", "threat_count", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "user_email", "violence_score", "weapons_score", "workspace_root"];

package/dist/agent_ops-context.gen.js

@@ -0,0 +1,288 @@
+// Code generated by highflame-policy-codegen. DO NOT EDIT.
+// Source: schemas/agent_ops/context.json
+/**
+ * Context attribute keys for AgentOps AgentOps unified agent guardrail policy enforcement — superset of Guardrails, Overwatch, and AI Gateway.
+ *
+ * These constants correspond to the context attributes defined in the
+ * AgentOps Cedar schema and are used at policy evaluation time.
+ */
+export const AgentOpsContextKey = {
+    AgentFramework: 'agent_framework',
+    AgentId: 'agent_id',
+    AgentPublisher: 'agent_publisher',
+    AgentTrustLevel: 'agent_trust_level',
+    AgentType: 'agent_type',
+    BudgetExceeded: 'budget_exceeded',
+    BudgetRemainingPct: 'budget_remaining_pct',
+    CodeLanguages: 'code_languages',
+    CodeRatio: 'code_ratio',
+    CommandInjectionDetected: 'command_injection_detected',
+    CommandInjectionScore: 'command_injection_score',
+    CommandInjectionType: 'command_injection_type',
+    ContainsCode: 'contains_code',
+    ContainsNonAscii: 'contains_non_ascii',
+    ContentSafetyBlocked: 'content_safety_blocked',
+    ContentSafetyScore: 'content_safety_score',
+    ContentTopics: 'content_topics',
+    ContentType: 'content_type',
+    ConversationTurn: 'conversation_turn',
+    CrimeScore: 'crime_score',
+    CrossOriginDetected: 'cross_origin_detected',
+    CrossOriginScore: 'cross_origin_score',
+    CrossOriginType: 'cross_origin_type',
+    Cwd: 'cwd',
+    DetectedLanguage: 'detected_language',
+    DetectedScript: 'detected_script',
+    DetectedThreats: 'detected_threats',
+    DetectorCount: 'detector_count',
+    Direction: 'direction',
+    EncodedContentDetected: 'encoded_content_detected',
+    EncodedCount: 'encoded_count',
+    EncodedScore: 'encoded_score',
+    EncodedTypes: 'encoded_types',
+    Event: 'event',
+    FactualityScore: 'factuality_score',
+    HallucinationScore: 'hallucination_score',
+    HateSpeechScore: 'hate_speech_score',
+    HighestSeverity: 'highest_severity',
+    IdentityType: 'identity_type',
+    IndirectInjectionScore: 'indirect_injection_score',
+    IndirectInjectionType: 'indirect_injection_type',
+    InjectionDeepContextScore: 'injection_deep_context_score',
+    InjectionPulseScore: 'injection_pulse_score',
+    InjectionScore: 'injection_score',
+    InjectionType: 'injection_type',
+    InvisibleCharsDetected: 'invisible_chars_detected',
+    InvisibleCharsScore: 'invisible_chars_score',
+    IsEnglish: 'is_english',
+    IsLatinScript: 'is_latin_script',
+    JailbreakDeepContextScore: 'jailbreak_deep_context_score',
+    JailbreakPulseScore: 'jailbreak_pulse_score',
+    JailbreakScore: 'jailbreak_score',
+    KeywordCategories: 'keyword_categories',
+    KeywordCount: 'keyword_count',
+    KeywordMatched: 'keyword_matched',
+    LanguageConfidence: 'language_confidence',
+    LoopCount: 'loop_count',
+    LoopDetected: 'loop_detected',
+    LoopTool: 'loop_tool',
+    McpConfigRisk: 'mcp_config_risk',
+    McpRiskScore: 'mcp_risk_score',
+    McpRiskType: 'mcp_risk_type',
+    McpServer: 'mcp_server',
+    McpServerVerified: 'mcp_server_verified',
+    McpTool: 'mcp_tool',
+    ModelName: 'model_name',
+    ModelProvider: 'model_provider',
+    MultiTurnDetection: 'multi_turn_detection',
+    ParamTypeViolation: 'param_type_violation',
+    ParamTypeViolations: 'param_type_violations',
+    Path: 'path',
+    PathTraversalDetected: 'path_traversal_detected',
+    PathTraversalSeverity: 'path_traversal_severity',
+    PathTraversalType: 'path_traversal_type',
+    PatternType: 'pattern_type',
+    PhishingDetected: 'phishing_detected',
+    PiiCount: 'pii_count',
+    PiiDetected: 'pii_detected',
+    PiiScore: 'pii_score',
+    PiiTypes: 'pii_types',
+    Principal: 'principal',
+    PrivilegeScope: 'privilege_scope',
+    ProfanityScore: 'profanity_score',
+    RequestId: 'request_id',
+    Role: 'role',
+    RpmExceeded: 'rpm_exceeded',
+    RpmRemainingPct: 'rpm_remaining_pct',
+    RugPullDetected: 'rug_pull_detected',
+    RugPullScore: 'rug_pull_score',
+    RugPullType: 'rug_pull_type',
+    ScriptConfidence: 'script_confidence',
+    SecretCount: 'secret_count',
+    SecretTypes: 'secret_types',
+    SecretsDetected: 'secrets_detected',
+    SentimentScore: 'sentiment_score',
+    SequenceRisk: 'sequence_risk',
+    SessionCommandInjection: 'session_command_injection',
+    SessionCumulativeRiskScore: 'session_cumulative_risk_score',
+    SessionInjectionDetected: 'session_injection_detected',
+    SessionMaxCommandInjectionScore: 'session_max_command_injection_score',
+    SessionMaxInjectionScore: 'session_max_injection_score',
+    SessionMaxJailbreakScore: 'session_max_jailbreak_score',
+    SessionMaxPiiScore: 'session_max_pii_score',
+    SessionMaxSecretScore: 'session_max_secret_score',
+    SessionMaxSensitivity: 'session_max_sensitivity',
+    SessionOriginalRequest: 'session_original_request',
+    SessionPiiDetected: 'session_pii_detected',
+    SessionPiiTypes: 'session_pii_types',
+    SessionSecretTypes: 'session_secret_types',
+    SessionSecretsDetected: 'session_secrets_detected',
+    SessionThreatTurns: 'session_threat_turns',
+    SexualScore: 'sexual_score',
+    Source: 'source',
+    SqlInjectionDetected: 'sql_injection_detected',
+    SqlInjectionScore: 'sql_injection_score',
+    SqlInjectionType: 'sql_injection_type',
+    SuspiciousPattern: 'suspicious_pattern',
+    ThreatCategories: 'threat_categories',
+    ThreatCount: 'threat_count',
+    Timestamp: 'timestamp',
+    ToolCategory: 'tool_category',
+    ToolIsBuiltin: 'tool_is_builtin',
+    ToolIsSensitive: 'tool_is_sensitive',
+    ToolName: 'tool_name',
+    ToolOperationClasses: 'tool_operation_classes',
+    ToolPoisoningDetected: 'tool_poisoning_detected',
+    ToolPoisoningScore: 'tool_poisoning_score',
+    ToolPoisoningType: 'tool_poisoning_type',
+    ToolRiskScore: 'tool_risk_score',
+    TopicConfidence: 'topic_confidence',
+    TpmExceeded: 'tpm_exceeded',
+    TpmRemainingPct: 'tpm_remaining_pct',
+    UserEmail: 'user_email',
+    ViolenceScore: 'violence_score',
+    WeaponsScore: 'weapons_score',
+    WorkspaceRoot: 'workspace_root',
+};
+/**
+ * The full set of authorable context attribute keys for AgentOps.
+ * Iterate this to enumerate the authorable surface (cockpit, conformance).
+ */
+export const AgentOpsContextKeys = [
+    AgentOpsContextKey.AgentFramework,
+    AgentOpsContextKey.AgentId,
+    AgentOpsContextKey.AgentPublisher,
+    AgentOpsContextKey.AgentTrustLevel,
+    AgentOpsContextKey.AgentType,
+    AgentOpsContextKey.BudgetExceeded,
+    AgentOpsContextKey.BudgetRemainingPct,
+    AgentOpsContextKey.CodeLanguages,
+    AgentOpsContextKey.CodeRatio,
+    AgentOpsContextKey.CommandInjectionDetected,
+    AgentOpsContextKey.CommandInjectionScore,
+    AgentOpsContextKey.CommandInjectionType,
+    AgentOpsContextKey.ContainsCode,
+    AgentOpsContextKey.ContainsNonAscii,
+    AgentOpsContextKey.ContentSafetyBlocked,
+    AgentOpsContextKey.ContentSafetyScore,
+    AgentOpsContextKey.ContentTopics,
+    AgentOpsContextKey.ContentType,
+    AgentOpsContextKey.ConversationTurn,
+    AgentOpsContextKey.CrimeScore,
+    AgentOpsContextKey.CrossOriginDetected,
+    AgentOpsContextKey.CrossOriginScore,
+    AgentOpsContextKey.CrossOriginType,
+    AgentOpsContextKey.Cwd,
+    AgentOpsContextKey.DetectedLanguage,
+    AgentOpsContextKey.DetectedScript,
+    AgentOpsContextKey.DetectedThreats,
+    AgentOpsContextKey.DetectorCount,
+    AgentOpsContextKey.Direction,
+    AgentOpsContextKey.EncodedContentDetected,
+    AgentOpsContextKey.EncodedCount,
+    AgentOpsContextKey.EncodedScore,
+    AgentOpsContextKey.EncodedTypes,
+    AgentOpsContextKey.Event,
+    AgentOpsContextKey.FactualityScore,
+    AgentOpsContextKey.HallucinationScore,
+    AgentOpsContextKey.HateSpeechScore,
+    AgentOpsContextKey.HighestSeverity,
+    AgentOpsContextKey.IdentityType,
+    AgentOpsContextKey.IndirectInjectionScore,
+    AgentOpsContextKey.IndirectInjectionType,
+    AgentOpsContextKey.InjectionDeepContextScore,
+    AgentOpsContextKey.InjectionPulseScore,
+    AgentOpsContextKey.InjectionScore,
+    AgentOpsContextKey.InjectionType,
+    AgentOpsContextKey.InvisibleCharsDetected,
+    AgentOpsContextKey.InvisibleCharsScore,
+    AgentOpsContextKey.IsEnglish,
+    AgentOpsContextKey.IsLatinScript,
+    AgentOpsContextKey.JailbreakDeepContextScore,
+    AgentOpsContextKey.JailbreakPulseScore,
+    AgentOpsContextKey.JailbreakScore,
+    AgentOpsContextKey.KeywordCategories,
+    AgentOpsContextKey.KeywordCount,
+    AgentOpsContextKey.KeywordMatched,
+    AgentOpsContextKey.LanguageConfidence,
+    AgentOpsContextKey.LoopCount,
+    AgentOpsContextKey.LoopDetected,
+    AgentOpsContextKey.LoopTool,
+    AgentOpsContextKey.McpConfigRisk,
+    AgentOpsContextKey.McpRiskScore,
+    AgentOpsContextKey.McpRiskType,
+    AgentOpsContextKey.McpServer,
+    AgentOpsContextKey.McpServerVerified,
+    AgentOpsContextKey.McpTool,
+    AgentOpsContextKey.ModelName,
+    AgentOpsContextKey.ModelProvider,
+    AgentOpsContextKey.MultiTurnDetection,
+    AgentOpsContextKey.ParamTypeViolation,
+    AgentOpsContextKey.ParamTypeViolations,
+    AgentOpsContextKey.Path,
+    AgentOpsContextKey.PathTraversalDetected,
+    AgentOpsContextKey.PathTraversalSeverity,
+    AgentOpsContextKey.PathTraversalType,
+    AgentOpsContextKey.PatternType,
+    AgentOpsContextKey.PhishingDetected,
+    AgentOpsContextKey.PiiCount,
+    AgentOpsContextKey.PiiDetected,
+    AgentOpsContextKey.PiiScore,
+    AgentOpsContextKey.PiiTypes,
+    AgentOpsContextKey.Principal,
+    AgentOpsContextKey.PrivilegeScope,
+    AgentOpsContextKey.ProfanityScore,
+    AgentOpsContextKey.RequestId,
+    AgentOpsContextKey.Role,
+    AgentOpsContextKey.RpmExceeded,
+    AgentOpsContextKey.RpmRemainingPct,
+    AgentOpsContextKey.RugPullDetected,
+    AgentOpsContextKey.RugPullScore,
+    AgentOpsContextKey.RugPullType,
+    AgentOpsContextKey.ScriptConfidence,
+    AgentOpsContextKey.SecretCount,
+    AgentOpsContextKey.SecretTypes,
+    AgentOpsContextKey.SecretsDetected,
+    AgentOpsContextKey.SentimentScore,
+    AgentOpsContextKey.SequenceRisk,
+    AgentOpsContextKey.SessionCommandInjection,
+    AgentOpsContextKey.SessionCumulativeRiskScore,
+    AgentOpsContextKey.SessionInjectionDetected,
+    AgentOpsContextKey.SessionMaxCommandInjectionScore,
+    AgentOpsContextKey.SessionMaxInjectionScore,
+    AgentOpsContextKey.SessionMaxJailbreakScore,
+    AgentOpsContextKey.SessionMaxPiiScore,
+    AgentOpsContextKey.SessionMaxSecretScore,
+    AgentOpsContextKey.SessionMaxSensitivity,
+    AgentOpsContextKey.SessionOriginalRequest,
+    AgentOpsContextKey.SessionPiiDetected,
+    AgentOpsContextKey.SessionPiiTypes,
+    AgentOpsContextKey.SessionSecretTypes,
+    AgentOpsContextKey.SessionSecretsDetected,
+    AgentOpsContextKey.SessionThreatTurns,
+    AgentOpsContextKey.SexualScore,
+    AgentOpsContextKey.Source,
+    AgentOpsContextKey.SqlInjectionDetected,
+    AgentOpsContextKey.SqlInjectionScore,
+    AgentOpsContextKey.SqlInjectionType,
+    AgentOpsContextKey.SuspiciousPattern,
+    AgentOpsContextKey.ThreatCategories,
+    AgentOpsContextKey.ThreatCount,
+    AgentOpsContextKey.Timestamp,
+    AgentOpsContextKey.ToolCategory,
+    AgentOpsContextKey.ToolIsBuiltin,
+    AgentOpsContextKey.ToolIsSensitive,
+    AgentOpsContextKey.ToolName,
+    AgentOpsContextKey.ToolOperationClasses,
+    AgentOpsContextKey.ToolPoisoningDetected,
+    AgentOpsContextKey.ToolPoisoningScore,
+    AgentOpsContextKey.ToolPoisoningType,
+    AgentOpsContextKey.ToolRiskScore,
+    AgentOpsContextKey.TopicConfidence,
+    AgentOpsContextKey.TpmExceeded,
+    AgentOpsContextKey.TpmRemainingPct,
+    AgentOpsContextKey.UserEmail,
+    AgentOpsContextKey.ViolenceScore,
+    AgentOpsContextKey.WeaponsScore,
+    AgentOpsContextKey.WorkspaceRoot,
+];