@highflame/policy 2.2.6 → 2.2.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/_schemas/agent_ops/context.json +1676 -0
- package/_schemas/agent_ops/schema.cedarschema +666 -0
- package/_schemas/agent_ops/templates/defaults/baseline.cedar +21 -0
- package/_schemas/agent_ops/templates/templates.json +66 -0
- package/_schemas/ai_gateway/schema.cedarschema +30 -0
- package/_schemas/guardrails/schema.cedarschema +30 -0
- package/dist/agent_ops-context.gen.d.ts +150 -0
- package/dist/agent_ops-context.gen.js +288 -0
- package/dist/agent_ops-defaults.gen.d.ts +64 -0
- package/dist/agent_ops-defaults.gen.js +156 -0
- package/dist/agent_ops-entities.gen.d.ts +11 -0
- package/dist/agent_ops-entities.gen.js +37 -0
- package/dist/guardrails-detectors.gen.js +5 -1
- package/dist/index.d.ts +5 -1
- package/dist/index.js +4 -1
- package/dist/service-schemas.gen.d.ts +12 -2
- package/dist/service-schemas.gen.js +1165 -1
- package/dist/types.d.ts +5 -1
- package/dist/types.js +4 -1
- package/package.json +1 -1
|
@@ -1,15 +1,718 @@
|
|
|
1
1
|
// Code generated by highflame-policy-codegen. DO NOT EDIT.
|
|
2
|
-
// Source: schemas/ai_gateway/schema.cedarschema, schemas/guardrails/schema.cedarschema, schemas/overwatch/schema.cedarschema, schemas/palisade/schema.cedarschema, schemas/sentry/schema.cedarschema
|
|
2
|
+
// Source: schemas/agent_ops/schema.cedarschema, schemas/ai_gateway/schema.cedarschema, schemas/guardrails/schema.cedarschema, schemas/overwatch/schema.cedarschema, schemas/palisade/schema.cedarschema, schemas/sentry/schema.cedarschema
|
|
3
3
|
//
|
|
4
4
|
// Service-specific Cedar schemas and context metadata.
|
|
5
5
|
// Works in both browser and Node.js environments.
|
|
6
6
|
//
|
|
7
7
|
// Usage:
|
|
8
|
+
// import { AGENT_OPS_SCHEMA, AGENT_OPS_CONTEXT } from '@highflame/policy/types';
|
|
8
9
|
// import { AI_GATEWAY_SCHEMA, AI_GATEWAY_CONTEXT } from '@highflame/policy/types';
|
|
9
10
|
// import { GUARDRAILS_SCHEMA, GUARDRAILS_CONTEXT } from '@highflame/policy/types';
|
|
10
11
|
// import { OVERWATCH_SCHEMA, OVERWATCH_CONTEXT } from '@highflame/policy/types';
|
|
11
12
|
// import { PALISADE_SCHEMA, PALISADE_CONTEXT } from '@highflame/policy/types';
|
|
12
13
|
// import { SENTRY_SCHEMA, SENTRY_CONTEXT } from '@highflame/policy/types';
|
|
14
|
+
/**
|
|
15
|
+
* AgentOps Cedar schema
|
|
16
|
+
*
|
|
17
|
+
* Full Cedar schema for agent_ops, embedded at codegen time.
|
|
18
|
+
*/
|
|
19
|
+
export const AGENT_OPS_SCHEMA = `// =============================================================================
|
|
20
|
+
// AgentOps Cedar Schema
|
|
21
|
+
// =============================================================================
|
|
22
|
+
// Unified schema for all agent guardrail policies. Covers every request path
|
|
23
|
+
// where an AI agent touches the Highflame platform:
|
|
24
|
+
// - LLM prompt/response (Guardrails path)
|
|
25
|
+
// - IDE tool calls and file access (Overwatch path)
|
|
26
|
+
// - MCP server connections (AI Gateway path)
|
|
27
|
+
//
|
|
28
|
+
// The context types are a superset of Guardrails, Overwatch, and AI Gateway
|
|
29
|
+
// schemas. All extra fields are optional — Shield projects only what is present
|
|
30
|
+
// in the request, Cedar ignores absent optional attributes.
|
|
31
|
+
//
|
|
32
|
+
// Service: highflame-shield (agent_ops product)
|
|
33
|
+
// Namespace: AgentOps
|
|
34
|
+
// =============================================================================
|
|
35
|
+
|
|
36
|
+
namespace AgentOps {
|
|
37
|
+
// =========================================================================
|
|
38
|
+
// Entity Types — ReBAC Hierarchy
|
|
39
|
+
// =========================================================================
|
|
40
|
+
// Entity hierarchy enables Cedar's \`in\` operator for policy scoping:
|
|
41
|
+
// Account (org root)
|
|
42
|
+
// └── Project in [Account]
|
|
43
|
+
// ├── App in [Project]
|
|
44
|
+
// │ └── Session in [App, Agent]
|
|
45
|
+
// └── Agent in [Project]
|
|
46
|
+
// └── Session in [App, Agent]
|
|
47
|
+
//
|
|
48
|
+
// Policy scoping examples:
|
|
49
|
+
// resource in AgentOps::Project::"<uuid>" → project-wide (all agents)
|
|
50
|
+
// resource in AgentOps::Agent::"<external_id>" → named agent + its sessions
|
|
51
|
+
// resource == AgentOps::Agent::"<external_id>" → named agent only (exact match)
|
|
52
|
+
// resource in AgentOps::Account::"<uuid>" → org-wide
|
|
53
|
+
// =========================================================================
|
|
54
|
+
|
|
55
|
+
/// Account represents an organization (top-level tenant)
|
|
56
|
+
entity Account;
|
|
57
|
+
|
|
58
|
+
/// Project represents a project within an account
|
|
59
|
+
entity Project in [Account];
|
|
60
|
+
|
|
61
|
+
/// User represents a principal (human or service) making requests
|
|
62
|
+
entity User;
|
|
63
|
+
|
|
64
|
+
/// Agent represents an AI agent (Claude, Cursor, Copilot, MCP client, etc.)
|
|
65
|
+
/// Used as both principal (who is acting) and resource (policy scoping target).
|
|
66
|
+
/// Agent + sessions: resource in AgentOps::Agent::"<external_id>" (hierarchy match)
|
|
67
|
+
/// Agent only: resource == AgentOps::Agent::"<external_id>" (exact match)
|
|
68
|
+
entity Agent in [Project];
|
|
69
|
+
|
|
70
|
+
/// App represents a protected application (guardrails-enabled LLM app)
|
|
71
|
+
entity App in [Project];
|
|
72
|
+
|
|
73
|
+
/// Session represents an agentic conversation session with state tracking.
|
|
74
|
+
/// Sessions can belong to either an App or an Agent.
|
|
75
|
+
entity Session in [App, Agent];
|
|
76
|
+
|
|
77
|
+
// =========================================================================
|
|
78
|
+
// Actions
|
|
79
|
+
// =========================================================================
|
|
80
|
+
|
|
81
|
+
/// Process user prompts and AI responses for security threats and content violations
|
|
82
|
+
action "process_prompt" appliesTo {
|
|
83
|
+
principal: [User, Agent],
|
|
84
|
+
resource: [App, Agent, Session],
|
|
85
|
+
context: ProcessPromptContext
|
|
86
|
+
};
|
|
87
|
+
|
|
88
|
+
/// Execute tool calls (shell, file operations, MCP tools)
|
|
89
|
+
action "call_tool" appliesTo {
|
|
90
|
+
principal: [User, Agent],
|
|
91
|
+
resource: [Agent, Session],
|
|
92
|
+
context: CallToolContext
|
|
93
|
+
};
|
|
94
|
+
|
|
95
|
+
/// Read file operations
|
|
96
|
+
action "read_file" appliesTo {
|
|
97
|
+
principal: [User, Agent],
|
|
98
|
+
resource: [Agent, Session],
|
|
99
|
+
context: FileReadContext
|
|
100
|
+
};
|
|
101
|
+
|
|
102
|
+
/// Write file operations
|
|
103
|
+
action "write_file" appliesTo {
|
|
104
|
+
principal: [User, Agent],
|
|
105
|
+
resource: [Agent, Session],
|
|
106
|
+
context: FileWriteContext
|
|
107
|
+
};
|
|
108
|
+
|
|
109
|
+
/// Connect to an MCP server
|
|
110
|
+
action "connect_server" appliesTo {
|
|
111
|
+
principal: [User, Agent],
|
|
112
|
+
resource: [Agent, Session],
|
|
113
|
+
context: ConnectServerContext
|
|
114
|
+
};
|
|
115
|
+
|
|
116
|
+
// =========================================================================
|
|
117
|
+
// Context Types (Action-Specific)
|
|
118
|
+
// =========================================================================
|
|
119
|
+
|
|
120
|
+
/// Context for process_prompt action (user prompts & AI responses)
|
|
121
|
+
type ProcessPromptContext = {
|
|
122
|
+
// Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
|
|
123
|
+
"role"?: String,
|
|
124
|
+
"privilege_scope"?: Set<String>,
|
|
125
|
+
"identity_type"?: String, // Principal identity class: "human" | "agent" | "service" | "mcp_server"
|
|
126
|
+
"principal"?: String, // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)
|
|
127
|
+
// Core metadata (required)
|
|
128
|
+
"request_id": String,
|
|
129
|
+
"timestamp": Long,
|
|
130
|
+
"direction": String, // "input" | "output"
|
|
131
|
+
"content_type": String, // "prompt" | "response" | "tool_call" | "file"
|
|
132
|
+
"detector_count": Long,
|
|
133
|
+
|
|
134
|
+
// IDE / workspace context (optional — present for Overwatch/code-agent traffic)
|
|
135
|
+
"source"?: String, // Traffic origin: "ide" | "cli" | "api" | "browser"
|
|
136
|
+
"event"?: String, // Event type: "prompt" | "tool_call" | "file_read" | ...
|
|
137
|
+
"user_email"?: String, // Human operator email (IDE sessions)
|
|
138
|
+
"cwd"?: String, // Current working directory
|
|
139
|
+
"workspace_root"?: String, // IDE workspace root path
|
|
140
|
+
|
|
141
|
+
// Model context (optional — present for AI Gateway traffic)
|
|
142
|
+
"model_name"?: String, // LLM model name: "claude-3-5-sonnet", "gpt-4o", ...
|
|
143
|
+
"model_provider"?: String, // Model provider: "anthropic" | "openai" | "google" | ...
|
|
144
|
+
|
|
145
|
+
// Security - Injection & Jailbreak (optional)
|
|
146
|
+
"injection_score"?: Long, // Combined injection confidence: MAX(pulse, deep_context)
|
|
147
|
+
"jailbreak_score"?: Long, // Combined jailbreak confidence: MAX(pulse, deep_context)
|
|
148
|
+
"injection_pulse_score"?: Long, // 0-100 Pulse single-turn classifier
|
|
149
|
+
"injection_deep_context_score"?: Long, // 0-100 DeepContext multi-turn
|
|
150
|
+
"jailbreak_pulse_score"?: Long, // 0-100 Pulse single-turn classifier
|
|
151
|
+
"jailbreak_deep_context_score"?: Long, // 0-100 DeepContext multi-turn
|
|
152
|
+
"injection_type"?: String, // "prompt" | "sql" | "command" | "none"
|
|
153
|
+
"indirect_injection_score"?: Long, // Indirect injection via tool outputs (0-100)
|
|
154
|
+
|
|
155
|
+
// Privacy - Secrets (optional)
|
|
156
|
+
"secrets_detected"?: Boolean,
|
|
157
|
+
"secret_count"?: Long,
|
|
158
|
+
"secret_types"?: Set<String>, // ["aws_access_key", "github_token", ...]
|
|
159
|
+
|
|
160
|
+
// Privacy - PII (optional)
|
|
161
|
+
"pii_detected"?: Boolean,
|
|
162
|
+
"pii_count"?: Long,
|
|
163
|
+
"pii_types"?: Set<String>, // ["email", "phone", "ssn", "credit_card", ...]
|
|
164
|
+
"pii_score"?: Long, // PII ML classifier confidence (0-100)
|
|
165
|
+
|
|
166
|
+
// Aggregated threat summary (optional — populated by aggregation detectors)
|
|
167
|
+
"highest_severity"?: String, // "critical" | "high" | "medium" | "low" | "none"
|
|
168
|
+
"threat_count"?: Long,
|
|
169
|
+
"threat_categories"?: Set<String>,
|
|
170
|
+
"detected_threats"?: Set<String>,
|
|
171
|
+
|
|
172
|
+
// Trust & Safety - Toxicity (optional)
|
|
173
|
+
"violence_score"?: Long, // 0-100
|
|
174
|
+
"hate_speech_score"?: Long, // 0-100
|
|
175
|
+
"sexual_score"?: Long, // 0-100
|
|
176
|
+
"weapons_score"?: Long, // 0-100
|
|
177
|
+
"crime_score"?: Long, // 0-100
|
|
178
|
+
"profanity_score"?: Long, // 0-100
|
|
179
|
+
|
|
180
|
+
// Semantic - Topic Classification (optional)
|
|
181
|
+
"content_topics"?: Set<String>, // ["controlled_substances", "weapons_manufacturing", ...]
|
|
182
|
+
"topic_confidence"?: Long, // 0-100
|
|
183
|
+
|
|
184
|
+
// Security - Invisible Character Detection (optional)
|
|
185
|
+
"invisible_chars_detected"?: Boolean,
|
|
186
|
+
"invisible_chars_score"?: Long, // 0-100
|
|
187
|
+
|
|
188
|
+
// Security - Pattern Detection (optional)
|
|
189
|
+
"command_injection_detected"?: Boolean,
|
|
190
|
+
"command_injection_type"?: String, // "reverse_shell" | "privilege_escalation" | ...
|
|
191
|
+
"command_injection_score"?: Long, // 0-100
|
|
192
|
+
"path_traversal_detected"?: Boolean,
|
|
193
|
+
"path_traversal_severity"?: String, // "critical" | "high" | "medium" | "low" | "none"
|
|
194
|
+
"path_traversal_type"?: String,
|
|
195
|
+
"sql_injection_detected"?: Boolean,
|
|
196
|
+
"sql_injection_type"?: String, // "tautology" | "union_based" | "destructive" | ...
|
|
197
|
+
"sql_injection_score"?: Long, // 0-100
|
|
198
|
+
|
|
199
|
+
// Security - Cross-Origin Escalation (optional)
|
|
200
|
+
"cross_origin_detected"?: Boolean,
|
|
201
|
+
"cross_origin_type"?: String, // "cross_origin_tool" | "cross_origin_server" | "none"
|
|
202
|
+
"cross_origin_score"?: Long, // 0-100
|
|
203
|
+
|
|
204
|
+
// Security - Encoded Injection (optional)
|
|
205
|
+
"encoded_content_detected"?: Boolean,
|
|
206
|
+
"encoded_types"?: Set<String>, // ["base64", "hex", "unicode", "url", ...]
|
|
207
|
+
"encoded_count"?: Long,
|
|
208
|
+
"encoded_score"?: Long, // 0-100
|
|
209
|
+
|
|
210
|
+
// Language & Script Detection (optional)
|
|
211
|
+
"detected_language"?: String, // ISO language code
|
|
212
|
+
"is_english"?: Boolean,
|
|
213
|
+
"language_confidence"?: Long, // 0-100
|
|
214
|
+
"detected_script"?: String, // "latin" | "cyrillic" | "arabic" | "unknown" | ...
|
|
215
|
+
"is_latin_script"?: Boolean,
|
|
216
|
+
"script_confidence"?: Long, // 0-100
|
|
217
|
+
|
|
218
|
+
// Content Analysis (optional)
|
|
219
|
+
"hallucination_score"?: Long,
|
|
220
|
+
"factuality_score"?: Long, // 0-100
|
|
221
|
+
"sentiment_score"?: Long,
|
|
222
|
+
"contains_code"?: Boolean,
|
|
223
|
+
"code_languages"?: Set<String>,
|
|
224
|
+
"code_ratio"?: Long, // 0-100
|
|
225
|
+
"keyword_matched"?: Boolean,
|
|
226
|
+
"keyword_categories"?: Set<String>,
|
|
227
|
+
"keyword_count"?: Long,
|
|
228
|
+
"contains_non_ascii"?: Boolean,
|
|
229
|
+
"phishing_detected"?: Boolean,
|
|
230
|
+
"content_safety_score"?: Long, // 0-100
|
|
231
|
+
"content_safety_blocked"?: Boolean,
|
|
232
|
+
|
|
233
|
+
// Agentic - Multi-Turn Context (optional)
|
|
234
|
+
"conversation_turn"?: Long,
|
|
235
|
+
"multi_turn_detection"?: Boolean,
|
|
236
|
+
|
|
237
|
+
// Session Detection History — cross-turn sticky flags (optional)
|
|
238
|
+
"session_pii_detected"?: Boolean,
|
|
239
|
+
"session_pii_types"?: Set<String>,
|
|
240
|
+
"session_secrets_detected"?: Boolean,
|
|
241
|
+
"session_secret_types"?: Set<String>,
|
|
242
|
+
"session_injection_detected"?: Boolean,
|
|
243
|
+
"session_command_injection"?: Boolean,
|
|
244
|
+
"session_threat_turns"?: Long,
|
|
245
|
+
"session_max_injection_score"?: Long,
|
|
246
|
+
"session_max_jailbreak_score"?: Long,
|
|
247
|
+
"session_max_command_injection_score"?: Long,
|
|
248
|
+
"session_max_pii_score"?: Long,
|
|
249
|
+
"session_max_secret_score"?: Long,
|
|
250
|
+
"session_cumulative_risk_score"?: Long,
|
|
251
|
+
"session_original_request"?: String,
|
|
252
|
+
"session_max_sensitivity"?: String,
|
|
253
|
+
|
|
254
|
+
// Usage Budget — multi-window token & cost enforcement (optional)
|
|
255
|
+
"budget_remaining_pct"?: Long,
|
|
256
|
+
"budget_exceeded"?: Boolean,
|
|
257
|
+
"budget_cost_micros_this_turn"?: Long,
|
|
258
|
+
"budget_model"?: String,
|
|
259
|
+
"budget_tokens_pct_session"?: Long,
|
|
260
|
+
"budget_tokens_pct_daily"?: Long,
|
|
261
|
+
"budget_tokens_pct_monthly"?: Long,
|
|
262
|
+
"budget_cost_pct_daily"?: Long,
|
|
263
|
+
"budget_cost_pct_monthly"?: Long,
|
|
264
|
+
"budget_exceeded_session"?: Boolean,
|
|
265
|
+
"budget_exceeded_daily"?: Boolean,
|
|
266
|
+
"budget_exceeded_monthly"?: Boolean,
|
|
267
|
+
|
|
268
|
+
// Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
|
|
269
|
+
"rpm_remaining_pct"?: Long,
|
|
270
|
+
"rpm_exceeded"?: Boolean,
|
|
271
|
+
"tpm_remaining_pct"?: Long,
|
|
272
|
+
"tpm_exceeded"?: Boolean,
|
|
273
|
+
|
|
274
|
+
// Agent Identity — authenticated agent principal metadata (optional)
|
|
275
|
+
"agent_id"?: String,
|
|
276
|
+
"agent_type"?: String, // "orchestrator" | "autonomous" | "tool_agent" | "human_proxy"
|
|
277
|
+
"agent_trust_level"?: String, // "first_party" | "verified_third_party" | "unverified"
|
|
278
|
+
"agent_framework"?: String,
|
|
279
|
+
"agent_publisher"?: String,
|
|
280
|
+
|
|
281
|
+
};
|
|
282
|
+
|
|
283
|
+
/// Context for call_tool action (agentic tool execution)
|
|
284
|
+
type CallToolContext = {
|
|
285
|
+
// Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
|
|
286
|
+
"role"?: String,
|
|
287
|
+
"privilege_scope"?: Set<String>,
|
|
288
|
+
"identity_type"?: String,
|
|
289
|
+
"principal"?: String,
|
|
290
|
+
// Core metadata (required)
|
|
291
|
+
"request_id": String,
|
|
292
|
+
"timestamp": Long,
|
|
293
|
+
|
|
294
|
+
// IDE / workspace context (optional)
|
|
295
|
+
"source"?: String,
|
|
296
|
+
"event"?: String,
|
|
297
|
+
"user_email"?: String,
|
|
298
|
+
"cwd"?: String,
|
|
299
|
+
"workspace_root"?: String,
|
|
300
|
+
|
|
301
|
+
// Tool Risk (optional)
|
|
302
|
+
"tool_name"?: String,
|
|
303
|
+
"tool_risk_score"?: Long, // 0-100
|
|
304
|
+
"tool_is_sensitive"?: Boolean,
|
|
305
|
+
"tool_category"?: String, // "safe" | "sensitive" | "dangerous"
|
|
306
|
+
"tool_is_builtin"?: Boolean,
|
|
307
|
+
|
|
308
|
+
// AARM R3 (CAP-ENF-007) — Action Parameter Validation
|
|
309
|
+
"action_params"?: {
|
|
310
|
+
"amount"?: Long,
|
|
311
|
+
"count"?: Long,
|
|
312
|
+
"command"?: String,
|
|
313
|
+
"path"?: String,
|
|
314
|
+
"url"?: String,
|
|
315
|
+
"recipient"?: String,
|
|
316
|
+
"target"?: String,
|
|
317
|
+
"query"?: String,
|
|
318
|
+
},
|
|
319
|
+
"param_type_violation"?: Boolean,
|
|
320
|
+
"param_type_violations"?: Set<String>,
|
|
321
|
+
|
|
322
|
+
// MCP context (optional)
|
|
323
|
+
"mcp_server"?: String,
|
|
324
|
+
"mcp_tool"?: String,
|
|
325
|
+
"mcp_server_verified"?: Boolean,
|
|
326
|
+
|
|
327
|
+
// Agentic - Behavioral Patterns (optional)
|
|
328
|
+
"suspicious_pattern"?: Boolean,
|
|
329
|
+
"pattern_type"?: String, // "data_exfiltration" | "secret_exfiltration" | ...
|
|
330
|
+
"sequence_risk"?: Long, // 0-100
|
|
331
|
+
|
|
332
|
+
// Agentic - Loop Detection (optional)
|
|
333
|
+
"loop_detected"?: Boolean,
|
|
334
|
+
"loop_count"?: Long,
|
|
335
|
+
"loop_tool"?: String,
|
|
336
|
+
|
|
337
|
+
// Security checks on tool arguments (optional)
|
|
338
|
+
"secrets_detected"?: Boolean,
|
|
339
|
+
"secret_count"?: Long,
|
|
340
|
+
"secret_types"?: Set<String>,
|
|
341
|
+
"pii_detected"?: Boolean,
|
|
342
|
+
"pii_types"?: Set<String>,
|
|
343
|
+
"pii_count"?: Long,
|
|
344
|
+
"pii_score"?: Long,
|
|
345
|
+
"injection_score"?: Long,
|
|
346
|
+
"injection_pulse_score"?: Long,
|
|
347
|
+
"injection_deep_context_score"?: Long,
|
|
348
|
+
"indirect_injection_score"?: Long,
|
|
349
|
+
"indirect_injection_type"?: String, // Type of indirect injection detected
|
|
350
|
+
|
|
351
|
+
// Semantic - Topic Classification (optional)
|
|
352
|
+
"content_topics"?: Set<String>, // ["controlled_substances", "weapons_manufacturing", ...]
|
|
353
|
+
"topic_confidence"?: Long, // 0-100
|
|
354
|
+
|
|
355
|
+
// Security - Pattern Detection (optional)
|
|
356
|
+
"command_injection_detected"?: Boolean,
|
|
357
|
+
"command_injection_type"?: String,
|
|
358
|
+
"command_injection_score"?: Long,
|
|
359
|
+
"path_traversal_detected"?: Boolean,
|
|
360
|
+
"path_traversal_severity"?: String,
|
|
361
|
+
"path_traversal_type"?: String,
|
|
362
|
+
"sql_injection_detected"?: Boolean,
|
|
363
|
+
"sql_injection_type"?: String,
|
|
364
|
+
"sql_injection_score"?: Long,
|
|
365
|
+
|
|
366
|
+
// Security - Cross-Origin Escalation (optional)
|
|
367
|
+
"cross_origin_detected"?: Boolean,
|
|
368
|
+
"cross_origin_type"?: String,
|
|
369
|
+
"cross_origin_score"?: Long,
|
|
370
|
+
|
|
371
|
+
// Security - Invisible Character Detection (optional)
|
|
372
|
+
"invisible_chars_detected"?: Boolean,
|
|
373
|
+
"invisible_chars_score"?: Long,
|
|
374
|
+
|
|
375
|
+
// Security - Encoded Injection (optional)
|
|
376
|
+
"encoded_content_detected"?: Boolean,
|
|
377
|
+
"encoded_types"?: Set<String>,
|
|
378
|
+
"encoded_count"?: Long,
|
|
379
|
+
"encoded_score"?: Long,
|
|
380
|
+
|
|
381
|
+
// Agentic - Agent Security (optional)
|
|
382
|
+
"tool_poisoning_detected"?: Boolean,
|
|
383
|
+
"tool_poisoning_score"?: Long,
|
|
384
|
+
"tool_poisoning_type"?: String,
|
|
385
|
+
"rug_pull_detected"?: Boolean,
|
|
386
|
+
"rug_pull_score"?: Long,
|
|
387
|
+
"rug_pull_type"?: String,
|
|
388
|
+
|
|
389
|
+
// Agentic - MCP Risk (optional)
|
|
390
|
+
"mcp_config_risk"?: Boolean,
|
|
391
|
+
"mcp_risk_type"?: String,
|
|
392
|
+
"mcp_risk_score"?: Long,
|
|
393
|
+
|
|
394
|
+
// Tool Operation Classifier (optional)
|
|
395
|
+
"tool_operation_classes"?: Set<String>,
|
|
396
|
+
|
|
397
|
+
// Agentic - Multi-Turn Context (optional)
|
|
398
|
+
"conversation_turn"?: Long,
|
|
399
|
+
"multi_turn_detection"?: Boolean,
|
|
400
|
+
|
|
401
|
+
// Session Detection History — cross-turn sticky flags (optional)
|
|
402
|
+
"session_pii_detected"?: Boolean,
|
|
403
|
+
"session_pii_types"?: Set<String>,
|
|
404
|
+
"session_secrets_detected"?: Boolean,
|
|
405
|
+
"session_secret_types"?: Set<String>,
|
|
406
|
+
"session_injection_detected"?: Boolean,
|
|
407
|
+
"session_command_injection"?: Boolean,
|
|
408
|
+
"session_threat_turns"?: Long,
|
|
409
|
+
"session_max_injection_score"?: Long,
|
|
410
|
+
"session_max_jailbreak_score"?: Long,
|
|
411
|
+
"session_max_command_injection_score"?: Long,
|
|
412
|
+
"session_max_pii_score"?: Long,
|
|
413
|
+
"session_max_secret_score"?: Long,
|
|
414
|
+
"session_cumulative_risk_score"?: Long,
|
|
415
|
+
"session_original_request"?: String,
|
|
416
|
+
"session_max_sensitivity"?: String,
|
|
417
|
+
|
|
418
|
+
// Usage Budget (optional)
|
|
419
|
+
"budget_remaining_pct"?: Long,
|
|
420
|
+
"budget_exceeded"?: Boolean,
|
|
421
|
+
"budget_cost_micros_this_turn"?: Long,
|
|
422
|
+
"budget_model"?: String,
|
|
423
|
+
"budget_tokens_pct_session"?: Long,
|
|
424
|
+
"budget_tokens_pct_daily"?: Long,
|
|
425
|
+
"budget_tokens_pct_monthly"?: Long,
|
|
426
|
+
"budget_cost_pct_daily"?: Long,
|
|
427
|
+
"budget_cost_pct_monthly"?: Long,
|
|
428
|
+
"budget_exceeded_session"?: Boolean,
|
|
429
|
+
"budget_exceeded_daily"?: Boolean,
|
|
430
|
+
"budget_exceeded_monthly"?: Boolean,
|
|
431
|
+
|
|
432
|
+
// Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
|
|
433
|
+
"rpm_remaining_pct"?: Long,
|
|
434
|
+
"rpm_exceeded"?: Boolean,
|
|
435
|
+
"tpm_remaining_pct"?: Long,
|
|
436
|
+
"tpm_exceeded"?: Boolean,
|
|
437
|
+
|
|
438
|
+
// Aggregated threat summary (optional)
|
|
439
|
+
"highest_severity"?: String,
|
|
440
|
+
"threat_count"?: Long,
|
|
441
|
+
"detected_threats"?: Set<String>,
|
|
442
|
+
|
|
443
|
+
// Agent Identity (optional)
|
|
444
|
+
"agent_id"?: String,
|
|
445
|
+
"agent_type"?: String,
|
|
446
|
+
"agent_trust_level"?: String,
|
|
447
|
+
"agent_framework"?: String,
|
|
448
|
+
"agent_publisher"?: String,
|
|
449
|
+
|
|
450
|
+
// File & Path (optional)
|
|
451
|
+
"path"?: String,
|
|
452
|
+
|
|
453
|
+
};
|
|
454
|
+
|
|
455
|
+
/// Context for read_file action
|
|
456
|
+
type FileReadContext = {
|
|
457
|
+
// Identity (optional)
|
|
458
|
+
"role"?: String,
|
|
459
|
+
"privilege_scope"?: Set<String>,
|
|
460
|
+
"identity_type"?: String,
|
|
461
|
+
"principal"?: String,
|
|
462
|
+
// Core metadata (required)
|
|
463
|
+
"request_id": String,
|
|
464
|
+
"timestamp": Long,
|
|
465
|
+
|
|
466
|
+
// IDE / workspace context (optional)
|
|
467
|
+
"source"?: String,
|
|
468
|
+
"event"?: String,
|
|
469
|
+
"user_email"?: String,
|
|
470
|
+
"cwd"?: String,
|
|
471
|
+
"workspace_root"?: String,
|
|
472
|
+
|
|
473
|
+
// File path (optional)
|
|
474
|
+
"path"?: String,
|
|
475
|
+
|
|
476
|
+
// Security checks on file content (optional)
|
|
477
|
+
"secrets_detected"?: Boolean,
|
|
478
|
+
"secret_count"?: Long,
|
|
479
|
+
"secret_types"?: Set<String>,
|
|
480
|
+
"pii_detected"?: Boolean,
|
|
481
|
+
"pii_types"?: Set<String>,
|
|
482
|
+
|
|
483
|
+
// Security - Path Traversal (optional)
|
|
484
|
+
"path_traversal_detected"?: Boolean,
|
|
485
|
+
"path_traversal_severity"?: String,
|
|
486
|
+
"path_traversal_type"?: String,
|
|
487
|
+
|
|
488
|
+
// Aggregated threat summary (optional)
|
|
489
|
+
"highest_severity"?: String,
|
|
490
|
+
"threat_count"?: Long,
|
|
491
|
+
"detected_threats"?: Set<String>,
|
|
492
|
+
|
|
493
|
+
// Session Detection History (optional)
|
|
494
|
+
"session_pii_detected"?: Boolean,
|
|
495
|
+
"session_pii_types"?: Set<String>,
|
|
496
|
+
"session_secrets_detected"?: Boolean,
|
|
497
|
+
"session_secret_types"?: Set<String>,
|
|
498
|
+
"session_injection_detected"?: Boolean,
|
|
499
|
+
"session_command_injection"?: Boolean,
|
|
500
|
+
"session_threat_turns"?: Long,
|
|
501
|
+
"session_max_injection_score"?: Long,
|
|
502
|
+
"session_max_jailbreak_score"?: Long,
|
|
503
|
+
"session_max_command_injection_score"?: Long,
|
|
504
|
+
"session_max_pii_score"?: Long,
|
|
505
|
+
"session_max_secret_score"?: Long,
|
|
506
|
+
"session_cumulative_risk_score"?: Long,
|
|
507
|
+
"session_original_request"?: String,
|
|
508
|
+
"session_max_sensitivity"?: String,
|
|
509
|
+
|
|
510
|
+
// Usage Budget (optional)
|
|
511
|
+
"budget_remaining_pct"?: Long,
|
|
512
|
+
"budget_exceeded"?: Boolean,
|
|
513
|
+
"budget_cost_micros_this_turn"?: Long,
|
|
514
|
+
"budget_model"?: String,
|
|
515
|
+
"budget_tokens_pct_session"?: Long,
|
|
516
|
+
"budget_tokens_pct_daily"?: Long,
|
|
517
|
+
"budget_tokens_pct_monthly"?: Long,
|
|
518
|
+
"budget_cost_pct_daily"?: Long,
|
|
519
|
+
"budget_cost_pct_monthly"?: Long,
|
|
520
|
+
"budget_exceeded_session"?: Boolean,
|
|
521
|
+
"budget_exceeded_daily"?: Boolean,
|
|
522
|
+
"budget_exceeded_monthly"?: Boolean,
|
|
523
|
+
|
|
524
|
+
// Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
|
|
525
|
+
"rpm_remaining_pct"?: Long,
|
|
526
|
+
"rpm_exceeded"?: Boolean,
|
|
527
|
+
"tpm_remaining_pct"?: Long,
|
|
528
|
+
"tpm_exceeded"?: Boolean,
|
|
529
|
+
|
|
530
|
+
// Agent Identity (optional)
|
|
531
|
+
"agent_id"?: String,
|
|
532
|
+
"agent_type"?: String,
|
|
533
|
+
"agent_trust_level"?: String,
|
|
534
|
+
"agent_framework"?: String,
|
|
535
|
+
"agent_publisher"?: String,
|
|
536
|
+
|
|
537
|
+
};
|
|
538
|
+
|
|
539
|
+
/// Context for write_file action
|
|
540
|
+
type FileWriteContext = {
|
|
541
|
+
// Identity (optional)
|
|
542
|
+
"role"?: String,
|
|
543
|
+
"privilege_scope"?: Set<String>,
|
|
544
|
+
"identity_type"?: String,
|
|
545
|
+
"principal"?: String,
|
|
546
|
+
// Core metadata (required)
|
|
547
|
+
"request_id": String,
|
|
548
|
+
"timestamp": Long,
|
|
549
|
+
|
|
550
|
+
// IDE / workspace context (optional)
|
|
551
|
+
"source"?: String,
|
|
552
|
+
"event"?: String,
|
|
553
|
+
"user_email"?: String,
|
|
554
|
+
"cwd"?: String,
|
|
555
|
+
"workspace_root"?: String,
|
|
556
|
+
|
|
557
|
+
// File path (optional)
|
|
558
|
+
"path"?: String,
|
|
559
|
+
|
|
560
|
+
// Security - Invisible Character Detection in write content (optional)
|
|
561
|
+
"invisible_chars_detected"?: Boolean,
|
|
562
|
+
"invisible_chars_score"?: Long,
|
|
563
|
+
|
|
564
|
+
// Security checks on content being written (optional)
|
|
565
|
+
"secrets_detected"?: Boolean,
|
|
566
|
+
"secret_count"?: Long,
|
|
567
|
+
"secret_types"?: Set<String>,
|
|
568
|
+
"pii_detected"?: Boolean,
|
|
569
|
+
"pii_types"?: Set<String>,
|
|
570
|
+
|
|
571
|
+
// Security - Path Traversal (optional)
|
|
572
|
+
"path_traversal_detected"?: Boolean,
|
|
573
|
+
"path_traversal_severity"?: String,
|
|
574
|
+
"path_traversal_type"?: String,
|
|
575
|
+
|
|
576
|
+
// Aggregated threat summary (optional)
|
|
577
|
+
"highest_severity"?: String,
|
|
578
|
+
"threat_count"?: Long,
|
|
579
|
+
"detected_threats"?: Set<String>,
|
|
580
|
+
|
|
581
|
+
// Session Detection History (optional)
|
|
582
|
+
"session_pii_detected"?: Boolean,
|
|
583
|
+
"session_pii_types"?: Set<String>,
|
|
584
|
+
"session_secrets_detected"?: Boolean,
|
|
585
|
+
"session_secret_types"?: Set<String>,
|
|
586
|
+
"session_injection_detected"?: Boolean,
|
|
587
|
+
"session_command_injection"?: Boolean,
|
|
588
|
+
"session_threat_turns"?: Long,
|
|
589
|
+
"session_max_injection_score"?: Long,
|
|
590
|
+
"session_max_jailbreak_score"?: Long,
|
|
591
|
+
"session_max_command_injection_score"?: Long,
|
|
592
|
+
"session_max_pii_score"?: Long,
|
|
593
|
+
"session_max_secret_score"?: Long,
|
|
594
|
+
"session_cumulative_risk_score"?: Long,
|
|
595
|
+
"session_original_request"?: String,
|
|
596
|
+
"session_max_sensitivity"?: String,
|
|
597
|
+
|
|
598
|
+
// Usage Budget (optional)
|
|
599
|
+
"budget_remaining_pct"?: Long,
|
|
600
|
+
"budget_exceeded"?: Boolean,
|
|
601
|
+
"budget_cost_micros_this_turn"?: Long,
|
|
602
|
+
"budget_model"?: String,
|
|
603
|
+
"budget_tokens_pct_session"?: Long,
|
|
604
|
+
"budget_tokens_pct_daily"?: Long,
|
|
605
|
+
"budget_tokens_pct_monthly"?: Long,
|
|
606
|
+
"budget_cost_pct_daily"?: Long,
|
|
607
|
+
"budget_cost_pct_monthly"?: Long,
|
|
608
|
+
"budget_exceeded_session"?: Boolean,
|
|
609
|
+
"budget_exceeded_daily"?: Boolean,
|
|
610
|
+
"budget_exceeded_monthly"?: Boolean,
|
|
611
|
+
|
|
612
|
+
// Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
|
|
613
|
+
"rpm_remaining_pct"?: Long,
|
|
614
|
+
"rpm_exceeded"?: Boolean,
|
|
615
|
+
"tpm_remaining_pct"?: Long,
|
|
616
|
+
"tpm_exceeded"?: Boolean,
|
|
617
|
+
|
|
618
|
+
// Agent Identity (optional)
|
|
619
|
+
"agent_id"?: String,
|
|
620
|
+
"agent_type"?: String,
|
|
621
|
+
"agent_trust_level"?: String,
|
|
622
|
+
"agent_framework"?: String,
|
|
623
|
+
"agent_publisher"?: String,
|
|
624
|
+
|
|
625
|
+
};
|
|
626
|
+
|
|
627
|
+
/// Context for connect_server action (MCP server connections)
|
|
628
|
+
type ConnectServerContext = {
|
|
629
|
+
// Identity (optional)
|
|
630
|
+
"role"?: String,
|
|
631
|
+
"privilege_scope"?: Set<String>,
|
|
632
|
+
"identity_type"?: String,
|
|
633
|
+
"principal"?: String,
|
|
634
|
+
// Core metadata (required)
|
|
635
|
+
"request_id": String,
|
|
636
|
+
"timestamp": Long,
|
|
637
|
+
|
|
638
|
+
// IDE / workspace context (optional)
|
|
639
|
+
"source"?: String,
|
|
640
|
+
"event"?: String,
|
|
641
|
+
"user_email"?: String,
|
|
642
|
+
"cwd"?: String,
|
|
643
|
+
"workspace_root"?: String,
|
|
644
|
+
|
|
645
|
+
// MCP context (optional)
|
|
646
|
+
"mcp_server"?: String,
|
|
647
|
+
"mcp_server_verified"?: Boolean,
|
|
648
|
+
|
|
649
|
+
// Agentic - Agent Security (optional)
|
|
650
|
+
"tool_poisoning_detected"?: Boolean,
|
|
651
|
+
"tool_poisoning_score"?: Long,
|
|
652
|
+
"tool_poisoning_type"?: String,
|
|
653
|
+
|
|
654
|
+
// Agentic - MCP Risk (optional)
|
|
655
|
+
"mcp_config_risk"?: Boolean,
|
|
656
|
+
"mcp_risk_type"?: String,
|
|
657
|
+
"mcp_risk_score"?: Long,
|
|
658
|
+
|
|
659
|
+
// Security - Cross-Origin Escalation (optional)
|
|
660
|
+
"cross_origin_detected"?: Boolean,
|
|
661
|
+
"cross_origin_type"?: String,
|
|
662
|
+
"cross_origin_score"?: Long,
|
|
663
|
+
|
|
664
|
+
// Aggregated threat summary (optional)
|
|
665
|
+
"highest_severity"?: String,
|
|
666
|
+
"threat_count"?: Long,
|
|
667
|
+
"detected_threats"?: Set<String>,
|
|
668
|
+
|
|
669
|
+
// Session Detection History (optional)
|
|
670
|
+
"session_pii_detected"?: Boolean,
|
|
671
|
+
"session_pii_types"?: Set<String>,
|
|
672
|
+
"session_secrets_detected"?: Boolean,
|
|
673
|
+
"session_secret_types"?: Set<String>,
|
|
674
|
+
"session_injection_detected"?: Boolean,
|
|
675
|
+
"session_command_injection"?: Boolean,
|
|
676
|
+
"session_threat_turns"?: Long,
|
|
677
|
+
"session_max_injection_score"?: Long,
|
|
678
|
+
"session_max_jailbreak_score"?: Long,
|
|
679
|
+
"session_max_command_injection_score"?: Long,
|
|
680
|
+
"session_max_pii_score"?: Long,
|
|
681
|
+
"session_max_secret_score"?: Long,
|
|
682
|
+
"session_cumulative_risk_score"?: Long,
|
|
683
|
+
"session_original_request"?: String,
|
|
684
|
+
"session_max_sensitivity"?: String,
|
|
685
|
+
|
|
686
|
+
// Usage Budget (optional)
|
|
687
|
+
"budget_remaining_pct"?: Long,
|
|
688
|
+
"budget_exceeded"?: Boolean,
|
|
689
|
+
"budget_cost_micros_this_turn"?: Long,
|
|
690
|
+
"budget_model"?: String,
|
|
691
|
+
"budget_tokens_pct_session"?: Long,
|
|
692
|
+
"budget_tokens_pct_daily"?: Long,
|
|
693
|
+
"budget_tokens_pct_monthly"?: Long,
|
|
694
|
+
"budget_cost_pct_daily"?: Long,
|
|
695
|
+
"budget_cost_pct_monthly"?: Long,
|
|
696
|
+
"budget_exceeded_session"?: Boolean,
|
|
697
|
+
"budget_exceeded_daily"?: Boolean,
|
|
698
|
+
"budget_exceeded_monthly"?: Boolean,
|
|
699
|
+
|
|
700
|
+
// Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
|
|
701
|
+
"rpm_remaining_pct"?: Long,
|
|
702
|
+
"rpm_exceeded"?: Boolean,
|
|
703
|
+
"tpm_remaining_pct"?: Long,
|
|
704
|
+
"tpm_exceeded"?: Boolean,
|
|
705
|
+
|
|
706
|
+
// Agent Identity (optional)
|
|
707
|
+
"agent_id"?: String,
|
|
708
|
+
"agent_type"?: String,
|
|
709
|
+
"agent_trust_level"?: String,
|
|
710
|
+
"agent_framework"?: String,
|
|
711
|
+
"agent_publisher"?: String,
|
|
712
|
+
|
|
713
|
+
};
|
|
714
|
+
}
|
|
715
|
+
`;
|
|
13
716
|
/**
|
|
14
717
|
* AiGateway Cedar schema
|
|
15
718
|
*
|
|
@@ -190,6 +893,12 @@ action call_tool appliesTo {
|
|
|
190
893
|
budget_exceeded_session?: Bool,
|
|
191
894
|
budget_exceeded_daily?: Bool,
|
|
192
895
|
budget_exceeded_monthly?: Bool,
|
|
896
|
+
|
|
897
|
+
// Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
|
|
898
|
+
rpm_remaining_pct?: Long,
|
|
899
|
+
rpm_exceeded?: Bool,
|
|
900
|
+
tpm_remaining_pct?: Long,
|
|
901
|
+
tpm_exceeded?: Bool,
|
|
193
902
|
},
|
|
194
903
|
};
|
|
195
904
|
|
|
@@ -262,6 +971,12 @@ action connect_server appliesTo {
|
|
|
262
971
|
budget_exceeded_session?: Bool,
|
|
263
972
|
budget_exceeded_daily?: Bool,
|
|
264
973
|
budget_exceeded_monthly?: Bool,
|
|
974
|
+
|
|
975
|
+
// Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
|
|
976
|
+
rpm_remaining_pct?: Long,
|
|
977
|
+
rpm_exceeded?: Bool,
|
|
978
|
+
tpm_remaining_pct?: Long,
|
|
979
|
+
tpm_exceeded?: Bool,
|
|
265
980
|
},
|
|
266
981
|
};
|
|
267
982
|
|
|
@@ -343,6 +1058,12 @@ action process_prompt appliesTo {
|
|
|
343
1058
|
budget_exceeded_session?: Bool,
|
|
344
1059
|
budget_exceeded_daily?: Bool,
|
|
345
1060
|
budget_exceeded_monthly?: Bool,
|
|
1061
|
+
|
|
1062
|
+
// Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
|
|
1063
|
+
rpm_remaining_pct?: Long,
|
|
1064
|
+
rpm_exceeded?: Bool,
|
|
1065
|
+
tpm_remaining_pct?: Long,
|
|
1066
|
+
tpm_exceeded?: Bool,
|
|
346
1067
|
},
|
|
347
1068
|
};
|
|
348
1069
|
|
|
@@ -404,6 +1125,12 @@ action read_file appliesTo {
|
|
|
404
1125
|
budget_exceeded_session?: Bool,
|
|
405
1126
|
budget_exceeded_daily?: Bool,
|
|
406
1127
|
budget_exceeded_monthly?: Bool,
|
|
1128
|
+
|
|
1129
|
+
// Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
|
|
1130
|
+
rpm_remaining_pct?: Long,
|
|
1131
|
+
rpm_exceeded?: Bool,
|
|
1132
|
+
tpm_remaining_pct?: Long,
|
|
1133
|
+
tpm_exceeded?: Bool,
|
|
407
1134
|
},
|
|
408
1135
|
};
|
|
409
1136
|
|
|
@@ -465,6 +1192,12 @@ action write_file appliesTo {
|
|
|
465
1192
|
budget_exceeded_session?: Bool,
|
|
466
1193
|
budget_exceeded_daily?: Bool,
|
|
467
1194
|
budget_exceeded_monthly?: Bool,
|
|
1195
|
+
|
|
1196
|
+
// Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
|
|
1197
|
+
rpm_remaining_pct?: Long,
|
|
1198
|
+
rpm_exceeded?: Bool,
|
|
1199
|
+
tpm_remaining_pct?: Long,
|
|
1200
|
+
tpm_exceeded?: Bool,
|
|
468
1201
|
},
|
|
469
1202
|
};
|
|
470
1203
|
|
|
@@ -706,6 +1439,12 @@ namespace Guardrails {
|
|
|
706
1439
|
"budget_exceeded_daily"?: Bool, // Any daily-scoped budget exceeded
|
|
707
1440
|
"budget_exceeded_monthly"?: Bool, // Any monthly-scoped budget exceeded
|
|
708
1441
|
|
|
1442
|
+
// Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
|
|
1443
|
+
"rpm_remaining_pct"?: Long,
|
|
1444
|
+
"rpm_exceeded"?: Bool,
|
|
1445
|
+
"tpm_remaining_pct"?: Long,
|
|
1446
|
+
"tpm_exceeded"?: Bool,
|
|
1447
|
+
|
|
709
1448
|
// Agent Identity — authenticated agent principal metadata (optional)
|
|
710
1449
|
// Present when the request is made by an AI agent (API key or JWT with agent claims).
|
|
711
1450
|
// Empty strings for human user requests. Use these to write agent-specific policies.
|
|
@@ -792,6 +1531,12 @@ namespace Guardrails {
|
|
|
792
1531
|
"budget_exceeded_daily"?: Bool,
|
|
793
1532
|
"budget_exceeded_monthly"?: Bool,
|
|
794
1533
|
|
|
1534
|
+
// Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
|
|
1535
|
+
"rpm_remaining_pct"?: Long,
|
|
1536
|
+
"rpm_exceeded"?: Bool,
|
|
1537
|
+
"tpm_remaining_pct"?: Long,
|
|
1538
|
+
"tpm_exceeded"?: Bool,
|
|
1539
|
+
|
|
795
1540
|
// Semantic - Topic Classification (optional)
|
|
796
1541
|
"content_topics"?: Set<String>, // ["controlled_substances", "weapons_manufacturing", ...]
|
|
797
1542
|
"topic_confidence"?: Long, // 0-100
|
|
@@ -945,6 +1690,12 @@ namespace Guardrails {
|
|
|
945
1690
|
"budget_exceeded_daily"?: Bool,
|
|
946
1691
|
"budget_exceeded_monthly"?: Bool,
|
|
947
1692
|
|
|
1693
|
+
// Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
|
|
1694
|
+
"rpm_remaining_pct"?: Long,
|
|
1695
|
+
"rpm_exceeded"?: Bool,
|
|
1696
|
+
"tpm_remaining_pct"?: Long,
|
|
1697
|
+
"tpm_exceeded"?: Bool,
|
|
1698
|
+
|
|
948
1699
|
// Agent Identity — authenticated agent principal metadata (optional)
|
|
949
1700
|
"agent_id"?: String,
|
|
950
1701
|
"agent_type"?: String,
|
|
@@ -1016,6 +1767,12 @@ namespace Guardrails {
|
|
|
1016
1767
|
"budget_exceeded_daily"?: Bool,
|
|
1017
1768
|
"budget_exceeded_monthly"?: Bool,
|
|
1018
1769
|
|
|
1770
|
+
// Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
|
|
1771
|
+
"rpm_remaining_pct"?: Long,
|
|
1772
|
+
"rpm_exceeded"?: Bool,
|
|
1773
|
+
"tpm_remaining_pct"?: Long,
|
|
1774
|
+
"tpm_exceeded"?: Bool,
|
|
1775
|
+
|
|
1019
1776
|
// Agent Identity — authenticated agent principal metadata (optional)
|
|
1020
1777
|
"agent_id"?: String,
|
|
1021
1778
|
"agent_type"?: String,
|
|
@@ -1087,6 +1844,12 @@ namespace Guardrails {
|
|
|
1087
1844
|
"budget_exceeded_daily"?: Bool,
|
|
1088
1845
|
"budget_exceeded_monthly"?: Bool,
|
|
1089
1846
|
|
|
1847
|
+
// Rate Limiting — gateway-metered, Shield-decided (ADR 0014)
|
|
1848
|
+
"rpm_remaining_pct"?: Long,
|
|
1849
|
+
"rpm_exceeded"?: Bool,
|
|
1850
|
+
"tpm_remaining_pct"?: Long,
|
|
1851
|
+
"tpm_exceeded"?: Bool,
|
|
1852
|
+
|
|
1090
1853
|
// Agent Identity — authenticated agent principal metadata (optional)
|
|
1091
1854
|
"agent_id"?: String,
|
|
1092
1855
|
"agent_type"?: String,
|
|
@@ -2110,6 +2873,407 @@ action upload_file appliesTo {
|
|
|
2110
2873
|
|
|
2111
2874
|
}
|
|
2112
2875
|
`;
|
|
2876
|
+
/**
|
|
2877
|
+
* AgentOps context metadata (parsed JSON)
|
|
2878
|
+
*/
|
|
2879
|
+
export const AGENT_OPS_CONTEXT = {
|
|
2880
|
+
"service": "agent_ops",
|
|
2881
|
+
"version": "1.0.0",
|
|
2882
|
+
"description": "AgentOps unified agent guardrail policy enforcement — superset of Guardrails, Overwatch, and AI Gateway",
|
|
2883
|
+
"actions": [
|
|
2884
|
+
{
|
|
2885
|
+
"name": "process_prompt",
|
|
2886
|
+
"description": "Analyze user prompts and AI responses for security threats, PII, and content violations",
|
|
2887
|
+
"context_attributes": [
|
|
2888
|
+
{ "key": "role", "type": "string", "required": false, "description": "Caller\'s RBAC role projected from the principal\'s token (AARM R6 / CAP-IDN-011)" },
|
|
2889
|
+
{ "key": "privilege_scope", "type": "array", "required": false, "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011)" },
|
|
2890
|
+
{ "key": "identity_type", "type": "string", "required": false, "description": "Principal identity class projected from the token: \'human\', \'agent\', \'service\', or \'mcp_server\'" },
|
|
2891
|
+
{ "key": "principal", "type": "string", "required": false, "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id)" },
|
|
2892
|
+
{ "key": "request_id", "type": "string", "required": true, "description": "Unique identifier for this request, useful for audit trails and debugging" },
|
|
2893
|
+
{ "key": "timestamp", "type": "number", "required": true, "description": "Unix timestamp in milliseconds when the request was processed" },
|
|
2894
|
+
{ "key": "direction", "type": "string", "required": true, "description": "Content flow direction: \'input\' for user prompts, \'output\' for AI responses" },
|
|
2895
|
+
{ "key": "content_type", "type": "string", "required": true, "description": "Type of content being analyzed: \'prompt\', \'response\', \'tool_call\', \'file\', or \'clipboard\'" },
|
|
2896
|
+
{ "key": "detector_count", "type": "number", "required": true, "description": "Number of detectors that were executed for this request" },
|
|
2897
|
+
{ "key": "source", "type": "string", "required": false, "description": "Traffic origin: \'ide\' | \'cli\' | \'api\' | \'browser\'. Present for Overwatch/code-agent traffic." },
|
|
2898
|
+
{ "key": "event", "type": "string", "required": false, "description": "Event type: \'prompt\' | \'tool_call\' | \'file_read\' | \'file_write\' | \'connect_server\'. Present for Overwatch traffic." },
|
|
2899
|
+
{ "key": "user_email", "type": "string", "required": false, "description": "Human operator email (IDE sessions)" },
|
|
2900
|
+
{ "key": "cwd", "type": "string", "required": false, "description": "Current working directory (IDE sessions)" },
|
|
2901
|
+
{ "key": "workspace_root", "type": "string", "required": false, "description": "IDE workspace root path" },
|
|
2902
|
+
{ "key": "model_name", "type": "string", "required": false, "description": "LLM model name: \'claude-3-5-sonnet\', \'gpt-4o\', etc. Present for AI Gateway traffic." },
|
|
2903
|
+
{ "key": "model_provider", "type": "string", "required": false, "description": "Model provider: \'anthropic\' | \'openai\' | \'google\' | \'meta\'. Present for AI Gateway traffic." },
|
|
2904
|
+
{ "key": "injection_score", "type": "number", "required": false, "description": "Combined prompt injection confidence (0-100). MAX of all detector scores." },
|
|
2905
|
+
{ "key": "jailbreak_score", "type": "number", "required": false, "description": "Combined jailbreak detection confidence (0-100). MAX of all detector scores." },
|
|
2906
|
+
{ "key": "injection_pulse_score", "type": "number", "required": false, "description": "Highflame single-turn classifier score for prompt injection (0-100)." },
|
|
2907
|
+
{ "key": "injection_deep_context_score", "type": "number", "required": false, "description": "DeepContext multi-turn analyzer score for prompt injection (0-100)." },
|
|
2908
|
+
{ "key": "jailbreak_pulse_score", "type": "number", "required": false, "description": "Highflame single-turn classifier score for jailbreak attempts (0-100)." },
|
|
2909
|
+
{ "key": "jailbreak_deep_context_score", "type": "number", "required": false, "description": "DeepContext multi-turn analyzer score for jailbreak attempts (0-100)." },
|
|
2910
|
+
{ "key": "injection_type", "type": "string", "required": false, "description": "Type of injection detected: \'prompt\', \'sql\', \'command\', or \'none\'" },
|
|
2911
|
+
{ "key": "indirect_injection_score", "type": "number", "required": false, "description": "Indirect prompt injection risk score (0-100) — injection via tool outputs, retrieved documents, or external content." },
|
|
2912
|
+
{ "key": "indirect_injection_type", "type": "string", "required": false, "description": "Type of indirect injection detected in content (e.g., instruction override, authority hijack)" },
|
|
2913
|
+
{ "key": "secrets_detected", "type": "boolean", "required": false, "description": "Whether any API keys, tokens, passwords, or credentials were detected" },
|
|
2914
|
+
{ "key": "secret_count", "type": "number", "required": false, "description": "Total number of secret matches found" },
|
|
2915
|
+
{ "key": "secret_types", "type": "array", "required": false, "description": "Array of secret types found (e.g., [\'aws_access_key\', \'github_token\'])" },
|
|
2916
|
+
{ "key": "pii_detected", "type": "boolean", "required": false, "description": "Whether personally identifiable information (PII) was found" },
|
|
2917
|
+
{ "key": "pii_count", "type": "number", "required": false, "description": "Total number of PII matches found" },
|
|
2918
|
+
{ "key": "pii_types", "type": "array", "required": false, "description": "Array of PII types detected (e.g., [\'email\', \'phone\', \'ssn\', \'credit_card\'])" },
|
|
2919
|
+
{ "key": "pii_score", "type": "number", "required": false, "description": "PII detection ML classifier confidence (0-100)." },
|
|
2920
|
+
{ "key": "highest_severity", "type": "string", "required": false, "description": "Highest severity level: \'critical\', \'high\', \'medium\', \'low\', or \'none\'" },
|
|
2921
|
+
{ "key": "threat_count", "type": "number", "required": false, "description": "Total number of threats detected across all detectors" },
|
|
2922
|
+
{ "key": "threat_categories", "type": "array", "required": false, "description": "Array of threat category names detected (e.g., [\'injection\', \'pii\', \'secrets\'])" },
|
|
2923
|
+
{ "key": "detected_threats", "type": "array", "required": false, "description": "Array of specific threat names detected" },
|
|
2924
|
+
{ "key": "violence_score", "type": "number", "required": false, "description": "ML-based score for violent content references (0-100)." },
|
|
2925
|
+
{ "key": "hate_speech_score", "type": "number", "required": false, "description": "ML-based score for hate speech or discriminatory language (0-100)." },
|
|
2926
|
+
{ "key": "sexual_score", "type": "number", "required": false, "description": "ML-based score for sexual or adult content (0-100)." },
|
|
2927
|
+
{ "key": "weapons_score", "type": "number", "required": false, "description": "ML-based score for weapons references (0-100)." },
|
|
2928
|
+
{ "key": "crime_score", "type": "number", "required": false, "description": "ML-based score for criminal activity discussions (0-100)." },
|
|
2929
|
+
{ "key": "profanity_score", "type": "number", "required": false, "description": "ML-based score for profanity and vulgar language (0-100)." },
|
|
2930
|
+
{ "key": "content_topics", "type": "array", "required": false, "description": "Semantic topics detected in content (e.g., [\'controlled_substances\', \'weapons_manufacturing\'])" },
|
|
2931
|
+
{ "key": "topic_confidence", "type": "number", "required": false, "description": "Confidence score from topic classifier (0-100)." },
|
|
2932
|
+
{ "key": "invisible_chars_detected", "type": "boolean", "required": false, "description": "Whether invisible Unicode characters were detected in the content" },
|
|
2933
|
+
{ "key": "invisible_chars_score", "type": "number", "required": false, "description": "Density score for invisible characters (0-100)." },
|
|
2934
|
+
{ "key": "command_injection_detected", "type": "boolean", "required": false, "description": "Whether command injection patterns were detected" },
|
|
2935
|
+
{ "key": "command_injection_type", "type": "string", "required": false, "description": "Type of command injection: \'reverse_shell\', \'privilege_escalation\', \'code_execution\', \'destructive_command\', or \'data_exfiltration\'" },
|
|
2936
|
+
{ "key": "command_injection_score", "type": "number", "required": false, "description": "Confidence score for command injection detection (0-100)." },
|
|
2937
|
+
{ "key": "path_traversal_detected", "type": "boolean", "required": false, "description": "Whether path traversal patterns were detected" },
|
|
2938
|
+
{ "key": "path_traversal_severity", "type": "string", "required": false, "description": "Severity of path traversal: \'critical\', \'high\', \'medium\', \'low\', or \'none\'" },
|
|
2939
|
+
{ "key": "path_traversal_type", "type": "string", "required": false, "description": "Type of path traversal detected" },
|
|
2940
|
+
{ "key": "sql_injection_detected", "type": "boolean", "required": false, "description": "Whether SQL injection patterns were detected" },
|
|
2941
|
+
{ "key": "sql_injection_type", "type": "string", "required": false, "description": "Type of SQL injection: \'tautology\', \'union_based\', \'destructive\', \'blind\', or \'error_based\'" },
|
|
2942
|
+
{ "key": "sql_injection_score", "type": "number", "required": false, "description": "Confidence score for SQL injection detection (0-100)." },
|
|
2943
|
+
{ "key": "cross_origin_detected", "type": "boolean", "required": false, "description": "Whether cross-origin escalation patterns were detected" },
|
|
2944
|
+
{ "key": "cross_origin_type", "type": "string", "required": false, "description": "Type of cross-origin escalation: \'cross_origin_tool\', \'cross_origin_server\', or \'none\'" },
|
|
2945
|
+
{ "key": "cross_origin_score", "type": "number", "required": false, "description": "Risk score for cross-origin escalation (0-100)." },
|
|
2946
|
+
{ "key": "encoded_content_detected", "type": "boolean", "required": false, "description": "Whether encoded content was detected (base64, hex, unicode, URL encoding)" },
|
|
2947
|
+
{ "key": "encoded_types", "type": "array", "required": false, "description": "Array of encoding types detected (e.g., [\'base64\', \'hex\', \'unicode\', \'url\'])" },
|
|
2948
|
+
{ "key": "encoded_count", "type": "number", "required": false, "description": "Number of encoded segments found" },
|
|
2949
|
+
{ "key": "encoded_score", "type": "number", "required": false, "description": "Risk score for encoded injection attempts (0-100)." },
|
|
2950
|
+
{ "key": "detected_language", "type": "string", "required": false, "description": "ISO language code of the detected language (e.g., \'en\', \'fr\', \'zh\')" },
|
|
2951
|
+
{ "key": "is_english", "type": "boolean", "required": false, "description": "Whether the content is in English" },
|
|
2952
|
+
{ "key": "language_confidence", "type": "number", "required": false, "description": "Confidence score for language detection (0-100)." },
|
|
2953
|
+
{ "key": "detected_script", "type": "string", "required": false, "description": "Writing script detected: \'latin\', \'cyrillic\', \'arabic\', \'cjk\', \'unknown\', etc." },
|
|
2954
|
+
{ "key": "is_latin_script", "type": "boolean", "required": false, "description": "Whether the content uses Latin script" },
|
|
2955
|
+
{ "key": "script_confidence", "type": "number", "required": false, "description": "Confidence score for script detection (0-100)." },
|
|
2956
|
+
{ "key": "hallucination_score", "type": "number", "required": false, "description": "ML-based score for hallucinated or fabricated content (0-100)." },
|
|
2957
|
+
{ "key": "factuality_score", "type": "number", "required": false, "description": "ML-based factuality assessment score (0-100)." },
|
|
2958
|
+
{ "key": "sentiment_score", "type": "number", "required": false, "description": "Sentiment analysis score." },
|
|
2959
|
+
{ "key": "contains_code", "type": "boolean", "required": false, "description": "Whether code snippets were detected in the content" },
|
|
2960
|
+
{ "key": "code_languages", "type": "array", "required": false, "description": "Array of programming languages detected in code snippets" },
|
|
2961
|
+
{ "key": "code_ratio", "type": "number", "required": false, "description": "Percentage of content that consists of code (0-100)." },
|
|
2962
|
+
{ "key": "keyword_matched", "type": "boolean", "required": false, "description": "Whether any configured keywords or phrases were matched" },
|
|
2963
|
+
{ "key": "keyword_categories", "type": "array", "required": false, "description": "Array of keyword categories matched (e.g., [\'competitor_names\', \'restricted_topics\'])" },
|
|
2964
|
+
{ "key": "keyword_count", "type": "number", "required": false, "description": "Number of keyword matches found" },
|
|
2965
|
+
{ "key": "contains_non_ascii", "type": "boolean", "required": false, "description": "Whether non-ASCII characters were detected" },
|
|
2966
|
+
{ "key": "phishing_detected", "type": "boolean", "required": false, "description": "Whether phishing patterns were detected" },
|
|
2967
|
+
{ "key": "content_safety_score", "type": "number", "required": false, "description": "Aggregate content safety score (0-100)." },
|
|
2968
|
+
{ "key": "content_safety_blocked", "type": "boolean", "required": false, "description": "Whether content was flagged for blocking by the content safety system" },
|
|
2969
|
+
{ "key": "conversation_turn", "type": "number", "required": false, "description": "Current conversation turn number" },
|
|
2970
|
+
{ "key": "multi_turn_detection", "type": "boolean", "required": false, "description": "Whether multi-turn injection patterns were detected" },
|
|
2971
|
+
{ "key": "budget_remaining_pct", "type": "number", "required": false, "description": "Remaining token budget as percentage (0-100)." },
|
|
2972
|
+
{ "key": "budget_exceeded", "type": "boolean", "required": false, "description": "Whether the token budget has been exceeded" },
|
|
2973
|
+
{ "key": "rpm_remaining_pct", "type": "number", "required": false, "description": "Remaining RPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)." },
|
|
2974
|
+
{ "key": "rpm_exceeded", "type": "boolean", "required": false, "description": "Whether the RPM limit has been exceeded" },
|
|
2975
|
+
{ "key": "tpm_remaining_pct", "type": "number", "required": false, "description": "Remaining TPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)." },
|
|
2976
|
+
{ "key": "tpm_exceeded", "type": "boolean", "required": false, "description": "Whether the TPM limit has been exceeded" },
|
|
2977
|
+
{ "key": "session_pii_detected", "type": "boolean", "required": false, "description": "Whether PII was detected in any previous turn of the session" },
|
|
2978
|
+
{ "key": "session_pii_types", "type": "array", "required": false, "description": "PII types detected across the session (accumulated)" },
|
|
2979
|
+
{ "key": "session_secrets_detected", "type": "boolean", "required": false, "description": "Whether secrets were detected in any previous turn of the session" },
|
|
2980
|
+
{ "key": "session_secret_types", "type": "array", "required": false, "description": "Secret types detected across the session (accumulated)" },
|
|
2981
|
+
{ "key": "session_injection_detected", "type": "boolean", "required": false, "description": "Whether prompt injection was detected in any previous turn of the session" },
|
|
2982
|
+
{ "key": "session_command_injection", "type": "boolean", "required": false, "description": "Whether command injection was detected in any previous turn of the session" },
|
|
2983
|
+
{ "key": "session_threat_turns", "type": "number", "required": false, "description": "Number of turns in the session where threats were detected" },
|
|
2984
|
+
{ "key": "session_max_injection_score", "type": "number", "required": false, "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions" },
|
|
2985
|
+
{ "key": "session_max_jailbreak_score", "type": "number", "required": false, "description": "Highest jailbreak detection score seen in any turn of the session (0-100)" },
|
|
2986
|
+
{ "key": "session_max_command_injection_score", "type": "number", "required": false, "description": "Highest command injection score seen in any turn of the session (0-100)" },
|
|
2987
|
+
{ "key": "session_max_pii_score", "type": "number", "required": false, "description": "Highest PII risk score seen in any turn of the session (0-100)" },
|
|
2988
|
+
{ "key": "session_max_secret_score", "type": "number", "required": false, "description": "Highest secret detection score seen in any turn of the session (0-100)" },
|
|
2989
|
+
{ "key": "session_cumulative_risk_score", "type": "number", "required": false, "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant" },
|
|
2990
|
+
{ "key": "session_max_sensitivity", "type": "string", "required": false, "description": "Highest data-sensitivity tier observed across the session (e.g. \'public\', \'internal\', \'confidential\', \'restricted\')" },
|
|
2991
|
+
{ "key": "session_original_request", "type": "string", "required": false, "description": "The session\'s first user request, retained for drift / goal-hijack policies that compare later turns against the original intent" },
|
|
2992
|
+
{ "key": "agent_id", "type": "string", "required": false, "description": "Unique identifier of the authenticated AI agent making this request. Empty string for human user requests." },
|
|
2993
|
+
{ "key": "agent_type", "type": "string", "required": false, "description": "Type of the authenticated agent: \'orchestrator\', \'autonomous\', \'tool_agent\', or \'human_proxy\'. Empty string for human users." },
|
|
2994
|
+
{ "key": "agent_trust_level", "type": "string", "required": false, "description": "Trust level of the authenticated agent: \'first_party\', \'verified_third_party\', or \'unverified\'." },
|
|
2995
|
+
{ "key": "agent_framework", "type": "string", "required": false, "description": "Framework or SDK the agent is built with (e.g., \'claude-code\', \'langchain\', \'crewai\', \'autogen\')." },
|
|
2996
|
+
{ "key": "agent_publisher", "type": "string", "required": false, "description": "Organization that published the agent (e.g., \'anthropic\', \'internal\', \'acme-corp\')." }
|
|
2997
|
+
]
|
|
2998
|
+
},
|
|
2999
|
+
{
|
|
3000
|
+
"name": "call_tool",
|
|
3001
|
+
"description": "Execute agentic tool calls, including shell commands, file operations, and MCP tools",
|
|
3002
|
+
"context_attributes": [
|
|
3003
|
+
{ "key": "role", "type": "string", "required": false, "description": "Caller\'s RBAC role projected from the principal\'s token" },
|
|
3004
|
+
{ "key": "privilege_scope", "type": "array", "required": false, "description": "Privilege-scope strings granted to the caller" },
|
|
3005
|
+
{ "key": "identity_type", "type": "string", "required": false, "description": "Principal identity class: \'human\', \'agent\', \'service\', or \'mcp_server\'" },
|
|
3006
|
+
{ "key": "principal", "type": "string", "required": false, "description": "Stable principal identifier" },
|
|
3007
|
+
{ "key": "request_id", "type": "string", "required": true, "description": "Unique identifier for this request" },
|
|
3008
|
+
{ "key": "timestamp", "type": "number", "required": true, "description": "Unix timestamp in milliseconds" },
|
|
3009
|
+
{ "key": "source", "type": "string", "required": false, "description": "Traffic origin: \'ide\' | \'cli\' | \'api\' | \'browser\'" },
|
|
3010
|
+
{ "key": "event", "type": "string", "required": false, "description": "Event type: \'tool_call\'" },
|
|
3011
|
+
{ "key": "user_email", "type": "string", "required": false, "description": "Human operator email (IDE sessions)" },
|
|
3012
|
+
{ "key": "cwd", "type": "string", "required": false, "description": "Current working directory" },
|
|
3013
|
+
{ "key": "workspace_root", "type": "string", "required": false, "description": "IDE workspace root path" },
|
|
3014
|
+
{ "key": "tool_name", "type": "string", "required": false, "description": "Name of the tool being called (e.g., \'shell\', \'write_file\', \'http_post\')" },
|
|
3015
|
+
{ "key": "tool_risk_score", "type": "number", "required": false, "description": "Computed risk score for this tool call (0-100)." },
|
|
3016
|
+
{ "key": "tool_is_sensitive", "type": "boolean", "required": false, "description": "Whether the tool is classified as sensitive" },
|
|
3017
|
+
{ "key": "tool_category", "type": "string", "required": false, "description": "Tool classification: \'safe\', \'sensitive\', or \'dangerous\'" },
|
|
3018
|
+
{ "key": "tool_is_builtin", "type": "boolean", "required": false, "description": "Whether the tool is a built-in tool (vs MCP external tool)" },
|
|
3019
|
+
{ "key": "param_type_violation", "type": "boolean", "required": false, "description": "True when any projected tool-call argument failed type coercion (AARM R3)" },
|
|
3020
|
+
{ "key": "param_type_violations", "type": "array", "required": false, "description": "Names of the tool-call arguments that failed type coercion" },
|
|
3021
|
+
{ "key": "mcp_server", "type": "string", "required": false, "description": "Name of the MCP server providing this tool" },
|
|
3022
|
+
{ "key": "mcp_tool", "type": "string", "required": false, "description": "Name of the specific tool within the MCP server" },
|
|
3023
|
+
{ "key": "mcp_server_verified", "type": "boolean", "required": false, "description": "Whether the MCP server is from a verified/trusted registry" },
|
|
3024
|
+
{ "key": "suspicious_pattern", "type": "boolean", "required": false, "description": "Whether a suspicious action sequence was detected" },
|
|
3025
|
+
{ "key": "pattern_type", "type": "string", "required": false, "description": "Type of suspicious pattern: \'data_exfiltration\', \'secret_exfiltration\', \'db_exfiltration\', or \'none\'" },
|
|
3026
|
+
{ "key": "sequence_risk", "type": "number", "required": false, "description": "Risk score from action sequence analysis (0-100)." },
|
|
3027
|
+
{ "key": "loop_detected", "type": "boolean", "required": false, "description": "Whether a tool call loop was detected" },
|
|
3028
|
+
{ "key": "loop_count", "type": "number", "required": false, "description": "Number of consecutive repeated tool calls" },
|
|
3029
|
+
{ "key": "loop_tool", "type": "string", "required": false, "description": "Name of the tool involved in the loop" },
|
|
3030
|
+
{ "key": "secrets_detected", "type": "boolean", "required": false, "description": "Whether secrets were detected in tool arguments or content" },
|
|
3031
|
+
{ "key": "secret_count", "type": "number", "required": false, "description": "Total number of secret matches found in tool arguments" },
|
|
3032
|
+
{ "key": "secret_types", "type": "array", "required": false, "description": "Array of secret types found in tool arguments" },
|
|
3033
|
+
{ "key": "pii_detected", "type": "boolean", "required": false, "description": "Whether PII was detected in tool arguments" },
|
|
3034
|
+
{ "key": "pii_types", "type": "array", "required": false, "description": "Array of PII types found in tool arguments" },
|
|
3035
|
+
{ "key": "pii_count", "type": "number", "required": false, "description": "Number of PII pattern matches in tool arguments" },
|
|
3036
|
+
{ "key": "pii_score", "type": "number", "required": false, "description": "PII detection ML classifier confidence for tool content (0-100)." },
|
|
3037
|
+
{ "key": "injection_score", "type": "number", "required": false, "description": "Combined prompt injection confidence in tool arguments (0-100)." },
|
|
3038
|
+
{ "key": "injection_pulse_score", "type": "number", "required": false, "description": "Highflame single-turn classifier score for prompt injection in tool arguments (0-100)." },
|
|
3039
|
+
{ "key": "injection_deep_context_score", "type": "number", "required": false, "description": "DeepContext multi-turn analyzer score for prompt injection in tool arguments (0-100)." },
|
|
3040
|
+
{ "key": "indirect_injection_score", "type": "number", "required": false, "description": "Indirect prompt injection risk score (0-100) — injection via tool outputs or retrieved documents." },
|
|
3041
|
+
{ "key": "indirect_injection_type", "type": "string", "required": false, "description": "Type of indirect injection detected in tool content" },
|
|
3042
|
+
{ "key": "content_topics", "type": "array", "required": false, "description": "Semantic topics detected in tool arguments" },
|
|
3043
|
+
{ "key": "topic_confidence", "type": "number", "required": false, "description": "Confidence score from topic classifier for tool content (0-100)." },
|
|
3044
|
+
{ "key": "command_injection_detected", "type": "boolean", "required": false, "description": "Whether command injection patterns were detected in tool arguments" },
|
|
3045
|
+
{ "key": "command_injection_type", "type": "string", "required": false, "description": "Type of command injection detected in tool arguments" },
|
|
3046
|
+
{ "key": "command_injection_score", "type": "number", "required": false, "description": "Confidence score for command injection in tool arguments (0-100)." },
|
|
3047
|
+
{ "key": "path_traversal_detected", "type": "boolean", "required": false, "description": "Whether path traversal patterns were detected in tool arguments" },
|
|
3048
|
+
{ "key": "path_traversal_severity", "type": "string", "required": false, "description": "Severity of path traversal in tool arguments" },
|
|
3049
|
+
{ "key": "path_traversal_type", "type": "string", "required": false, "description": "Type of path traversal detected in tool arguments" },
|
|
3050
|
+
{ "key": "sql_injection_detected", "type": "boolean", "required": false, "description": "Whether SQL injection patterns were detected in tool arguments" },
|
|
3051
|
+
{ "key": "sql_injection_type", "type": "string", "required": false, "description": "Type of SQL injection detected in tool arguments" },
|
|
3052
|
+
{ "key": "sql_injection_score", "type": "number", "required": false, "description": "Confidence score for SQL injection in tool arguments (0-100)." },
|
|
3053
|
+
{ "key": "tool_poisoning_detected", "type": "boolean", "required": false, "description": "Whether tool poisoning was detected" },
|
|
3054
|
+
{ "key": "tool_poisoning_score", "type": "number", "required": false, "description": "Confidence score for tool poisoning detection (0-100)." },
|
|
3055
|
+
{ "key": "tool_poisoning_type", "type": "string", "required": false, "description": "Type of tool poisoning: \'hidden_instructions\', \'system_prompt_injection\', or \'authority_hijack\'" },
|
|
3056
|
+
{ "key": "rug_pull_detected", "type": "boolean", "required": false, "description": "Whether a rug pull was detected" },
|
|
3057
|
+
{ "key": "rug_pull_score", "type": "number", "required": false, "description": "Confidence score for rug pull detection (0-100)." },
|
|
3058
|
+
{ "key": "rug_pull_type", "type": "string", "required": false, "description": "Type of rug pull detected: \'risk_spike\', \'pattern_change\', \'combined\', or \'none\'" },
|
|
3059
|
+
{ "key": "mcp_config_risk", "type": "boolean", "required": false, "description": "Whether MCP configuration risk was detected" },
|
|
3060
|
+
{ "key": "mcp_risk_type", "type": "string", "required": false, "description": "Type of MCP risk: \'inline_execution\', \'suspicious_url\', or \'cross_origin\'" },
|
|
3061
|
+
{ "key": "mcp_risk_score", "type": "number", "required": false, "description": "Risk score for MCP configuration issues (0-100)." },
|
|
3062
|
+
{ "key": "cross_origin_detected", "type": "boolean", "required": false, "description": "Whether cross-origin escalation patterns were detected in tool calls" },
|
|
3063
|
+
{ "key": "cross_origin_type", "type": "string", "required": false, "description": "Type of cross-origin escalation detected in tool call" },
|
|
3064
|
+
{ "key": "cross_origin_score", "type": "number", "required": false, "description": "Risk score for cross-origin escalation in tool calls (0-100)." },
|
|
3065
|
+
{ "key": "invisible_chars_detected", "type": "boolean", "required": false, "description": "Whether invisible Unicode characters were detected in tool arguments" },
|
|
3066
|
+
{ "key": "invisible_chars_score", "type": "number", "required": false, "description": "Invisible character attack severity score in tool arguments (0-100)." },
|
|
3067
|
+
{ "key": "encoded_content_detected", "type": "boolean", "required": false, "description": "Whether encoded content was detected in tool arguments" },
|
|
3068
|
+
{ "key": "encoded_types", "type": "array", "required": false, "description": "Array of encoding types detected in tool arguments" },
|
|
3069
|
+
{ "key": "encoded_count", "type": "number", "required": false, "description": "Number of encoded segments found in tool arguments" },
|
|
3070
|
+
{ "key": "encoded_score", "type": "number", "required": false, "description": "Risk score for encoded injection in tool arguments (0-100)." },
|
|
3071
|
+
{ "key": "tool_operation_classes", "type": "array", "required": false, "description": "All operation classes observed in the tool call: \'readonly\', \'write_enabling\', \'execute_enabling\', \'network_access\', \'unknown\'" },
|
|
3072
|
+
{ "key": "path", "type": "string", "required": false, "description": "File path targeted by the tool call" },
|
|
3073
|
+
{ "key": "conversation_turn", "type": "number", "required": false, "description": "Current conversation turn number" },
|
|
3074
|
+
{ "key": "multi_turn_detection", "type": "boolean", "required": false, "description": "Whether multi-turn injection patterns were detected across tool calls" },
|
|
3075
|
+
{ "key": "budget_remaining_pct", "type": "number", "required": false, "description": "Remaining token budget as percentage (0-100)." },
|
|
3076
|
+
{ "key": "budget_exceeded", "type": "boolean", "required": false, "description": "Whether the token budget has been exceeded" },
|
|
3077
|
+
{ "key": "rpm_remaining_pct", "type": "number", "required": false, "description": "Remaining RPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)." },
|
|
3078
|
+
{ "key": "rpm_exceeded", "type": "boolean", "required": false, "description": "Whether the RPM limit has been exceeded" },
|
|
3079
|
+
{ "key": "tpm_remaining_pct", "type": "number", "required": false, "description": "Remaining TPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)." },
|
|
3080
|
+
{ "key": "tpm_exceeded", "type": "boolean", "required": false, "description": "Whether the TPM limit has been exceeded" },
|
|
3081
|
+
{ "key": "highest_severity", "type": "string", "required": false, "description": "Highest severity level across all detection engines" },
|
|
3082
|
+
{ "key": "threat_count", "type": "number", "required": false, "description": "Total number of threats detected" },
|
|
3083
|
+
{ "key": "detected_threats", "type": "array", "required": false, "description": "Array of specific threat names detected" },
|
|
3084
|
+
{ "key": "session_pii_detected", "type": "boolean", "required": false, "description": "Whether PII was detected in any previous turn of the session" },
|
|
3085
|
+
{ "key": "session_pii_types", "type": "array", "required": false, "description": "PII types detected across the session (accumulated)" },
|
|
3086
|
+
{ "key": "session_secrets_detected", "type": "boolean", "required": false, "description": "Whether secrets were detected in any previous turn of the session" },
|
|
3087
|
+
{ "key": "session_secret_types", "type": "array", "required": false, "description": "Secret types detected across the session (accumulated)" },
|
|
3088
|
+
{ "key": "session_injection_detected", "type": "boolean", "required": false, "description": "Whether prompt injection was detected in any previous turn of the session" },
|
|
3089
|
+
{ "key": "session_command_injection", "type": "boolean", "required": false, "description": "Whether command injection was detected in any previous turn of the session" },
|
|
3090
|
+
{ "key": "session_threat_turns", "type": "number", "required": false, "description": "Number of turns in the session where threats were detected" },
|
|
3091
|
+
{ "key": "session_max_injection_score", "type": "number", "required": false, "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions" },
|
|
3092
|
+
{ "key": "session_max_jailbreak_score", "type": "number", "required": false, "description": "Highest jailbreak detection score seen in any turn of the session (0-100)" },
|
|
3093
|
+
{ "key": "session_max_command_injection_score", "type": "number", "required": false, "description": "Highest command injection score seen in any turn of the session (0-100)" },
|
|
3094
|
+
{ "key": "session_max_pii_score", "type": "number", "required": false, "description": "Highest PII risk score seen in any turn of the session (0-100)" },
|
|
3095
|
+
{ "key": "session_max_secret_score", "type": "number", "required": false, "description": "Highest secret detection score seen in any turn of the session (0-100)" },
|
|
3096
|
+
{ "key": "session_cumulative_risk_score", "type": "number", "required": false, "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant" },
|
|
3097
|
+
{ "key": "session_max_sensitivity", "type": "string", "required": false, "description": "Highest data-sensitivity tier observed across the session (e.g. \'public\', \'internal\', \'confidential\', \'restricted\')" },
|
|
3098
|
+
{ "key": "session_original_request", "type": "string", "required": false, "description": "The session\'s first user request, retained for drift / goal-hijack policies that compare later turns against the original intent" },
|
|
3099
|
+
{ "key": "agent_id", "type": "string", "required": false, "description": "Unique identifier of the authenticated AI agent making this request. Empty string for human user requests." },
|
|
3100
|
+
{ "key": "agent_type", "type": "string", "required": false, "description": "Type of the authenticated agent: \'orchestrator\', \'autonomous\', \'tool_agent\', or \'human_proxy\'. Empty string for human users." },
|
|
3101
|
+
{ "key": "agent_trust_level", "type": "string", "required": false, "description": "Trust level of the authenticated agent: \'first_party\', \'verified_third_party\', or \'unverified\'." },
|
|
3102
|
+
{ "key": "agent_framework", "type": "string", "required": false, "description": "Framework or SDK the agent is built with (e.g., \'claude-code\', \'langchain\', \'crewai\', \'autogen\')." },
|
|
3103
|
+
{ "key": "agent_publisher", "type": "string", "required": false, "description": "Organization that published the agent (e.g., \'anthropic\', \'internal\', \'acme-corp\')." }
|
|
3104
|
+
]
|
|
3105
|
+
},
|
|
3106
|
+
{
|
|
3107
|
+
"name": "read_file",
|
|
3108
|
+
"description": "Read file operations for analyzing file content before allowing access",
|
|
3109
|
+
"context_attributes": [
|
|
3110
|
+
{ "key": "role", "type": "string", "required": false, "description": "Caller\'s RBAC role projected from the principal\'s token" },
|
|
3111
|
+
{ "key": "privilege_scope", "type": "array", "required": false, "description": "Privilege-scope strings granted to the caller" },
|
|
3112
|
+
{ "key": "identity_type", "type": "string", "required": false, "description": "Principal identity class: \'human\', \'agent\', \'service\', or \'mcp_server\'" },
|
|
3113
|
+
{ "key": "principal", "type": "string", "required": false, "description": "Stable principal identifier" },
|
|
3114
|
+
{ "key": "request_id", "type": "string", "required": true, "description": "Unique identifier for this request" },
|
|
3115
|
+
{ "key": "timestamp", "type": "number", "required": true, "description": "Unix timestamp in milliseconds" },
|
|
3116
|
+
{ "key": "source", "type": "string", "required": false, "description": "Traffic origin: \'ide\' | \'cli\' | \'api\' | \'browser\'" },
|
|
3117
|
+
{ "key": "event", "type": "string", "required": false, "description": "Event type: \'file_read\'" },
|
|
3118
|
+
{ "key": "user_email", "type": "string", "required": false, "description": "Human operator email (IDE sessions)" },
|
|
3119
|
+
{ "key": "cwd", "type": "string", "required": false, "description": "Current working directory" },
|
|
3120
|
+
{ "key": "workspace_root", "type": "string", "required": false, "description": "IDE workspace root path" },
|
|
3121
|
+
{ "key": "path", "type": "string", "required": false, "description": "File path being read. Use for path-based access control policies." },
|
|
3122
|
+
{ "key": "secrets_detected", "type": "boolean", "required": false, "description": "Whether secrets were detected in the file content being read" },
|
|
3123
|
+
{ "key": "secret_count", "type": "number", "required": false, "description": "Total number of secret matches found in file content" },
|
|
3124
|
+
{ "key": "secret_types", "type": "array", "required": false, "description": "Array of secret types found in file content" },
|
|
3125
|
+
{ "key": "pii_detected", "type": "boolean", "required": false, "description": "Whether PII was detected in the file content" },
|
|
3126
|
+
{ "key": "pii_types", "type": "array", "required": false, "description": "Array of PII types found in file content" },
|
|
3127
|
+
{ "key": "path_traversal_detected", "type": "boolean", "required": false, "description": "Whether path traversal patterns were detected in the file path" },
|
|
3128
|
+
{ "key": "path_traversal_severity", "type": "string", "required": false, "description": "Severity of path traversal in the file path" },
|
|
3129
|
+
{ "key": "path_traversal_type", "type": "string", "required": false, "description": "Type of path traversal detected" },
|
|
3130
|
+
{ "key": "highest_severity", "type": "string", "required": false, "description": "Highest severity level across all detection engines" },
|
|
3131
|
+
{ "key": "threat_count", "type": "number", "required": false, "description": "Total number of threats detected" },
|
|
3132
|
+
{ "key": "detected_threats", "type": "array", "required": false, "description": "Array of specific threat names detected" },
|
|
3133
|
+
{ "key": "budget_remaining_pct", "type": "number", "required": false, "description": "Remaining token budget as percentage (0-100)." },
|
|
3134
|
+
{ "key": "budget_exceeded", "type": "boolean", "required": false, "description": "Whether the token budget has been exceeded" },
|
|
3135
|
+
{ "key": "rpm_remaining_pct", "type": "number", "required": false, "description": "Remaining RPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)." },
|
|
3136
|
+
{ "key": "rpm_exceeded", "type": "boolean", "required": false, "description": "Whether the RPM limit has been exceeded" },
|
|
3137
|
+
{ "key": "tpm_remaining_pct", "type": "number", "required": false, "description": "Remaining TPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)." },
|
|
3138
|
+
{ "key": "tpm_exceeded", "type": "boolean", "required": false, "description": "Whether the TPM limit has been exceeded" },
|
|
3139
|
+
{ "key": "session_pii_detected", "type": "boolean", "required": false, "description": "Whether PII was detected in any previous turn of the session" },
|
|
3140
|
+
{ "key": "session_pii_types", "type": "array", "required": false, "description": "PII types detected across the session (accumulated)" },
|
|
3141
|
+
{ "key": "session_secrets_detected", "type": "boolean", "required": false, "description": "Whether secrets were detected in any previous turn of the session" },
|
|
3142
|
+
{ "key": "session_secret_types", "type": "array", "required": false, "description": "Secret types detected across the session (accumulated)" },
|
|
3143
|
+
{ "key": "session_injection_detected", "type": "boolean", "required": false, "description": "Whether prompt injection was detected in any previous turn of the session" },
|
|
3144
|
+
{ "key": "session_command_injection", "type": "boolean", "required": false, "description": "Whether command injection was detected in any previous turn of the session" },
|
|
3145
|
+
{ "key": "session_threat_turns", "type": "number", "required": false, "description": "Number of turns in the session where threats were detected" },
|
|
3146
|
+
{ "key": "session_max_injection_score", "type": "number", "required": false, "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions" },
|
|
3147
|
+
{ "key": "session_max_jailbreak_score", "type": "number", "required": false, "description": "Highest jailbreak detection score seen in any turn of the session (0-100)" },
|
|
3148
|
+
{ "key": "session_max_command_injection_score", "type": "number", "required": false, "description": "Highest command injection score seen in any turn of the session (0-100)" },
|
|
3149
|
+
{ "key": "session_max_pii_score", "type": "number", "required": false, "description": "Highest PII risk score seen in any turn of the session (0-100)" },
|
|
3150
|
+
{ "key": "session_max_secret_score", "type": "number", "required": false, "description": "Highest secret detection score seen in any turn of the session (0-100)" },
|
|
3151
|
+
{ "key": "session_cumulative_risk_score", "type": "number", "required": false, "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant" },
|
|
3152
|
+
{ "key": "session_max_sensitivity", "type": "string", "required": false, "description": "Highest data-sensitivity tier observed across the session (e.g. \'public\', \'internal\', \'confidential\', \'restricted\')" },
|
|
3153
|
+
{ "key": "session_original_request", "type": "string", "required": false, "description": "The session\'s first user request, retained for drift / goal-hijack policies that compare later turns against the original intent" },
|
|
3154
|
+
{ "key": "agent_id", "type": "string", "required": false, "description": "Unique identifier of the authenticated AI agent making this request. Empty string for human user requests." },
|
|
3155
|
+
{ "key": "agent_type", "type": "string", "required": false, "description": "Type of the authenticated agent: \'orchestrator\', \'autonomous\', \'tool_agent\', or \'human_proxy\'. Empty string for human users." },
|
|
3156
|
+
{ "key": "agent_trust_level", "type": "string", "required": false, "description": "Trust level of the authenticated agent: \'first_party\', \'verified_third_party\', or \'unverified\'." },
|
|
3157
|
+
{ "key": "agent_framework", "type": "string", "required": false, "description": "Framework or SDK the agent is built with (e.g., \'claude-code\', \'langchain\', \'crewai\', \'autogen\')." },
|
|
3158
|
+
{ "key": "agent_publisher", "type": "string", "required": false, "description": "Organization that published the agent (e.g., \'anthropic\', \'internal\', \'acme-corp\')." }
|
|
3159
|
+
]
|
|
3160
|
+
},
|
|
3161
|
+
{
|
|
3162
|
+
"name": "write_file",
|
|
3163
|
+
"description": "Write file operations for preventing writes of sensitive content",
|
|
3164
|
+
"context_attributes": [
|
|
3165
|
+
{ "key": "role", "type": "string", "required": false, "description": "Caller\'s RBAC role projected from the principal\'s token" },
|
|
3166
|
+
{ "key": "privilege_scope", "type": "array", "required": false, "description": "Privilege-scope strings granted to the caller" },
|
|
3167
|
+
{ "key": "identity_type", "type": "string", "required": false, "description": "Principal identity class: \'human\', \'agent\', \'service\', or \'mcp_server\'" },
|
|
3168
|
+
{ "key": "principal", "type": "string", "required": false, "description": "Stable principal identifier" },
|
|
3169
|
+
{ "key": "request_id", "type": "string", "required": true, "description": "Unique identifier for this request" },
|
|
3170
|
+
{ "key": "timestamp", "type": "number", "required": true, "description": "Unix timestamp in milliseconds" },
|
|
3171
|
+
{ "key": "source", "type": "string", "required": false, "description": "Traffic origin: \'ide\' | \'cli\' | \'api\' | \'browser\'" },
|
|
3172
|
+
{ "key": "event", "type": "string", "required": false, "description": "Event type: \'file_write\'" },
|
|
3173
|
+
{ "key": "user_email", "type": "string", "required": false, "description": "Human operator email (IDE sessions)" },
|
|
3174
|
+
{ "key": "cwd", "type": "string", "required": false, "description": "Current working directory" },
|
|
3175
|
+
{ "key": "workspace_root", "type": "string", "required": false, "description": "IDE workspace root path" },
|
|
3176
|
+
{ "key": "path", "type": "string", "required": false, "description": "File path being written. Use for path-based blocking policies." },
|
|
3177
|
+
{ "key": "invisible_chars_detected", "type": "boolean", "required": false, "description": "Whether invisible Unicode characters were detected in the content being written" },
|
|
3178
|
+
{ "key": "invisible_chars_score", "type": "number", "required": false, "description": "Invisible character attack severity score in write content (0-100)." },
|
|
3179
|
+
{ "key": "secrets_detected", "type": "boolean", "required": false, "description": "Whether secrets were detected in the content being written" },
|
|
3180
|
+
{ "key": "secret_count", "type": "number", "required": false, "description": "Total number of secret matches found in write content" },
|
|
3181
|
+
{ "key": "secret_types", "type": "array", "required": false, "description": "Array of secret types found in write content" },
|
|
3182
|
+
{ "key": "pii_detected", "type": "boolean", "required": false, "description": "Whether PII was detected in the content being written" },
|
|
3183
|
+
{ "key": "pii_types", "type": "array", "required": false, "description": "Array of PII types found in write content" },
|
|
3184
|
+
{ "key": "path_traversal_detected", "type": "boolean", "required": false, "description": "Whether path traversal patterns were detected in the file path" },
|
|
3185
|
+
{ "key": "path_traversal_severity", "type": "string", "required": false, "description": "Severity of path traversal in the file write path" },
|
|
3186
|
+
{ "key": "path_traversal_type", "type": "string", "required": false, "description": "Type of path traversal detected" },
|
|
3187
|
+
{ "key": "highest_severity", "type": "string", "required": false, "description": "Highest severity level across all detection engines" },
|
|
3188
|
+
{ "key": "threat_count", "type": "number", "required": false, "description": "Total number of threats detected" },
|
|
3189
|
+
{ "key": "detected_threats", "type": "array", "required": false, "description": "Array of specific threat names detected" },
|
|
3190
|
+
{ "key": "budget_remaining_pct", "type": "number", "required": false, "description": "Remaining token budget as percentage (0-100)." },
|
|
3191
|
+
{ "key": "budget_exceeded", "type": "boolean", "required": false, "description": "Whether the token budget has been exceeded" },
|
|
3192
|
+
{ "key": "rpm_remaining_pct", "type": "number", "required": false, "description": "Remaining RPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)." },
|
|
3193
|
+
{ "key": "rpm_exceeded", "type": "boolean", "required": false, "description": "Whether the RPM limit has been exceeded" },
|
|
3194
|
+
{ "key": "tpm_remaining_pct", "type": "number", "required": false, "description": "Remaining TPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)." },
|
|
3195
|
+
{ "key": "tpm_exceeded", "type": "boolean", "required": false, "description": "Whether the TPM limit has been exceeded" },
|
|
3196
|
+
{ "key": "session_pii_detected", "type": "boolean", "required": false, "description": "Whether PII was detected in any previous turn of the session" },
|
|
3197
|
+
{ "key": "session_pii_types", "type": "array", "required": false, "description": "PII types detected across the session (accumulated)" },
|
|
3198
|
+
{ "key": "session_secrets_detected", "type": "boolean", "required": false, "description": "Whether secrets were detected in any previous turn of the session" },
|
|
3199
|
+
{ "key": "session_secret_types", "type": "array", "required": false, "description": "Secret types detected across the session (accumulated)" },
|
|
3200
|
+
{ "key": "session_injection_detected", "type": "boolean", "required": false, "description": "Whether prompt injection was detected in any previous turn of the session" },
|
|
3201
|
+
{ "key": "session_command_injection", "type": "boolean", "required": false, "description": "Whether command injection was detected in any previous turn of the session" },
|
|
3202
|
+
{ "key": "session_threat_turns", "type": "number", "required": false, "description": "Number of turns in the session where threats were detected" },
|
|
3203
|
+
{ "key": "session_max_injection_score", "type": "number", "required": false, "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions" },
|
|
3204
|
+
{ "key": "session_max_jailbreak_score", "type": "number", "required": false, "description": "Highest jailbreak detection score seen in any turn of the session (0-100)" },
|
|
3205
|
+
{ "key": "session_max_command_injection_score", "type": "number", "required": false, "description": "Highest command injection score seen in any turn of the session (0-100)" },
|
|
3206
|
+
{ "key": "session_max_pii_score", "type": "number", "required": false, "description": "Highest PII risk score seen in any turn of the session (0-100)" },
|
|
3207
|
+
{ "key": "session_max_secret_score", "type": "number", "required": false, "description": "Highest secret detection score seen in any turn of the session (0-100)" },
|
|
3208
|
+
{ "key": "session_cumulative_risk_score", "type": "number", "required": false, "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant" },
|
|
3209
|
+
{ "key": "session_max_sensitivity", "type": "string", "required": false, "description": "Highest data-sensitivity tier observed across the session (e.g. \'public\', \'internal\', \'confidential\', \'restricted\')" },
|
|
3210
|
+
{ "key": "session_original_request", "type": "string", "required": false, "description": "The session\'s first user request, retained for drift / goal-hijack policies that compare later turns against the original intent" },
|
|
3211
|
+
{ "key": "agent_id", "type": "string", "required": false, "description": "Unique identifier of the authenticated AI agent making this request. Empty string for human user requests." },
|
|
3212
|
+
{ "key": "agent_type", "type": "string", "required": false, "description": "Type of the authenticated agent: \'orchestrator\', \'autonomous\', \'tool_agent\', or \'human_proxy\'. Empty string for human users." },
|
|
3213
|
+
{ "key": "agent_trust_level", "type": "string", "required": false, "description": "Trust level of the authenticated agent: \'first_party\', \'verified_third_party\', or \'unverified\'." },
|
|
3214
|
+
{ "key": "agent_framework", "type": "string", "required": false, "description": "Framework or SDK the agent is built with (e.g., \'claude-code\', \'langchain\', \'crewai\', \'autogen\')." },
|
|
3215
|
+
{ "key": "agent_publisher", "type": "string", "required": false, "description": "Organization that published the agent (e.g., \'anthropic\', \'internal\', \'acme-corp\')." }
|
|
3216
|
+
]
|
|
3217
|
+
},
|
|
3218
|
+
{
|
|
3219
|
+
"name": "connect_server",
|
|
3220
|
+
"description": "Connect to an MCP server, used to control which MCP servers are allowed",
|
|
3221
|
+
"context_attributes": [
|
|
3222
|
+
{ "key": "role", "type": "string", "required": false, "description": "Caller\'s RBAC role projected from the principal\'s token" },
|
|
3223
|
+
{ "key": "privilege_scope", "type": "array", "required": false, "description": "Privilege-scope strings granted to the caller" },
|
|
3224
|
+
{ "key": "identity_type", "type": "string", "required": false, "description": "Principal identity class: \'human\', \'agent\', \'service\', or \'mcp_server\'" },
|
|
3225
|
+
{ "key": "principal", "type": "string", "required": false, "description": "Stable principal identifier" },
|
|
3226
|
+
{ "key": "request_id", "type": "string", "required": true, "description": "Unique identifier for this request" },
|
|
3227
|
+
{ "key": "timestamp", "type": "number", "required": true, "description": "Unix timestamp in milliseconds" },
|
|
3228
|
+
{ "key": "source", "type": "string", "required": false, "description": "Traffic origin: \'ide\' | \'cli\' | \'api\' | \'browser\'" },
|
|
3229
|
+
{ "key": "event", "type": "string", "required": false, "description": "Event type: \'connect_server\'" },
|
|
3230
|
+
{ "key": "user_email", "type": "string", "required": false, "description": "Human operator email (IDE sessions)" },
|
|
3231
|
+
{ "key": "cwd", "type": "string", "required": false, "description": "Current working directory" },
|
|
3232
|
+
{ "key": "workspace_root", "type": "string", "required": false, "description": "IDE workspace root path" },
|
|
3233
|
+
{ "key": "mcp_server", "type": "string", "required": false, "description": "Name of the MCP server being connected to" },
|
|
3234
|
+
{ "key": "mcp_server_verified", "type": "boolean", "required": false, "description": "Whether the MCP server is from a verified/trusted registry" },
|
|
3235
|
+
{ "key": "tool_poisoning_detected", "type": "boolean", "required": false, "description": "Whether tool poisoning was detected in the MCP server\'s tool descriptions" },
|
|
3236
|
+
{ "key": "tool_poisoning_score", "type": "number", "required": false, "description": "Confidence score for tool poisoning in MCP server tools (0-100)." },
|
|
3237
|
+
{ "key": "tool_poisoning_type", "type": "string", "required": false, "description": "Type of tool poisoning detected: \'hidden_instructions\', \'system_prompt_injection\', or \'authority_hijack\'" },
|
|
3238
|
+
{ "key": "mcp_config_risk", "type": "boolean", "required": false, "description": "Whether MCP configuration risk was detected" },
|
|
3239
|
+
{ "key": "mcp_risk_type", "type": "string", "required": false, "description": "Type of MCP configuration risk: \'inline_execution\', \'suspicious_url\', or \'cross_origin\'" },
|
|
3240
|
+
{ "key": "mcp_risk_score", "type": "number", "required": false, "description": "Risk score for MCP configuration issues (0-100)." },
|
|
3241
|
+
{ "key": "cross_origin_detected", "type": "boolean", "required": false, "description": "Whether cross-origin escalation patterns were detected" },
|
|
3242
|
+
{ "key": "cross_origin_type", "type": "string", "required": false, "description": "Type of cross-origin escalation detected" },
|
|
3243
|
+
{ "key": "cross_origin_score", "type": "number", "required": false, "description": "Risk score for cross-origin escalation (0-100)." },
|
|
3244
|
+
{ "key": "highest_severity", "type": "string", "required": false, "description": "Highest severity level across all detection engines" },
|
|
3245
|
+
{ "key": "threat_count", "type": "number", "required": false, "description": "Total number of threats detected" },
|
|
3246
|
+
{ "key": "detected_threats", "type": "array", "required": false, "description": "Array of specific threat names detected" },
|
|
3247
|
+
{ "key": "budget_remaining_pct", "type": "number", "required": false, "description": "Remaining token budget as percentage (0-100)." },
|
|
3248
|
+
{ "key": "budget_exceeded", "type": "boolean", "required": false, "description": "Whether the token budget has been exceeded" },
|
|
3249
|
+
{ "key": "rpm_remaining_pct", "type": "number", "required": false, "description": "Remaining RPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)." },
|
|
3250
|
+
{ "key": "rpm_exceeded", "type": "boolean", "required": false, "description": "Whether the RPM limit has been exceeded" },
|
|
3251
|
+
{ "key": "tpm_remaining_pct", "type": "number", "required": false, "description": "Remaining TPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)." },
|
|
3252
|
+
{ "key": "tpm_exceeded", "type": "boolean", "required": false, "description": "Whether the TPM limit has been exceeded" },
|
|
3253
|
+
{ "key": "session_pii_detected", "type": "boolean", "required": false, "description": "Whether PII was detected in any previous turn of the session" },
|
|
3254
|
+
{ "key": "session_pii_types", "type": "array", "required": false, "description": "PII types detected across the session (accumulated)" },
|
|
3255
|
+
{ "key": "session_secrets_detected", "type": "boolean", "required": false, "description": "Whether secrets were detected in any previous turn of the session" },
|
|
3256
|
+
{ "key": "session_secret_types", "type": "array", "required": false, "description": "Secret types detected across the session (accumulated)" },
|
|
3257
|
+
{ "key": "session_injection_detected", "type": "boolean", "required": false, "description": "Whether prompt injection was detected in any previous turn of the session" },
|
|
3258
|
+
{ "key": "session_command_injection", "type": "boolean", "required": false, "description": "Whether command injection was detected in any previous turn of the session" },
|
|
3259
|
+
{ "key": "session_threat_turns", "type": "number", "required": false, "description": "Number of turns in the session where threats were detected" },
|
|
3260
|
+
{ "key": "session_max_injection_score", "type": "number", "required": false, "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions" },
|
|
3261
|
+
{ "key": "session_max_jailbreak_score", "type": "number", "required": false, "description": "Highest jailbreak detection score seen in any turn of the session (0-100)" },
|
|
3262
|
+
{ "key": "session_max_command_injection_score", "type": "number", "required": false, "description": "Highest command injection score seen in any turn of the session (0-100)" },
|
|
3263
|
+
{ "key": "session_max_pii_score", "type": "number", "required": false, "description": "Highest PII risk score seen in any turn of the session (0-100)" },
|
|
3264
|
+
{ "key": "session_max_secret_score", "type": "number", "required": false, "description": "Highest secret detection score seen in any turn of the session (0-100)" },
|
|
3265
|
+
{ "key": "session_cumulative_risk_score", "type": "number", "required": false, "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant" },
|
|
3266
|
+
{ "key": "session_max_sensitivity", "type": "string", "required": false, "description": "Highest data-sensitivity tier observed across the session (e.g. \'public\', \'internal\', \'confidential\', \'restricted\')" },
|
|
3267
|
+
{ "key": "session_original_request", "type": "string", "required": false, "description": "The session\'s first user request, retained for drift / goal-hijack policies that compare later turns against the original intent" },
|
|
3268
|
+
{ "key": "agent_id", "type": "string", "required": false, "description": "Unique identifier of the authenticated AI agent making this request. Empty string for human user requests." },
|
|
3269
|
+
{ "key": "agent_type", "type": "string", "required": false, "description": "Type of the authenticated agent: \'orchestrator\', \'autonomous\', \'tool_agent\', or \'human_proxy\'. Empty string for human users." },
|
|
3270
|
+
{ "key": "agent_trust_level", "type": "string", "required": false, "description": "Trust level of the authenticated agent: \'first_party\', \'verified_third_party\', or \'unverified\'." },
|
|
3271
|
+
{ "key": "agent_framework", "type": "string", "required": false, "description": "Framework or SDK the agent is built with (e.g., \'claude-code\', \'langchain\', \'crewai\', \'autogen\')." },
|
|
3272
|
+
{ "key": "agent_publisher", "type": "string", "required": false, "description": "Organization that published the agent (e.g., \'anthropic\', \'internal\', \'acme-corp\')." }
|
|
3273
|
+
]
|
|
3274
|
+
}
|
|
3275
|
+
]
|
|
3276
|
+
};
|
|
2113
3277
|
/**
|
|
2114
3278
|
* AiGateway context metadata (parsed JSON)
|
|
2115
3279
|
*/
|