{ "$defs": { "agent_registration_condition": { "$ref": "#/$defs/agent_registration_rule_contract", "additionalProperties": false, "properties": { "params": {}, "rule_type": { "type": "string" } }, "required": [ "rule_type" ], "type": "object" }, "agent_registration_rule_contract": { "oneOf": [ { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "conditions": { "description": "List of sub-condition objects, each with ``rule_type`` and ``params``", "items": { "$ref": "#/$defs/agent_registration_condition" }, "type": "array" } }, "required": [ "conditions" ], "type": "object" }, "rule_type": { "const": "all_of" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "conditions": { "description": "List of sub-condition objects, each with ``rule_type`` and ``params``", "items": { "$ref": "#/$defs/agent_registration_condition" }, "type": "array" } }, "required": [ "conditions" ], "type": "object" }, "rule_type": { "const": "any_of" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "forbidden_kinds": { "anyOf": [ { "description": "Current step must not be these types", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, { "type": "null" } ] }, "required_kind": { "anyOf": [ { "description": "Current step must be this type", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, { "type": "null" } ] }, "trigger_condition": { "additionalProperties": false, "description": "Condition on a previous step field", "properties": { "field": { "description": "Full step field path on the previous step, e.g. 'properties.target.trust'", "pattern": "^(?:kind|verb|step_name|(?:input|properties)\\.[^.]+(?:\\.[^.]+)*)(?![\\s\\S])", "type": "string" }, "op": { "description": "Comparison; 'below' and 'above' need a numeric value", "enum": [ "below", "above", "equals", "contains" ], "type": "string" }, "value": { "description": "Value compared against the field; any type, a number for 'below' and 'above'" } }, "required": [ "field", "op", "value" ], "type": "object" }, "trigger_kinds": { "description": "Trigger previous kinds", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" } }, "required": [ "trigger_condition", "trigger_kinds" ], "type": "object" }, "rule_type": { "const": "conditional_successor_required" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "kind": { "description": "Required kind", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "property_filter": { "anyOf": [ { "description": "Property filter on current step", "type": "object" }, { "type": "null" } ] }, "verb": { "anyOf": [ { "description": "Required verb (if any)", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "kind" ], "type": "object" }, "rule_type": { "const": "current_is" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "allowed_domains": { "description": "Permitted domain names", "type": "array" }, "target_kinds": { "description": "Kinds the allowlist applies to (e.g. ['step.resource'])", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" } }, "required": [ "allowed_domains", "target_kinds" ], "type": "object" }, "rule_type": { "const": "domain_allowlist" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "kind": { "description": "Kind to count", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "max_steps": { "description": "Maximum allowed steps, the intended one included; 0 forbids every matching step", "minimum": 0, "type": "integer" }, "step_name": { "anyOf": [ { "description": "If set, count only steps with this step name (e.g. a specific tool)", "type": "string" }, { "type": "null" } ] }, "verb": { "anyOf": [ { "description": "If set, count only steps with this verb", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "kind", "max_steps" ], "type": "object" }, "rule_type": { "const": "execution_max_steps" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "field": { "description": "Step field path or registration field name", "pattern": "^(?:agent_id|agent_key|declared_tools|description|environment|maintainer_id|metadata|name|owner_id|purpose|risk_classification)(?:\\.[^.]+)*(?![\\s\\S])", "type": "string" }, "values": { "description": "Allowed values", "type": "array" } }, "required": [ "field", "values" ], "type": "object" }, "rule_type": { "const": "field_in_list" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "field": { "description": "Step field path or registration field name", "pattern": "^(?:agent_id|agent_key|declared_tools|description|environment|maintainer_id|metadata|name|owner_id|purpose|risk_classification)(?:\\.[^.]+)*(?![\\s\\S])", "type": "string" }, "pattern": { "description": "RE2 regex; no lookaround or backreferences; anchor with ^ and $", "type": "string" } }, "required": [ "field", "pattern" ], "type": "object" }, "rule_type": { "const": "field_matches_regex" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "field": { "description": "Step field path or registration field name", "pattern": "^(?:agent_id|agent_key|declared_tools|description|environment|maintainer_id|metadata|name|owner_id|purpose|risk_classification)(?:\\.[^.]+)*(?![\\s\\S])", "type": "string" } }, "required": [ "field" ], "type": "object" }, "rule_type": { "const": "field_not_empty" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "count_attempts": { "description": "Whether blocked attempts count as matches", "type": "boolean" }, "kind": { "description": "Required kind in history", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "output_filter": { "anyOf": [ { "description": "Filter on the matched step's output (relative to output)", "type": "object" }, { "type": "null" } ] }, "property_filter": { "anyOf": [ { "description": "Property filter on the matched step", "type": "object" }, { "type": "null" } ] }, "verb": { "anyOf": [ { "description": "Also require this verb on the matched step", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "count_attempts", "kind" ], "type": "object" }, "rule_type": { "const": "history_contains" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "kind": { "description": "Kind to monitor", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "max_consecutive": { "description": "Max consecutive occurrences, the intended step included; 0 forbids the kind", "minimum": 0, "type": "integer" } }, "required": [ "kind", "max_consecutive" ], "type": "object" }, "rule_type": { "const": "max_consecutive_same_type" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "condition": { "$ref": "#/$defs/agent_registration_condition" } }, "required": [ "condition" ], "type": "object" }, "rule_type": { "const": "not" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "anyOf": [ { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "field": { "anyOf": [ { "description": "Step field path of the target (default: 'properties.target.host')", "pattern": "^(?:agent_id|agent_key|declared_tools|description|environment|maintainer_id|metadata|name|owner_id|purpose|risk_classification)(?:\\.[^.]+)*(?![\\s\\S])", "type": "string" }, { "type": "null" } ] }, "target_kinds": { "anyOf": [ { "description": "Only enforce when current kind is in this list (default: all)", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, { "type": "null" } ] }, "target_verb": { "anyOf": [ { "description": "Only enforce when current verb matches this single verb", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] }, "target_verbs": { "anyOf": [ { "description": "Only enforce when current verb is in this list. Use to scope to write verbs (e.g. ['POST', 'PATCH', 'DELETE']) so reads outside the root are not blocked. kinds with no verb (e.g. step.exec) are always in scope.", "items": { "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, "type": "array" }, { "type": "null" } ] } }, "required": [], "type": "object" }, { "type": "null" } ] }, "rule_type": { "const": "path_within_root" } }, "required": [ "rule_type" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "forbidden_sequence": { "description": "Ordered list of kind values to forbid", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" } }, "required": [ "forbidden_sequence" ], "type": "object" }, "rule_type": { "const": "sequence_forbidden" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "required_kind": { "description": "Required immediate predecessor kind", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "target_kinds": { "anyOf": [ { "description": "Kinds to enforce on (default: all)", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, { "type": "null" } ] }, "target_property_filter": { "anyOf": [ { "description": "Dot-path property filter on current step", "type": "object" }, { "type": "null" } ] }, "target_verb": { "anyOf": [ { "description": "Only enforce when current verb matches", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "required_kind" ], "type": "object" }, "rule_type": { "const": "step_directly_preceded_by" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "agent_risk_classifications": { "description": "Risk tiers this applies to, compared exactly with the agent's (lower case)", "items": { "enum": [ "high", "limited", "minimal", "unacceptable", "unclassified" ], "type": "string" }, "type": "array" }, "forbidden_kind": { "description": "Forbidden kind value", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "forbidden_verb": { "anyOf": [ { "description": "Only forbid when verb matches", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] }, "target_property_filter": { "anyOf": [ { "description": "Additional property conditions", "type": "object" }, { "type": "null" } ] } }, "required": [ "agent_risk_classifications", "forbidden_kind" ], "type": "object" }, "rule_type": { "const": "step_forbidden_for_classification" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "agent_field": { "description": "Agent attribute holding the allowlist", "enum": [ "agent_id", "agent_key", "api_key_id", "declared_tools", "environment", "id", "maintainer_id", "name", "owner_id", "purpose", "risk_classification" ], "type": "string" }, "target_kinds": { "anyOf": [ { "description": "Only enforce for these kinds", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, { "type": "null" } ] } }, "required": [ "agent_field" ], "type": "object" }, "rule_type": { "const": "step_name_in_allowlist" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "forbidden_predecessor_kinds": { "description": "Kinds that forbid the target from following", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, "target_kinds": { "description": "Kinds that must not follow the forbidden predecessors", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, "target_verb": { "anyOf": [ { "description": "Only enforce when verb matches", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "forbidden_predecessor_kinds", "target_kinds" ], "type": "object" }, "rule_type": { "const": "step_not_after" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "forbidden_intervening": { "description": "Kinds not allowed between predecessor and target", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, "required_kind": { "description": "Required predecessor", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "target_kinds": { "description": "Target kinds", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, "target_property_filter": { "anyOf": [ { "description": "Property filter on current step", "type": "object" }, { "type": "null" } ] }, "target_verb": { "anyOf": [ { "description": "Only enforce when current verb matches", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "forbidden_intervening", "required_kind", "target_kinds" ], "type": "object" }, "rule_type": { "const": "step_preceded_by_without_intervening" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "required_kind": { "description": "Predecessor kind", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "target_kinds": { "description": "Target kinds", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, "target_property_filter": { "anyOf": [ { "description": "Property filter on target", "type": "object" }, { "type": "null" } ] }, "target_verb": { "anyOf": [ { "description": "Only enforce when verb matches", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "required_kind", "target_kinds" ], "type": "object" }, "rule_type": { "const": "step_requires_dedicated_predecessor" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "gate_decision": { "anyOf": [ { "description": "Required output.decision value (default: 'pass')", "enum": [ "pass", "deny" ], "type": "string" }, { "type": "null" } ] }, "gate_kind": { "anyOf": [ { "description": "Required properties.kind value", "enum": [ "human", "guardrail" ], "type": "string" }, { "type": "null" } ] }, "max_steps_since_gate": { "anyOf": [ { "description": "Require a matching gate among the last N history entries", "minimum": 1, "type": "integer" }, { "type": "null" } ] }, "target_kinds": { "description": "Kinds requiring a gate", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, "target_verb": { "anyOf": [ { "description": "Only enforce when verb matches", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "target_kinds" ], "type": "object" }, "rule_type": { "const": "step_requires_gate" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "required_kind": { "description": "Required predecessor kind", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "target_kinds": { "description": "Kinds requiring the predecessor", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, "target_property_filter": { "anyOf": [ { "description": "Property filter on current step", "type": "object" }, { "type": "null" } ] }, "target_verb": { "anyOf": [ { "description": "Only enforce when current verb matches", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "required_kind", "target_kinds" ], "type": "object" }, "rule_type": { "const": "step_requires_predecessor" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "taint_kind": { "description": "Kind that taints the path", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "taint_output_filter": { "anyOf": [ { "description": "Filter on the taint step's output (relative to output)", "type": "object" }, { "type": "null" } ] }, "taint_property_filter": { "anyOf": [ { "description": "Property filter on the taint step", "type": "object" }, { "type": "null" } ] }, "taint_verb": { "anyOf": [ { "description": "Also require this verb on the taint step", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] }, "target_kinds": { "description": "Kinds blocked by taint", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, "target_verb": { "anyOf": [ { "description": "Only block when current verb matches", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "taint_kind", "target_kinds" ], "type": "object" }, "rule_type": { "const": "tainted_path_block" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "budget": { "description": "Maximum cumulative value allowed; 0 admits only steps that declare no positive value", "minimum": 0, "type": "number" }, "kind": { "description": "The budgeted kind: the only type this rule applies to and accumulates", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "property_path": { "description": "Dot-separated path to the numeric value, read from each recorded step's properties and from the intended step's properties", "type": "string" } }, "required": [ "budget", "kind", "property_path" ], "type": "object" }, "rule_type": { "const": "usage_budget" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "end_hour": { "description": "Exclusive end hour (0-24); 24 and 0 both mean until midnight", "maximum": 24, "minimum": 0, "type": "integer" }, "start_hour": { "description": "Inclusive start hour (0-23)", "maximum": 23, "minimum": 0, "type": "integer" }, "timezone": { "anyOf": [ { "description": "IANA timezone name (default: UTC)", "type": "string" }, { "type": "null" } ] } }, "required": [ "end_hour", "start_hour" ], "type": "object" }, "rule_type": { "const": "working_hours_only" } }, "required": [ "rule_type", "params" ] } ] }, "step_execution_condition": { "$ref": "#/$defs/step_execution_rule_contract", "additionalProperties": false, "properties": { "params": {}, "rule_type": { "type": "string" } }, "required": [ "rule_type" ], "type": "object" }, "step_execution_rule_contract": { "oneOf": [ { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "conditions": { "description": "List of sub-condition objects, each with ``rule_type`` and ``params``", "items": { "$ref": "#/$defs/step_execution_condition" }, "type": "array" } }, "required": [ "conditions" ], "type": "object" }, "rule_type": { "const": "all_of" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "conditions": { "description": "List of sub-condition objects, each with ``rule_type`` and ``params``", "items": { "$ref": "#/$defs/step_execution_condition" }, "type": "array" } }, "required": [ "conditions" ], "type": "object" }, "rule_type": { "const": "any_of" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "forbidden_kinds": { "anyOf": [ { "description": "Current step must not be these types", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, { "type": "null" } ] }, "required_kind": { "anyOf": [ { "description": "Current step must be this type", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, { "type": "null" } ] }, "trigger_condition": { "additionalProperties": false, "description": "Condition on a previous step field", "properties": { "field": { "description": "Full step field path on the previous step, e.g. 'properties.target.trust'", "pattern": "^(?:kind|verb|step_name|(?:input|properties)\\.[^.]+(?:\\.[^.]+)*)(?![\\s\\S])", "type": "string" }, "op": { "description": "Comparison; 'below' and 'above' need a numeric value", "enum": [ "below", "above", "equals", "contains" ], "type": "string" }, "value": { "description": "Value compared against the field; any type, a number for 'below' and 'above'" } }, "required": [ "field", "op", "value" ], "type": "object" }, "trigger_kinds": { "description": "Trigger previous kinds", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" } }, "required": [ "trigger_condition", "trigger_kinds" ], "type": "object" }, "rule_type": { "const": "conditional_successor_required" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "kind": { "description": "Required kind", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "property_filter": { "anyOf": [ { "description": "Property filter on current step", "type": "object" }, { "type": "null" } ] }, "verb": { "anyOf": [ { "description": "Required verb (if any)", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "kind" ], "type": "object" }, "rule_type": { "const": "current_is" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "allowed_domains": { "description": "Permitted domain names", "type": "array" }, "target_kinds": { "description": "Kinds the allowlist applies to (e.g. ['step.resource'])", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" } }, "required": [ "allowed_domains", "target_kinds" ], "type": "object" }, "rule_type": { "const": "domain_allowlist" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "kind": { "description": "Kind to count", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "max_steps": { "description": "Maximum allowed steps, the intended one included; 0 forbids every matching step", "minimum": 0, "type": "integer" }, "step_name": { "anyOf": [ { "description": "If set, count only steps with this step name (e.g. a specific tool)", "type": "string" }, { "type": "null" } ] }, "verb": { "anyOf": [ { "description": "If set, count only steps with this verb", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "kind", "max_steps" ], "type": "object" }, "rule_type": { "const": "execution_max_steps" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "field": { "description": "Step field path or registration field name", "pattern": "^(?:kind|verb|step_name|(?:input|properties)\\.[^.]+(?:\\.[^.]+)*)(?![\\s\\S])", "type": "string" }, "values": { "description": "Allowed values", "type": "array" } }, "required": [ "field", "values" ], "type": "object" }, "rule_type": { "const": "field_in_list" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "field": { "description": "Step field path or registration field name", "pattern": "^(?:kind|verb|step_name|(?:input|properties)\\.[^.]+(?:\\.[^.]+)*)(?![\\s\\S])", "type": "string" }, "pattern": { "description": "RE2 regex; no lookaround or backreferences; anchor with ^ and $", "type": "string" } }, "required": [ "field", "pattern" ], "type": "object" }, "rule_type": { "const": "field_matches_regex" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "field": { "description": "Step field path or registration field name", "pattern": "^(?:kind|verb|step_name|(?:input|properties)\\.[^.]+(?:\\.[^.]+)*)(?![\\s\\S])", "type": "string" } }, "required": [ "field" ], "type": "object" }, "rule_type": { "const": "field_not_empty" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "count_attempts": { "description": "Whether blocked attempts count as matches", "type": "boolean" }, "kind": { "description": "Required kind in history", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "output_filter": { "anyOf": [ { "description": "Filter on the matched step's output (relative to output)", "type": "object" }, { "type": "null" } ] }, "property_filter": { "anyOf": [ { "description": "Property filter on the matched step", "type": "object" }, { "type": "null" } ] }, "verb": { "anyOf": [ { "description": "Also require this verb on the matched step", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "count_attempts", "kind" ], "type": "object" }, "rule_type": { "const": "history_contains" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "kind": { "description": "Kind to monitor", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "max_consecutive": { "description": "Max consecutive occurrences, the intended step included; 0 forbids the kind", "minimum": 0, "type": "integer" } }, "required": [ "kind", "max_consecutive" ], "type": "object" }, "rule_type": { "const": "max_consecutive_same_type" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "condition": { "$ref": "#/$defs/step_execution_condition" } }, "required": [ "condition" ], "type": "object" }, "rule_type": { "const": "not" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "anyOf": [ { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "field": { "anyOf": [ { "description": "Step field path of the target (default: 'properties.target.host')", "pattern": "^(?:kind|verb|step_name|(?:input|properties)\\.[^.]+(?:\\.[^.]+)*)(?![\\s\\S])", "type": "string" }, { "type": "null" } ] }, "target_kinds": { "anyOf": [ { "description": "Only enforce when current kind is in this list (default: all)", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, { "type": "null" } ] }, "target_verb": { "anyOf": [ { "description": "Only enforce when current verb matches this single verb", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] }, "target_verbs": { "anyOf": [ { "description": "Only enforce when current verb is in this list. Use to scope to write verbs (e.g. ['POST', 'PATCH', 'DELETE']) so reads outside the root are not blocked. kinds with no verb (e.g. step.exec) are always in scope.", "items": { "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, "type": "array" }, { "type": "null" } ] } }, "required": [], "type": "object" }, { "type": "null" } ] }, "rule_type": { "const": "path_within_root" } }, "required": [ "rule_type" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "forbidden_sequence": { "description": "Ordered list of kind values to forbid", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" } }, "required": [ "forbidden_sequence" ], "type": "object" }, "rule_type": { "const": "sequence_forbidden" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "required_kind": { "description": "Required immediate predecessor kind", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "target_kinds": { "anyOf": [ { "description": "Kinds to enforce on (default: all)", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, { "type": "null" } ] }, "target_property_filter": { "anyOf": [ { "description": "Dot-path property filter on current step", "type": "object" }, { "type": "null" } ] }, "target_verb": { "anyOf": [ { "description": "Only enforce when current verb matches", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "required_kind" ], "type": "object" }, "rule_type": { "const": "step_directly_preceded_by" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "agent_risk_classifications": { "description": "Risk tiers this applies to, compared exactly with the agent's (lower case)", "items": { "enum": [ "high", "limited", "minimal", "unacceptable", "unclassified" ], "type": "string" }, "type": "array" }, "forbidden_kind": { "description": "Forbidden kind value", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "forbidden_verb": { "anyOf": [ { "description": "Only forbid when verb matches", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] }, "target_property_filter": { "anyOf": [ { "description": "Additional property conditions", "type": "object" }, { "type": "null" } ] } }, "required": [ "agent_risk_classifications", "forbidden_kind" ], "type": "object" }, "rule_type": { "const": "step_forbidden_for_classification" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "agent_field": { "description": "Agent attribute holding the allowlist", "enum": [ "agent_id", "agent_key", "api_key_id", "declared_tools", "environment", "id", "maintainer_id", "name", "owner_id", "purpose", "risk_classification" ], "type": "string" }, "target_kinds": { "anyOf": [ { "description": "Only enforce for these kinds", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, { "type": "null" } ] } }, "required": [ "agent_field" ], "type": "object" }, "rule_type": { "const": "step_name_in_allowlist" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "forbidden_predecessor_kinds": { "description": "Kinds that forbid the target from following", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, "target_kinds": { "description": "Kinds that must not follow the forbidden predecessors", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, "target_verb": { "anyOf": [ { "description": "Only enforce when verb matches", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "forbidden_predecessor_kinds", "target_kinds" ], "type": "object" }, "rule_type": { "const": "step_not_after" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "forbidden_intervening": { "description": "Kinds not allowed between predecessor and target", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, "required_kind": { "description": "Required predecessor", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "target_kinds": { "description": "Target kinds", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, "target_property_filter": { "anyOf": [ { "description": "Property filter on current step", "type": "object" }, { "type": "null" } ] }, "target_verb": { "anyOf": [ { "description": "Only enforce when current verb matches", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "forbidden_intervening", "required_kind", "target_kinds" ], "type": "object" }, "rule_type": { "const": "step_preceded_by_without_intervening" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "required_kind": { "description": "Predecessor kind", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "target_kinds": { "description": "Target kinds", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, "target_property_filter": { "anyOf": [ { "description": "Property filter on target", "type": "object" }, { "type": "null" } ] }, "target_verb": { "anyOf": [ { "description": "Only enforce when verb matches", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "required_kind", "target_kinds" ], "type": "object" }, "rule_type": { "const": "step_requires_dedicated_predecessor" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "gate_decision": { "anyOf": [ { "description": "Required output.decision value (default: 'pass')", "enum": [ "pass", "deny" ], "type": "string" }, { "type": "null" } ] }, "gate_kind": { "anyOf": [ { "description": "Required properties.kind value", "enum": [ "human", "guardrail" ], "type": "string" }, { "type": "null" } ] }, "max_steps_since_gate": { "anyOf": [ { "description": "Require a matching gate among the last N history entries", "minimum": 1, "type": "integer" }, { "type": "null" } ] }, "target_kinds": { "description": "Kinds requiring a gate", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, "target_verb": { "anyOf": [ { "description": "Only enforce when verb matches", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "target_kinds" ], "type": "object" }, "rule_type": { "const": "step_requires_gate" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "required_kind": { "description": "Required predecessor kind", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "target_kinds": { "description": "Kinds requiring the predecessor", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, "target_property_filter": { "anyOf": [ { "description": "Property filter on current step", "type": "object" }, { "type": "null" } ] }, "target_verb": { "anyOf": [ { "description": "Only enforce when current verb matches", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "required_kind", "target_kinds" ], "type": "object" }, "rule_type": { "const": "step_requires_predecessor" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "taint_kind": { "description": "Kind that taints the path", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "taint_output_filter": { "anyOf": [ { "description": "Filter on the taint step's output (relative to output)", "type": "object" }, { "type": "null" } ] }, "taint_property_filter": { "anyOf": [ { "description": "Property filter on the taint step", "type": "object" }, { "type": "null" } ] }, "taint_verb": { "anyOf": [ { "description": "Also require this verb on the taint step", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] }, "target_kinds": { "description": "Kinds blocked by taint", "items": { "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "type": "array" }, "target_verb": { "anyOf": [ { "description": "Only block when current verb matches", "enum": [ "DELETE", "GET", "PATCH", "POST" ], "type": "string" }, { "type": "null" } ] } }, "required": [ "taint_kind", "target_kinds" ], "type": "object" }, "rule_type": { "const": "tainted_path_block" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "budget": { "description": "Maximum cumulative value allowed; 0 admits only steps that declare no positive value", "minimum": 0, "type": "number" }, "kind": { "description": "The budgeted kind: the only type this rule applies to and accumulates", "enum": [ "step.credential", "step.exec", "step.gate", "step.message", "step.model", "step.resource", "step.self", "step.unknown", "task.end", "task.error", "task.idle", "task.start" ], "type": "string" }, "property_path": { "description": "Dot-separated path to the numeric value, read from each recorded step's properties and from the intended step's properties", "type": "string" } }, "required": [ "budget", "kind", "property_path" ], "type": "object" }, "rule_type": { "const": "usage_budget" } }, "required": [ "rule_type", "params" ] }, { "properties": { "params": { "additionalProperties": false, "patternProperties": { "^_": {} }, "properties": { "end_hour": { "description": "Exclusive end hour (0-24); 24 and 0 both mean until midnight", "maximum": 24, "minimum": 0, "type": "integer" }, "start_hour": { "description": "Inclusive start hour (0-23)", "maximum": 23, "minimum": 0, "type": "integer" }, "timezone": { "anyOf": [ { "description": "IANA timezone name (default: UTC)", "type": "string" }, { "type": "null" } ] } }, "required": [ "end_hour", "start_hour" ], "type": "object" }, "rule_type": { "const": "working_hours_only" } }, "required": [ "rule_type", "params" ] } ] } }, "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "name": { "type": "string" }, "policies": { "items": { "additionalProperties": false, "oneOf": [ { "$ref": "#/$defs/agent_registration_rule_contract", "properties": { "enforcement_point": { "pattern": "^(?:[aA][gG][eE][nN][tT]_[rR][eE][gG][iI][sS][tT][rR][aA][tT][iI][oO][nN])(?![\\s\\S])" } } }, { "$ref": "#/$defs/step_execution_rule_contract", "properties": { "enforcement_point": { "pattern": "^(?:[sS][tT][eE][pP]_[eE][xX][eE][cC][uU][tT][iI][oO][nN])(?![\\s\\S])" } } } ], "properties": { "agent_id": {}, "created_at": {}, "description": {}, "effect": {}, "enabled": {}, "enforcement_point": { "pattern": "^(?:[aA][gG][eE][nN][tT]_[rR][eE][gG][iI][sS][tT][rR][aA][tT][iI][oO][nN]|[sS][tT][eE][pP]_[eE][xX][eE][cC][uU][tT][iI][oO][nN])(?![\\s\\S])", "type": "string" }, "environment": {}, "evaluate_at": {}, "id": {}, "manifest_assigned_at": {}, "manifest_assigned_by": {}, "manifest_id": {}, "manifest_name": {}, "manifest_path": {}, "manifest_repo": {}, "manifest_sha": {}, "name": {}, "params": {}, "risk_classification": {}, "rule_type": {}, "severity": { "pattern": "^(?:[cC][rR][iI][tT][iI][cC][aA][lL]|[hH][iI][gG][hH]|[lL][oO][wW]|[mM][eE][dD][iI][uU][mM])(?![\\s\\S])", "type": "string" }, "source_template": {}, "updated_at": {}, "user_id": {} }, "required": [ "name", "rule_type", "severity", "enforcement_point" ], "type": "object" }, "type": "array" } }, "required": [ "name", "policies" ], "title": "Kyvvu manifest editor aid", "type": "object" }