Spaces:
Running
Running
File size: 3,122 Bytes
dcc82ec | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 | # SPDX-License-Identifier: Apache-2.0
# a11oy ROE / governance policy — NeMo Guardrails Colang (v1) flows.
# https://github.com/NVIDIA-NeMo/Guardrails (Colang policy DSL)
#
# DOCTRINE: This file is the AUTHORITATIVE, version-controlled, independently
# auditable Rules-of-Engagement policy. Policy lives HERE, in a reviewable file
# under git — NOT inside a prompt. serve.py loads + enforces these flows via
# szl_colang_policy.py and renders the file content + sha256 in the Policy tab so
# anyone can audit exactly which rules are active.
#
# policy_id: a11oy-roe-core
# policy_version: 1.0.0
# Each `define flow` is a named, hash-anchored rule. The runtime enforcer matches
# the proposed action against each flow's guard conditions and records which
# flows fired into the signed receipt (controls_evaluated.policy per IETF
# draft-marques-asqav-compliance-receipts-05).
define flow refuse_destructive_actions
# No irreversible / destructive action without explicit operator authorization.
user action requested $action
if is_destructive($action) and not has_operator_authorization($action)
bot refuse action with reason "destructive_without_authorization"
create signed_refusal_receipt($action, "destructive_without_authorization")
else
continue
define flow refuse_pii_exfiltration
# Never emit/exfiltrate PII (PAN, SSN, full card numbers) to an external sink.
user action requested $action
if requests_pii_exfiltration($action)
bot refuse action with reason "pii_exfiltration_blocked"
create signed_refusal_receipt($action, "pii_exfiltration_blocked")
else
continue
define flow refuse_prompt_injection
# Reject actions carrying override/injection signatures ("ignore previous", etc).
user action requested $action
if matches_injection_signature($action)
bot refuse action with reason "prompt_injection_detected"
create signed_refusal_receipt($action, "prompt_injection_detected")
else
continue
define flow require_operator_approval_high_impact
# High-consequence actions require a recorded human-on-loop approval event.
user action requested $action
if is_high_impact($action) and not has_operator_approval_event($action)
bot refuse action with reason "operator_approval_required"
create signed_refusal_receipt($action, "operator_approval_required")
else
continue
define flow enforce_payload_ceiling
# Reject oversized payloads (DoS ceiling) before they reach an effector.
user action requested $action
if payload_exceeds_ceiling($action)
bot refuse action with reason "payload_exceeds_1MB"
create signed_refusal_receipt($action, "payload_exceeds_1MB")
else
continue
define flow policy_before_effect
# An effecting tool call MUST be preceded by a policy evaluation in the trace.
user action requested $action
if is_effecting($action) and not policy_evaluated_before($action)
bot refuse action with reason "policy_evaluation_must_precede_effect"
create signed_refusal_receipt($action, "policy_evaluation_must_precede_effect")
else
allow action
create signed_action_receipt($action)
|