Policy JSON
{
"guard": {
"prompt_injection": {
"enabled": true,
"sensitivity": "high",
"action": "DENY",
"log_attempts": true
},
"pii_detection": {
"enabled": true,
"action": "REDACT",
"patterns": ["EMAIL", "PHONE", "SSN", "CREDIT_CARD", "ADDRESS"],
"redact_in_logs": true
},
"content_moderation": {
"enabled": true,
"threshold": 0.7,
"categories": ["hate", "violence", "sexual", "self_harm"],
"action": "DENY"
}
},
"secrets": {
"enabled": true,
"confidence_threshold": 0.8,
"categories": ["api_keys", "tokens", "passwords", "cloud_secrets"],
"actions": {
"critical": "DENY",
"high": "DENY",
"medium": "REDACT"
}
},
"registry": {
"models": ["gpt-4o", "gpt-4o-mini", "claude-3-sonnet", "claude-3-haiku", "claude-3-5-sonnet"],
"strict": true,
"tools": ["web_search", "file_read", "database_query"],
"deny_unlisted": true,
"verify_provenance": true,
"require_hash": false
},
"memory": {
"default_scope": "session",
"allowed_scopes": ["request", "session"],
"purge_on_session_end": true,
"deny_secrets_in_memory": true,
"deny_pii_in_memory": true
},
"cost": {
"budget": {
"daily": 50.00,
"action_on_exceed": "DENY",
"alert_threshold": 0.8
},
"per_request_limit": 2.00,
"action_on_exceed": "DENY"
},
"reliability": {
"circuit_breaker": {
"failure_threshold": 5,
"reset_timeout_ms": 30000,
"half_open_max_attempts": 1
},
"retry": {
"max_retries": 3,
"backoff": "exponential",
"max_backoff_ms": 5000,
"action_on_exhausted": "DENY"
}
},
"audit": {
"enabled": true,
"log_decisions": true,
"log_evidence": true,
"redact_pii": true,
"retention_days": 365
}
}
policy = {
"guard": {
"prompt_injection": {
"enabled": True,
"sensitivity": "high",
"action": "DENY",
"log_attempts": True,
},
"pii_detection": {
"enabled": True,
"action": "REDACT",
"patterns": ["EMAIL", "PHONE", "SSN", "CREDIT_CARD", "ADDRESS"],
"redact_in_logs": True,
},
"content_moderation": {
"enabled": True,
"threshold": 0.7,
"categories": ["hate", "violence", "sexual", "self_harm"],
"action": "DENY",
},
},
"secrets": {
"enabled": True,
"confidence_threshold": 0.8,
"categories": ["api_keys", "tokens", "passwords", "cloud_secrets"],
"actions": {"critical": "DENY", "high": "DENY", "medium": "REDACT"},
},
"registry": {
"models": ["gpt-4o", "gpt-4o-mini", "claude-3-sonnet", "claude-3-haiku", "claude-3-5-sonnet"],
"strict": True,
"tools": ["web_search", "file_read", "database_query"],
"deny_unlisted": True,
"verify_provenance": True,
"require_hash": False,
},
"memory": {
"default_scope": "session",
"allowed_scopes": ["request", "session"],
"purge_on_session_end": True,
"deny_secrets_in_memory": True,
"deny_pii_in_memory": True,
},
"cost": {
"budget": {"daily": 50.00, "action_on_exceed": "DENY", "alert_threshold": 0.8},
"per_request_limit": 2.00,
"action_on_exceed": "DENY",
},
"reliability": {
"circuit_breaker": {
"failure_threshold": 5,
"reset_timeout_ms": 30000,
"half_open_max_attempts": 1,
},
"retry": {
"max_retries": 3,
"backoff": "exponential",
"max_backoff_ms": 5000,
"action_on_exhausted": "DENY",
},
},
"audit": {
"enabled": True,
"log_decisions": True,
"log_evidence": True,
"redact_pii": True,
"retention_days": 365,
},
}
ASI Coverage Map
| ASI Control | Description | TealEngine Module |
|---|---|---|
| ASI-01 | Prompt Injection | guard.prompt_injection — high sensitivity, DENY |
| ASI-02 | Sensitive Information Disclosure | guard.pii_detection + secrets — REDACT/DENY |
| ASI-03 | Supply Chain Vulnerabilities | registry — model/tool allowlists + provenance |
| ASI-04 | Insecure Output Handling | guard.content_moderation — output scanning |
| ASI-05 | Improper Error Handling | reliability — circuit breaker + retry |
| ASI-06 | Excessive Agency | registry.tools — tool allowlist with deny-by-default |
| ASI-07 | System Prompt Leakage | guard.prompt_injection — blocks extraction attempts |
| ASI-08 | Vector/Embedding Weaknesses | memory — scope restriction + secret denial |
| ASI-09 | Misinformation/Hallucination | audit — evidence logging for review |
| ASI-10 | Unbounded Consumption | cost — daily budget + per-request limits |
Install
# Install the full OWASP ASI pack
tealtiger policy install --pack owasp-asi-starter
# Or copy the JSON above into your tealtiger.config.json
Customize
This pack uses moderate defaults suitable for most applications. Key settings to adjust:| Setting | Default | Adjust For |
|---|---|---|
guard.prompt_injection.sensitivity | high | Lower to medium if seeing false positives |
cost.budget.daily | 50.00 | Match your actual daily budget |
registry.models | 5 models | Add models your application uses |
registry.tools | 3 tools | Add tools your agent needs |
audit.retention_days | 365 | Increase for regulated industries |
Related
- HIPAA Healthcare — Stricter pack for healthcare applications
- SOC 2 Basic — Audit-focused compliance pack
- EU AI Act — High Risk — European regulatory compliance
- OWASP ASI Mapping — Detailed ASI control mapping