| """What the new policy will actually change, given how CLOAK combines policies. |
| |
| Endpoint (modules/pii/resolvePolicy.ts, modules/agent/routes.ts): |
| - AI prompt part (action, detection rules, AI sites, upload/paste, test mode): a group with its own |
| active policies uses only those; the org-wide prompt rules stop applying to it |
| - device and browser controls (agentControl, the agent's extensionControl): folded across org-wide AND |
| group policies, any "on" wins, so org-wide controls keep applying to every group |
| - within the prompt set in force, ONE action applies to every rule: the strictest one wins |
| Channels (pickChannelPolicy): one active policy per channel applies, the newest; it does not merge. |
| Email: one active email policy per provider (Gmail, Outlook / Microsoft 365). |
| """ |
| from __future__ import annotations |
|
|
| from .model import Draft |
| from .platform import catalog |
| from .platform.context import PlatformContext |
|
|
| PROVIDER_LABEL = {'google': 'Gmail', 'm365': 'Outlook / Microsoft 365'} |
|
|
|
|
| def assess(d: Draft, ctx: PlatformContext) -> None: |
| body = d.policyBody |
| if body is None: |
| return |
| d.issue('CREATED_INACTIVE', 'info', 'The policy is proposed switched off. Review it, then turn it on.') |
| if not ctx.policiesKnown: |
| return |
| if d.policyType == 'endpoint': |
| _endpoint(d, body, ctx) |
| elif d.policyType == 'email': |
| provider = body['channels']['email'].get('provider') or 'google' |
| active = [p for p in ctx.policies if p.type == 'email' and (p.provider or 'google') == provider] |
| if active: |
| label = PROVIDER_LABEL.get(provider, provider) |
| d.issue('ONE_ACTIVE_EMAIL_POLICY', 'warning', |
| f'"{active[0].name}" is the active {label} email policy, and only one per provider can be active. ' |
| f'To use this one, turn that one off first.', policy=active[0].name, provider=provider) |
| else: |
| _channel(d, body, ctx) |
|
|
|
|
| def _endpoint(d: Draft, body: dict, ctx: PlatformContext) -> None: |
| rank = catalog.action_rank() |
| gid = body['groupId'] |
| endpoint = [p for p in ctx.policies if p.type == 'endpoint'] |
| org = [p for p in endpoint if p.groupId == 'default'] |
| own = [p for p in endpoint if p.groupId == gid and gid != 'default'] |
|
|
| if gid != 'default': |
| name = ctx.group(gid).name if ctx.group(gid) else gid |
| if not own and org: |
| pl = 'y' if len(org) == 1 else 'ies' |
| msg = (f'Once this policy is on, AI prompts from {name} are checked only by policies for {name}, so the ' |
| f'AI prompt rules of the org-wide polic{pl} ({", ".join(p.name for p in org[:3])}) stop applying ' |
| f'to {name}.') |
| if not _has_prompt_part(body): |
| msg += f' This policy checks no prompts itself, so AI prompts from {name} would only be logged.' |
| msg += (f' Device and browser controls from the org-wide polic{pl} (USB, printing, block lists and ' |
| f'the rest) still apply to {name}.') |
| d.issue('GROUP_REPLACES_ORG_WIDE', 'warning', msg, group=name, orgWide=[p.name for p in org]) |
| else: |
| groups = sorted({p.groupId for p in endpoint if p.groupId != 'default'}) |
| if groups and _has_prompt_part(body): |
| names = [ctx.group(g).name if ctx.group(g) else g for g in groups] |
| d.issue('ORG_WIDE_SKIPS_GROUPS', 'warning', |
| f'Groups with their own policies ({", ".join(names)}) keep their own AI prompt rules, so this ' |
| f'policy\'s prompt checks do not reach them. Its device and browser controls apply to them too.', |
| groups=names) |
|
|
| uses_action = bool(body['extensionControl']['detectionRuleIds']) |
| if not uses_action: |
| return |
| if gid != 'default' and not own: |
| return |
| scope = own if gid != 'default' else org |
| if not scope: |
| return |
| new = rank.get(body['action'], 0) |
| strictest = max(scope, key=lambda p: rank.get(p.action, 0)) |
| if rank.get(strictest.action, 0) > new: |
| d.issue('STRICTER_ACTION_ACTIVE', 'warning', |
| f'"{strictest.name}" is already active with "{strictest.action}". One action applies to all rules ' |
| f'and the strictest wins, so this policy will also "{strictest.action}", not "{body["action"]}".', |
| policy=strictest.name, action=strictest.action) |
| elif rank.get(strictest.action, 0) < new: |
| d.issue('ACTION_RAISES_OTHERS', 'warning', |
| f'One action applies to every rule in force and the strictest wins: once this is on, matches of the ' |
| f'other active policies ({", ".join(p.name for p in scope[:3])}) will also "{body["action"]}".', |
| action=body['action']) |
|
|
|
|
| def _has_prompt_part(body: dict) -> bool: |
| """Whether the policy sets anything the group-replaces-org-wide rule applies to.""" |
| return bool(body['extensionControl']['detectionRuleIds']) or body['allowFileUpload'] is False \ |
| or body['allowCodePaste'] is False or body['action'] != 'log' |
|
|
|
|
| def _channel(d: Draft, body: dict, ctx: PlatformContext) -> None: |
| cfg = body['channels'][d.policyType] |
| mine = set(cfg.get('connectorIds') or []) |
| for p in ctx.policies: |
| if p.type != d.policyType: |
| continue |
| theirs = set(p.connectorIds) |
| if not mine or not theirs or mine & theirs: |
| d.issue('CHANNEL_POLICY_REPLACED', 'warning', |
| f'"{p.name}" is the active {catalog.TYPE_LABEL[d.policyType]} policy. Only one applies at a time ' |
| f'(the newest), so turning this on replaces it rather than adding to it.', policy=p.name) |
| return |
|
|
