max_window_raised

Raising the temporal look-back cap. The event schema’s default cap on any within window is 24h; a max_window = <interval> directive at the top of the event schema changes it. Here the cap is raised to 30d, which is what lets the policy’s formerly within 7d validate — under the default 24h cap a 7-day window is a max_window validation error.

The event schema is passed with --event-schema event.dwschema; the max_window = 30d line must precede the event declarations.

dogwood validate policy.dw \
  --policy-schema schema.cedarschema \
  --event-schema event.dwschema

See The event schema § Capping the look-back window and Temporal expressions § Intervals and time units.

Policy

// A multi-day look-back: permit a Read only if the same user successfully
// logged in within the last 7 days. A `formerly within 7d` window exceeds the
// 24h default cap, so this policy validates ONLY because the event schema
// raises the cap to 30d (see event.dwschema). Under the default event schema
// this would be a `max_window` validation error.
@id("read_after_recent_login_7d")
permit (
    principal,
    action == Drupe::Action::"Read",
    resource
)
when temporal {
    formerly within 7d Drupe::Action::"Login"::response{
        input.user: context.input.user
    }
};

Schema

namespace Drupe {
  type ContentFilterFinding = {
    severityScore: decimal
  };

  type LoginInput = {
    server: String,
    user: String
  };

  type LoginOutput = {
    result: Bool
  };

  type PromptAttackFinding = {
    severityScore: decimal
  };

  type ReadInput = {
    document: String,
    user: String
  };

  type ReadOutput = {
    result: Bool
  };

  type SensitiveInfoFinding = {
    confidenceScore: decimal
  };

  type SystemContext = {
    now: datetime
  };

  entity Gateway;

  entity IamEntity = {
    id: String
  };

  entity OAuthUser = {
    id: String
  } tags String;

  entity UnauthenticatedUser;

  action "CallTool" in [Action::"Mcp"] appliesTo {
    principal: [OAuthUser, IamEntity, UnauthenticatedUser],
    resource: [Gateway],
    context: {
      system: SystemContext
    }
  };

  action "Http" appliesTo {
    principal: [OAuthUser, IamEntity, UnauthenticatedUser],
    resource: [Gateway],
    context: {
      system: SystemContext
    }
  };

  action "InvokeAgent" in [Action::"Http"] appliesTo {
    principal: [OAuthUser, IamEntity, UnauthenticatedUser],
    resource: [Gateway],
    context: {
      input?: {      },
      system: SystemContext
    }
  };

  action "InvokeLLM" in [Action::"Http"] appliesTo {
    principal: [OAuthUser, IamEntity, UnauthenticatedUser],
    resource: [Gateway],
    context: {
      input?: {      },
      system: SystemContext
    }
  };

  action "Login" in [Action::"CallTool"] appliesTo {
    principal: [IamEntity, OAuthUser, UnauthenticatedUser],
    resource: [Gateway],
    context: {
      input: LoginInput,
      output?: LoginOutput,
      system: SystemContext
    }
  };

  action "Mcp" appliesTo {
    principal: [OAuthUser, IamEntity, UnauthenticatedUser],
    resource: [Gateway],
    context: {
      system: SystemContext
    }
  };

  action "Read" in [Action::"CallTool"] appliesTo {
    principal: [IamEntity, OAuthUser, UnauthenticatedUser],
    resource: [Gateway],
    context: {
      input: ReadInput,
      output?: ReadOutput,
      system: SystemContext
    }
  };

  action "UnknownTool" in [Action::"CallTool"] appliesTo {
    principal: [OAuthUser, IamEntity, UnauthenticatedUser],
    resource: [Gateway],
    context: {
      system: SystemContext
    }
  };
}

Event Schema

// This event schema raises the temporal look-back cap from the 24h default to
// 30 days with a `max_window` directive. Without it, the policy's
// `formerly within 7d` would be a validation error (7d > the 24h default);
// with the cap raised to 30d, a 7d window is well within bounds.
//
// The directive must come first, before any event declaration. The event
// kinds are the conventional request/response convention (the default
// shape), spelled out here only because supplying any `--event-schema` opts
// out of the built-in default.
max_window = 30d

decision event <A>::request {
    ...inputs(A),
    callerPrincipal: principalType(A),
    callerResource:  resourceType(A),
    requestId:       String,
}

event <A>::response {
    ...inputs(A),
    ...outputs(A),
    callerPrincipal: principalType(A),
    callerResource:  resourceType(A),
    requestId:       String,
}