--- title: Kong AI Gateway Policies description: An overview of policies that work with Kong AI Gateway. url: "/ai-gateway/policies/" canonical_url: "/ai-gateway/policies/" products: - AI Gateway canonical: true works_on: - konnect --- # Kong AI Gateway Policies ## AI ### AI AWS Guardrails Description: Use AWS Guardrails to validate requests and/or responses before forwarding them between clients and upstream LLMs. Documentation: /ai-gateway/policies/ai-aws-guardrails/ ### AI Azure Content Safety Description: Use Azure AI Content Safety to check and audit messages before proxying them to an upstream LLM Documentation: /ai-gateway/policies/ai-azure-content-safety/ ### AI Custom Guardrail Description: Use a third-party guardrails service to validate requests and/or responses before forwarding them between clients and upstream LLMs Documentation: /ai-gateway/policies/ai-custom-guardrail/ ### AI GCP Model Armor Description: Audit and validate LLM prompts with Google Cloud Model Armor before forwarding them to an upstream LLM. Documentation: /ai-gateway/policies/ai-gcp-model-armor/ ### AI LLM as Judge Description: Score prompt-response pairs with a dedicated LLM to evaluate the accuracy and quality of model responses. Documentation: /ai-gateway/policies/ai-llm-as-judge/ ### AI Lakera Guard Description: Inspect and enforce Lakera Guard safety policies on LLM requests and responses before they reach upstream models. Documentation: /ai-gateway/policies/ai-lakera-guard/ ### AI PII Sanitizer Description: Protect sensitive information in client request or response bodies before they reach upstream services or clients Documentation: /ai-gateway/policies/ai-sanitizer/ ### AI Prompt Compressor Description: Compress prompts with LLMLingua 2 before they reach the upstream LLM to stay within context limits, cut token costs, and reduce latency. Documentation: /ai-gateway/policies/ai-prompt-compressor/ ### AI Prompt Decorator Description: Prepend or append an array of messages to a user's chat history. Documentation: /ai-gateway/policies/ai-prompt-decorator/ ### AI Prompt Guard Description: Check text completion requests against a list of allowed or denied expressions Documentation: /ai-gateway/policies/ai-prompt-guard/ ### AI Prompt Template Description: Provide fill-in-the-blank AI prompts to users Documentation: /ai-gateway/policies/ai-prompt-template/ ### AI RAG Injector Description: Create RAG pipelines by automatically injecting content from a vector database Documentation: /ai-gateway/policies/ai-rag-injector/ ### AI Rate Limiting Advanced Description: Provides rate limiting for the AI plugins. Documentation: /ai-gateway/policies/ai-rate-limiting-advanced/ ### AI Request Transformer Description: Use an LLM service to transform a client request body prior to proxying the request to the upstream server Documentation: /ai-gateway/policies/ai-request-transformer/ ### AI Response Transformer Description: Use an LLM service to transform the upstream HTTP(S) prior to forwarding it to the client Documentation: /ai-gateway/policies/ai-response-transformer/ ### AI Semantic Cache Description: Cache LLM responses based on semantic similarity between requests to reduce latency and cost. Documentation: /ai-gateway/policies/ai-semantic-cache/ ### AI Semantic Prompt Guard Description: Permit or block LLM prompts based on semantic similarity to predefined allow and deny rules. Documentation: /ai-gateway/policies/ai-semantic-prompt-guard/ ### AI Semantic Response Guard Description: Permit or block LLM responses based on semantic similarity to predefined rules for chat, completions, and embeddings requests Documentation: /ai-gateway/policies/ai-semantic-response-guard/ ## Analytics & Monitoring ### AppDynamics Description: Integrate Kong AI Gateway with the AppDynamics APM Platform Documentation: /ai-gateway/policies/app-dynamics/ ### Datadog Description: Visualize metrics on Datadog Documentation: /ai-gateway/policies/datadog/ ### OpenTelemetry Description: Propagate spans and report space to a backend server through OTLP protocol. Documentation: /ai-gateway/policies/opentelemetry/ ### Prometheus Description: Expose metrics related to Kong AI Gateway in Prometheus exposition format Documentation: /ai-gateway/policies/prometheus/ ### StatsD Description: Send metrics to StatsD Documentation: /ai-gateway/policies/statsd/ ### Zipkin Description: Propagate Zipkin spans and report tracing data to a Zipkin server Documentation: /ai-gateway/policies/zipkin/ ## Authentication ### JWE Decrypt Description: Decrypt a JWE token in a request Documentation: /ai-gateway/policies/jwe-decrypt/ ## Logging ### File Log Description: Append request and response data to a log file Documentation: /ai-gateway/policies/file-log/ ### HTTP Log Description: Send request and response logs to an HTTP server Documentation: /ai-gateway/policies/http-log/ ### Kafka Log Description: Publish logs to a Kafka topic. Documentation: /ai-gateway/policies/kafka-log/ ### Loggly Description: Send request and response logs to Loggly Documentation: /ai-gateway/policies/loggly/ ### Solace Log Description: Publish request and response logs to a Solace endpoint or topic Documentation: /ai-gateway/policies/solace-log/ ### Syslog Description: Send request and response logs to Syslog Documentation: /ai-gateway/policies/syslog/ ### TCP Log Description: Send request and response logs to a TCP server Documentation: /ai-gateway/policies/tcp-log/ ### UDP Log Description: Send request and response logs to a UDP server Documentation: /ai-gateway/policies/udp-log/ ## Monetization ### Metering & Billing Description: A licensed add-on through Konnect Metering & Billing. Meter API requests and AI token usage for usage-based billing. Supports flexible customer identification, custom pricing dimensions, and fine-grained traffic filtering. Documentation: /ai-gateway/policies/metering-and-billing/ ## Security ### ACME Description: Let's Encrypt and ACMEv2 integration with Kong AI Gateway Documentation: /ai-gateway/policies/acme/ ### Bot Detection Description: Detect and block bots or custom clients Documentation: /ai-gateway/policies/bot-detection/ ### CORS Description: Configure Cross-Origin Resource Sharing (CORS) so that browser clients on approved origins can call your AI Models, AI Agents, and AI MCP Servers. Documentation: /ai-gateway/policies/cors/ ### IP Restriction Description: Allow or deny IPs that can make requests to your services Documentation: /ai-gateway/policies/ip-restriction/ ### Injection Protection Description: Detect and block injection attacks using regular expressions Documentation: /ai-gateway/policies/injection-protection/ ### JSON Threat Protection Description: Apply size checks on JSON payload and minimize risk of content-level attacks Documentation: /ai-gateway/policies/json-threat-protection/ ### OPA Description: Authorize requests against Open Policy Agent Documentation: /ai-gateway/policies/opa/ ### TLS Handshake Modifier Description: Requests a client to present its client certificate Documentation: /ai-gateway/policies/tls-handshake-modifier/ ### TLS Metadata Headers Description: Proxies TLS client certificate metadata to upstream services via an HTTP headers Documentation: /ai-gateway/policies/tls-metadata-headers/ ## Serverless ### AWS Lambda Description: Invoke and manage AWS Lambda functions from Kong AI Gateway Documentation: /ai-gateway/policies/aws-lambda/ ### Azure Functions Description: Invoke and manage Azure functions from Kong AI Gateway Documentation: /ai-gateway/policies/azure-functions/ ### Post-Function Description: Add and manage custom Lua functions to execute after other plugins Documentation: /ai-gateway/policies/post-function/ ### Pre-Function Description: Add and manage custom Lua functions to run before other plugins Documentation: /ai-gateway/policies/pre-function/ ## Traffic Control ### ACL Description: Control which AI Consumers and AI Consumer Groups can access entities Documentation: /ai-gateway/policies/acl/ ### Canary Release Description: Slowly roll out software changes to a subset of users Documentation: /ai-gateway/policies/canary/ ### Confluent Consume Description: Consume messages from Confluent Cloud Kafka topics and make them available through HTTP endpoints Documentation: /ai-gateway/policies/confluent-consume/ ### Forward Proxy Advanced Description: Allows Kong AI Gateway to connect to intermediary transparent HTTP Documentation: /ai-gateway/policies/forward-proxy/ ### GraphQL Proxy Caching Advanced Description: Cache and serve commonly requested responses in Kong AI Gateway Documentation: /ai-gateway/policies/graphql-proxy-cache-advanced/ ### GraphQL Rate Limiting Advanced Description: Provides rate limiting for GraphQL queries Documentation: /ai-gateway/policies/graphql-rate-limiting-advanced/ ### Kafka Consume Description: Consume messages from Kafka topics and make them available through HTTP endpoints. Documentation: /ai-gateway/policies/kafka-consume/ ### Mocking Description: Provide mock endpoints to test your APIs against your Services Documentation: /ai-gateway/policies/mocking/ ### OAS Validation Description: Validate HTTP requests and responses based on an OpenAPI 3.0 or Swagger API Specification Documentation: /ai-gateway/policies/oas-validation/ ### Proxy Cache Description: Cache and serve commonly requested responses in Kong Documentation: /ai-gateway/policies/proxy-cache/ ### Proxy Caching Advanced Description: Cache and serve commonly requested responses in Kong, in-memory or using Redis Documentation: /ai-gateway/policies/proxy-cache-advanced/ ### Rate Limiting Description: Limit how many HTTP requests can be made in a given period of seconds, minutes, hours, days, months, or years. Documentation: /ai-gateway/policies/rate-limiting/ ### Rate Limiting Advanced Description: Enhanced rate limiting capabilities such as sliding window support, Redis Sentinel support, and increased performance. Documentation: /ai-gateway/policies/rate-limiting-advanced/ ### Redirect Description: Redirect incoming requests to a new URL Documentation: /ai-gateway/policies/redirect/ ### Request Size Limiting Description: Block requests with bodies greater than a specified size. Documentation: /ai-gateway/policies/request-size-limiting/ ### Request Termination Description: Terminates all requests with a specific response Documentation: /ai-gateway/policies/request-termination/ ### Request Validator Description: Validates requests before they reach the upstream service Documentation: /ai-gateway/policies/request-validator/ ### Response Rate Limiting Description: Rate limit based on a custom response header value. Documentation: /ai-gateway/policies/response-ratelimiting/ ### Route By Header Description: Route requests based on specified request headers Documentation: /ai-gateway/policies/route-by-header/ ### Service Protection Description: Prevent abuse and protect services with absolute limits on the number of requests reaching the service Documentation: /ai-gateway/policies/service-protection/ ### Solace Consume Description: Consume messages from Solace topics and make them available through HTTP endpoints Documentation: /ai-gateway/policies/solace-consume/ ### Standard Webhooks Description: Validate that incoming webhooks adhere to the Standard Webhooks specification Documentation: /ai-gateway/policies/standard-webhooks/ ### Upstream Timeout Description: Set custom timeouts on connections to upstream services to override Gateway Service-level timeouts. Documentation: /ai-gateway/policies/upstream-timeout/ ### WebSocket Size Limit Description: Block incoming WebSocket messages greater than a specified size Documentation: /ai-gateway/policies/websocket-size-limit/ ### WebSocket Validator Description: Validate WebSocket messages before they are proxied Documentation: /ai-gateway/policies/websocket-validator/ ### XML Threat Protection Description: Apply structural and size checks on XML payloads Documentation: /ai-gateway/policies/xml-threat-protection/ ## Transformations ### Confluent Description: Transform requests into Kafka messages in a Confluent Kafka topic. Documentation: /ai-gateway/policies/confluent/ ### Correlation ID Description: Correlate requests and responses using a unique ID Documentation: /ai-gateway/policies/correlation-id/ ### Datakit Description: Datakit is a workflow engine for working with external APIs Documentation: /ai-gateway/policies/datakit/ ### DeGraphQL Description: Transform a GraphQL upstream into a REST API Documentation: /ai-gateway/policies/degraphql/ ### Exit Transformer Description: Customize Kong exit responses sent downstream Documentation: /ai-gateway/policies/exit-transformer/ ### Kafka Upstream Description: Transform requests into Kafka messages in a Kafka topic. Documentation: /ai-gateway/policies/kafka-upstream/ ### Request Callout Description: Insert arbitrary API calls before proxying a request to the upstream service. Documentation: /ai-gateway/policies/request-callout/ ### Request Transformer Description: Use regular expressions, variables, and templates to transform requests Documentation: /ai-gateway/policies/request-transformer/ ### Request Transformer Advanced Description: Use powerful regular expressions, variables, and templates to transform API requests Documentation: /ai-gateway/policies/request-transformer-advanced/ ### Response Transformer Description: Modify the upstream response before returning it to the client Documentation: /ai-gateway/policies/response-transformer/ ### Response Transformer Advanced Description: Modify the upstream response before returning it to the client, with greater customization capabilities Documentation: /ai-gateway/policies/response-transformer-advanced/ ### Route Transformer Advanced Description: Transform routing by changing the upstream server, port, or path Documentation: /ai-gateway/policies/route-transformer-advanced/ ### Solace Upstream Description: Transform requests into Solace messages in a Solace queue or topic Documentation: /ai-gateway/policies/solace-upstream/ ### gRPC-Gateway Description: Access gRPC services through HTTP REST Documentation: /ai-gateway/policies/grpc-gateway/ ### gRPC-Web Description: Allow browser clients to call gRPC services Documentation: /ai-gateway/policies/grpc-web/ ### jq Description: Transform JSON objects included in API requests or responses using jq programs Documentation: /ai-gateway/policies/jq/