Block request content in predefined categories
Configure the policy to block request content matching the Hate and Violence categories defined by Azure.
The policy only reviews content in requests by default. To change this, adjust the guarding_mode parameter.
Prerequisites
-
You have an Azure subscription and access to Azure AI Content Safety.
-
An existing AI Model.
Environment variables
-
CONTENT_SAFETY_URL: The full URL of the Azure AI Content Safety instance. -
CONTENT_SAFETY_KEY: The API key to access the Azure AI Content Safety instance.
ai_gateway_policies:
- ref: block-predefined-categories
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: block-predefined-categories
display_name: Block request content in predefined categories
type: ai-azure-content-safety
enabled: true
config:
content_safety_url: !env CONTENT_SAFETY_URL
content_safety_key: !env CONTENT_SAFETY_KEY
categories:
- name: Hate
rejection_level: 2
- name: Violence
rejection_level: 2
global: falseMake sure to replace the following placeholders with your own values:
-
AI_GATEWAY_ID: Theidof your AI Gateway. -
!env CONTENT_SAFETY_URL: The full URL of the Azure AI Content Safety instance. -
!env CONTENT_SAFETY_KEY: The API key to access the Azure AI Content Safety instance.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "block-predefined-categories",
"display_name": "Block request content in predefined categories",
"type": "ai-azure-content-safety",
"enabled": true,
"config": {
"content_safety_url": "'$CONTENT_SAFETY_URL'",
"content_safety_key": "'$CONTENT_SAFETY_KEY'",
"categories": [
{
"name": "Hate",
"rejection_level": 2
},
{
"name": "Violence",
"rejection_level": 2
}
]
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "block-predefined-categories"
display_name = "Block request content in predefined categories"
type = "ai-azure-content-safety"
enabled = true
global = false
config = jsonencode({
content_safety_url = var.content_safety_url
content_safety_key = var.content_safety_key
categories = [
{
name = "Hate"
rejection_level = 2
},
{
name = "Violence"
rejection_level = 2
} ]
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "content_safety_url" {
type = string
}
variable "content_safety_key" {
type = string
}ai_gateway_policies:
- ref: block-predefined-categories
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: block-predefined-categories
display_name: Block request content in predefined categories
type: ai-azure-content-safety
enabled: true
config:
content_safety_url: !env CONTENT_SAFETY_URL
content_safety_key: !env CONTENT_SAFETY_KEY
categories:
- name: Hate
rejection_level: 2
- name: Violence
rejection_level: 2
global: falseMake sure to replace the following placeholders with your own values:
-
AI_GATEWAY_ID: Theidof your AI Gateway. -
!env CONTENT_SAFETY_URL: The full URL of the Azure AI Content Safety instance. -
!env CONTENT_SAFETY_KEY: The API key to access the Azure AI Content Safety instance.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "block-predefined-categories",
"display_name": "Block request content in predefined categories",
"type": "ai-azure-content-safety",
"enabled": true,
"config": {
"content_safety_url": "'$CONTENT_SAFETY_URL'",
"content_safety_key": "'$CONTENT_SAFETY_KEY'",
"categories": [
{
"name": "Hate",
"rejection_level": 2
},
{
"name": "Violence",
"rejection_level": 2
}
]
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "block-predefined-categories"
display_name = "Block request content in predefined categories"
type = "ai-azure-content-safety"
enabled = true
global = false
config = jsonencode({
content_safety_url = var.content_safety_url
content_safety_key = var.content_safety_key
categories = [
{
name = "Hate"
rejection_level = 2
},
{
name = "Violence"
rejection_level = 2
} ]
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "content_safety_url" {
type = string
}
variable "content_safety_key" {
type = string
}ai_gateway_policies:
- ref: block-predefined-categories
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: block-predefined-categories
display_name: Block request content in predefined categories
type: ai-azure-content-safety
enabled: true
config:
content_safety_url: !env CONTENT_SAFETY_URL
content_safety_key: !env CONTENT_SAFETY_KEY
categories:
- name: Hate
rejection_level: 2
- name: Violence
rejection_level: 2
global: falseMake sure to replace the following placeholders with your own values:
-
AI_GATEWAY_ID: Theidof your AI Gateway. -
!env CONTENT_SAFETY_URL: The full URL of the Azure AI Content Safety instance. -
!env CONTENT_SAFETY_KEY: The API key to access the Azure AI Content Safety instance.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "block-predefined-categories",
"display_name": "Block request content in predefined categories",
"type": "ai-azure-content-safety",
"enabled": true,
"config": {
"content_safety_url": "'$CONTENT_SAFETY_URL'",
"content_safety_key": "'$CONTENT_SAFETY_KEY'",
"categories": [
{
"name": "Hate",
"rejection_level": 2
},
{
"name": "Violence",
"rejection_level": 2
}
]
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "block-predefined-categories"
display_name = "Block request content in predefined categories"
type = "ai-azure-content-safety"
enabled = true
global = false
config = jsonencode({
content_safety_url = var.content_safety_url
content_safety_key = var.content_safety_key
categories = [
{
name = "Hate"
rejection_level = 2
},
{
name = "Violence"
rejection_level = 2
} ]
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "content_safety_url" {
type = string
}
variable "content_safety_key" {
type = string
}ai_gateway_policies:
- ref: block-predefined-categories
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: block-predefined-categories
display_name: Block request content in predefined categories
type: ai-azure-content-safety
enabled: true
config:
content_safety_url: !env CONTENT_SAFETY_URL
content_safety_key: !env CONTENT_SAFETY_KEY
categories:
- name: Hate
rejection_level: 2
- name: Violence
rejection_level: 2
global: trueMake sure to replace the following placeholders with your own values:
-
AI_GATEWAY_ID: Theidof your AI Gateway. -
!env CONTENT_SAFETY_URL: The full URL of the Azure AI Content Safety instance. -
!env CONTENT_SAFETY_KEY: The API key to access the Azure AI Content Safety instance.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "block-predefined-categories",
"display_name": "Block request content in predefined categories",
"type": "ai-azure-content-safety",
"enabled": true,
"config": {
"content_safety_url": "'$CONTENT_SAFETY_URL'",
"content_safety_key": "'$CONTENT_SAFETY_KEY'",
"categories": [
{
"name": "Hate",
"rejection_level": 2
},
{
"name": "Violence",
"rejection_level": 2
}
]
},
"global": true
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "block-predefined-categories"
display_name = "Block request content in predefined categories"
type = "ai-azure-content-safety"
enabled = true
global = true
config = jsonencode({
content_safety_url = var.content_safety_url
content_safety_key = var.content_safety_key
categories = [
{
name = "Hate"
rejection_level = 2
},
{
name = "Violence"
rejection_level = 2
} ]
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "content_safety_url" {
type = string
}
variable "content_safety_key" {
type = string
}After creating the policy, add block-predefined-categories to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
ai_gateway_models:
- ref: my-gpt-4o
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: my-gpt-4o
name: my-gpt-4o
type: model
capabilities:
- generate
formats:
- type: openai
targets:
- name: gpt-4o
provider: my-openai-account
config:
type: openai
config:
route:
paths:
- "/v1"
model:
body_param: model
values:
- my-gpt-4o
logging:
payloads: false
policies:
- !ref block-predefined-categories#nameAfter creating the policy, add block-predefined-categories to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/models/my-gpt-4o \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "my-gpt-4o",
"name": "my-gpt-4o",
"type": "model",
"capabilities": [
"generate"
],
"formats": [
{
"type": "openai"
}
],
"policies": [
"block-predefined-categories"
],
"targets": [
{
"name": "gpt-4o",
"provider": "my-openai-account",
"config": {
"type": "openai"
}
}
],
"config": {
"route": {
"paths": [
"/v1"
],
"model": {
"body_param": "model",
"values": [
"my-gpt-4o"
]
}
},
"logging": {
"payloads": false
}
}
}
'After creating the policy, add block-predefined-categories to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
resource "konnect_ai_gateway_model" "my_model" {
display_name = "my-gpt-4o"
name = "my-gpt-4o"
type = "model"
capabilities = ["generate"]
formats = [
{
type = "openai"
} ]
targets = [
{
name = "gpt-4o"
provider = "my-openai-account"
config = {
type = "openai"
}
} ]
config = jsonencode({
route = {
paths = ["/v1"]
model = {
body_param = "model"
values = ["my-gpt-4o"]
}
}
logging = {
payloads = false
}
})
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "content_safety_url" {
type = string
}
variable "content_safety_key" {
type = string
}After creating the policy, add block-predefined-categories to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
ai_gateway_consumers:
- ref: mobile-app-production
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: Mobile App - Production
name: mobile-app-production
type: api-key
policies:
- !ref block-predefined-categories#nameAfter creating the policy, add block-predefined-categories to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumers/mobile-app-production \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "Mobile App - Production",
"name": "mobile-app-production",
"type": "api-key",
"policies": [
"block-predefined-categories"
]
}
'After creating the policy, add block-predefined-categories to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
resource "konnect_ai_gateway_consumer" "my_consumer" {
display_name = "Mobile App - Production"
name = "mobile-app-production"
type = "api-key"
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "content_safety_url" {
type = string
}
variable "content_safety_key" {
type = string
}After creating the policy, add block-predefined-categories to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
ai_gateway_consumer_groups:
- ref: internal-teams
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: Internal Teams
name: internal-teams
policies:
- !ref block-predefined-categories#nameAfter creating the policy, add block-predefined-categories to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumer-groups/internal-teams \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "Internal Teams",
"name": "internal-teams",
"policies": [
"block-predefined-categories"
]
}
'After creating the policy, add block-predefined-categories to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
resource "konnect_ai_gateway_consumer_group" "my_consumer_group" {
display_name = "Internal Teams"
name = "internal-teams"
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "content_safety_url" {
type = string
}
variable "content_safety_key" {
type = string
}