AI RAG Injector: RAG injection with ACLs using OpenAI and Redis - Policy

RAG injection with ACLs using OpenAI and Redis

Configure the AI RAG Injector policy with access control lists (ACLs) to restrict which consumer groups can access specific knowledge base collections. This configuration uses Redis as the vector database and OpenAI text-embedding-3-large for embeddings.

The example demonstrates a three-tier access model:

Public documents accessible to all authenticated users
Finance reports restricted to finance and executive groups
Executive confidential content accessible only to executives

Prerequisites

An existing AI Model.
An existing AI Auth Strategy.
Existing AI Consumer Groups that match your ACL configuration.
You have an OpenAI account.
A Redis instance.
Port 6379, or your custom Redis port, is open and reachable from AI Gateway.

Environment variables

OPENAI_API_KEY: The API key to use to connect to OpenAI
REDIS_HOST: The Redis server’s host

Set up the policy

kongctl

policy.yaml

Copied!

ai_gateway_policies:
  - ref: rag-injector-acls
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    name: rag-injector-acls
    display_name: RAG injection with ACLs using OpenAI and Redis
    type: ai-rag-injector
    enabled: true
    config:
      inject_template: |
        Use the following context to answer the question. If the context doesnt contain relevant information, say so.
        Context:
        <CONTEXT>
        Question: <PROMPT>
      inject_as_role: system
      consumer_identifier: consumer_group
      global_acl_config:
        allow:
        - public
        deny: []
      collection_acl_config:
        public-docs:
          allow: []
          deny: []
        finance-reports:
          allow:
          - finance
          - executive
          deny:
          - contractor
        executive-confidential:
          allow:
          - executive
      embeddings:
        auth:
          header_name: Authorization
          header_value: Bearer $OPENAI_API_KEY
        model:
          provider: openai
          name: text-embedding-3-large
      vectordb:
        strategy: redis
        redis:
          host: !env REDIS_HOST
          port: 6379
        distance_metric: cosine
        dimensions: 3072
    global: false

Make sure to replace the following placeholders with your own values:

AI_GATEWAY_ID: The id of your AI Gateway.
!env OPENAI_API_KEY: The API key to use to connect to OpenAI
!env REDIS_HOST: The Redis server’s host

curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "rag-injector-acls",
      "display_name": "RAG injection with ACLs using OpenAI and Redis",
      "type": "ai-rag-injector",
      "enabled": true,
      "config": {
        "inject_template": "Use the following context to answer the question. If the context doesnt contain relevant information, say so.\nContext:\n<CONTEXT>\nQuestion: <PROMPT>\n",
        "inject_as_role": "system",
        "consumer_identifier": "consumer_group",
        "global_acl_config": {
          "allow": [
            "public"
          ],
          "deny": []
        },
        "collection_acl_config": {
          "public-docs": {
            "allow": [],
            "deny": []
          },
          "finance-reports": {
            "allow": [
              "finance",
              "executive"
            ],
            "deny": [
              "contractor"
            ]
          },
          "executive-confidential": {
            "allow": [
              "executive"
            ]
          }
        },
        "embeddings": {
          "auth": {
            "header_name": "Authorization",
            "header_value": "Bearer '$OPENAI_API_KEY'"
          },
          "model": {
            "provider": "openai",
            "name": "text-embedding-3-large"
          }
        },
        "vectordb": {
          "strategy": "redis",
          "redis": {
            "host": "'$REDIS_HOST'",
            "port": 6379
          },
          "distance_metric": "cosine",
          "dimensions": 3072
        }
      },
      "global": false
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
AIGatewayId: The id of the AI Gateway.

See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration:

resource "konnect_ai_gateway_policy" "my_policy" {
  name = "rag-injector-acls"
  display_name = "RAG injection with ACLs using OpenAI and Redis"
  type = "ai-rag-injector"
  enabled = true
  global = false
  config = jsonencode({
    inject_template = <<EOF
Use the following context to answer the question. If the context doesnt contain relevant information, say so.
Context:
<CONTEXT>
Question: <PROMPT>
EOF
    inject_as_role = "system"
    consumer_identifier = "consumer_group"

    global_acl_config = {
      allow = ["public"]
      deny = []
    }

    collection_acl_config = {

      public-docs = {
        allow = []
        deny = []
      }

      finance-reports = {
        allow = ["finance", "executive"]
        deny = ["contractor"]
      }

      executive-confidential = {
        allow = ["executive"]
      }
    }

    embeddings = {

      auth = {
        header_name = "Authorization"
        header_value = "Bearer var.openai_api_key"
      }

      model = {
        provider = "openai"
        name = "text-embedding-3-large"
      }
    }

    vectordb = {
      strategy = "redis"

      redis = {
        host = var.redis_host
        port = 6379
      }
      distance_metric = "cosine"
      dimensions = 3072
    }
  })


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "openai_api_key" {
  type = string
}
variable "redis_host" {
  type = string
}

Copied!

kongctl

policy.yaml

Copied!

ai_gateway_policies:
  - ref: rag-injector-acls
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    name: rag-injector-acls
    display_name: RAG injection with ACLs using OpenAI and Redis
    type: ai-rag-injector
    enabled: true
    config:
      inject_template: |
        Use the following context to answer the question. If the context doesnt contain relevant information, say so.
        Context:
        <CONTEXT>
        Question: <PROMPT>
      inject_as_role: system
      consumer_identifier: consumer_group
      global_acl_config:
        allow:
        - public
        deny: []
      collection_acl_config:
        public-docs:
          allow: []
          deny: []
        finance-reports:
          allow:
          - finance
          - executive
          deny:
          - contractor
        executive-confidential:
          allow:
          - executive
      embeddings:
        auth:
          header_name: Authorization
          header_value: Bearer $OPENAI_API_KEY
        model:
          provider: openai
          name: text-embedding-3-large
      vectordb:
        strategy: redis
        redis:
          host: !env REDIS_HOST
          port: 6379
        distance_metric: cosine
        dimensions: 3072
    global: false

Make sure to replace the following placeholders with your own values:

AI_GATEWAY_ID: The id of your AI Gateway.
!env OPENAI_API_KEY: The API key to use to connect to OpenAI
!env REDIS_HOST: The Redis server’s host

curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "rag-injector-acls",
      "display_name": "RAG injection with ACLs using OpenAI and Redis",
      "type": "ai-rag-injector",
      "enabled": true,
      "config": {
        "inject_template": "Use the following context to answer the question. If the context doesnt contain relevant information, say so.\nContext:\n<CONTEXT>\nQuestion: <PROMPT>\n",
        "inject_as_role": "system",
        "consumer_identifier": "consumer_group",
        "global_acl_config": {
          "allow": [
            "public"
          ],
          "deny": []
        },
        "collection_acl_config": {
          "public-docs": {
            "allow": [],
            "deny": []
          },
          "finance-reports": {
            "allow": [
              "finance",
              "executive"
            ],
            "deny": [
              "contractor"
            ]
          },
          "executive-confidential": {
            "allow": [
              "executive"
            ]
          }
        },
        "embeddings": {
          "auth": {
            "header_name": "Authorization",
            "header_value": "Bearer '$OPENAI_API_KEY'"
          },
          "model": {
            "provider": "openai",
            "name": "text-embedding-3-large"
          }
        },
        "vectordb": {
          "strategy": "redis",
          "redis": {
            "host": "'$REDIS_HOST'",
            "port": 6379
          },
          "distance_metric": "cosine",
          "dimensions": 3072
        }
      },
      "global": false
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
AIGatewayId: The id of the AI Gateway.

See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration:

resource "konnect_ai_gateway_policy" "my_policy" {
  name = "rag-injector-acls"
  display_name = "RAG injection with ACLs using OpenAI and Redis"
  type = "ai-rag-injector"
  enabled = true
  global = false
  config = jsonencode({
    inject_template = <<EOF
Use the following context to answer the question. If the context doesnt contain relevant information, say so.
Context:
<CONTEXT>
Question: <PROMPT>
EOF
    inject_as_role = "system"
    consumer_identifier = "consumer_group"

    global_acl_config = {
      allow = ["public"]
      deny = []
    }

    collection_acl_config = {

      public-docs = {
        allow = []
        deny = []
      }

      finance-reports = {
        allow = ["finance", "executive"]
        deny = ["contractor"]
      }

      executive-confidential = {
        allow = ["executive"]
      }
    }

    embeddings = {

      auth = {
        header_name = "Authorization"
        header_value = "Bearer var.openai_api_key"
      }

      model = {
        provider = "openai"
        name = "text-embedding-3-large"
      }
    }

    vectordb = {
      strategy = "redis"

      redis = {
        host = var.redis_host
        port = 6379
      }
      distance_metric = "cosine"
      dimensions = 3072
    }
  })


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "openai_api_key" {
  type = string
}
variable "redis_host" {
  type = string
}

Copied!

kongctl

policy.yaml

Copied!

ai_gateway_policies:
  - ref: rag-injector-acls
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    name: rag-injector-acls
    display_name: RAG injection with ACLs using OpenAI and Redis
    type: ai-rag-injector
    enabled: true
    config:
      inject_template: |
        Use the following context to answer the question. If the context doesnt contain relevant information, say so.
        Context:
        <CONTEXT>
        Question: <PROMPT>
      inject_as_role: system
      consumer_identifier: consumer_group
      global_acl_config:
        allow:
        - public
        deny: []
      collection_acl_config:
        public-docs:
          allow: []
          deny: []
        finance-reports:
          allow:
          - finance
          - executive
          deny:
          - contractor
        executive-confidential:
          allow:
          - executive
      embeddings:
        auth:
          header_name: Authorization
          header_value: Bearer $OPENAI_API_KEY
        model:
          provider: openai
          name: text-embedding-3-large
      vectordb:
        strategy: redis
        redis:
          host: !env REDIS_HOST
          port: 6379
        distance_metric: cosine
        dimensions: 3072
    global: false

Make sure to replace the following placeholders with your own values:

AI_GATEWAY_ID: The id of your AI Gateway.
!env OPENAI_API_KEY: The API key to use to connect to OpenAI
!env REDIS_HOST: The Redis server’s host

curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "rag-injector-acls",
      "display_name": "RAG injection with ACLs using OpenAI and Redis",
      "type": "ai-rag-injector",
      "enabled": true,
      "config": {
        "inject_template": "Use the following context to answer the question. If the context doesnt contain relevant information, say so.\nContext:\n<CONTEXT>\nQuestion: <PROMPT>\n",
        "inject_as_role": "system",
        "consumer_identifier": "consumer_group",
        "global_acl_config": {
          "allow": [
            "public"
          ],
          "deny": []
        },
        "collection_acl_config": {
          "public-docs": {
            "allow": [],
            "deny": []
          },
          "finance-reports": {
            "allow": [
              "finance",
              "executive"
            ],
            "deny": [
              "contractor"
            ]
          },
          "executive-confidential": {
            "allow": [
              "executive"
            ]
          }
        },
        "embeddings": {
          "auth": {
            "header_name": "Authorization",
            "header_value": "Bearer '$OPENAI_API_KEY'"
          },
          "model": {
            "provider": "openai",
            "name": "text-embedding-3-large"
          }
        },
        "vectordb": {
          "strategy": "redis",
          "redis": {
            "host": "'$REDIS_HOST'",
            "port": 6379
          },
          "distance_metric": "cosine",
          "dimensions": 3072
        }
      },
      "global": false
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
AIGatewayId: The id of the AI Gateway.

See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration:

resource "konnect_ai_gateway_policy" "my_policy" {
  name = "rag-injector-acls"
  display_name = "RAG injection with ACLs using OpenAI and Redis"
  type = "ai-rag-injector"
  enabled = true
  global = false
  config = jsonencode({
    inject_template = <<EOF
Use the following context to answer the question. If the context doesnt contain relevant information, say so.
Context:
<CONTEXT>
Question: <PROMPT>
EOF
    inject_as_role = "system"
    consumer_identifier = "consumer_group"

    global_acl_config = {
      allow = ["public"]
      deny = []
    }

    collection_acl_config = {

      public-docs = {
        allow = []
        deny = []
      }

      finance-reports = {
        allow = ["finance", "executive"]
        deny = ["contractor"]
      }

      executive-confidential = {
        allow = ["executive"]
      }
    }

    embeddings = {

      auth = {
        header_name = "Authorization"
        header_value = "Bearer var.openai_api_key"
      }

      model = {
        provider = "openai"
        name = "text-embedding-3-large"
      }
    }

    vectordb = {
      strategy = "redis"

      redis = {
        host = var.redis_host
        port = 6379
      }
      distance_metric = "cosine"
      dimensions = 3072
    }
  })


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "openai_api_key" {
  type = string
}
variable "redis_host" {
  type = string
}

Copied!

kongctl

policy.yaml

Copied!

ai_gateway_policies:
  - ref: rag-injector-acls
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    name: rag-injector-acls
    display_name: RAG injection with ACLs using OpenAI and Redis
    type: ai-rag-injector
    enabled: true
    config:
      inject_template: |
        Use the following context to answer the question. If the context doesnt contain relevant information, say so.
        Context:
        <CONTEXT>
        Question: <PROMPT>
      inject_as_role: system
      consumer_identifier: consumer_group
      global_acl_config:
        allow:
        - public
        deny: []
      collection_acl_config:
        public-docs:
          allow: []
          deny: []
        finance-reports:
          allow:
          - finance
          - executive
          deny:
          - contractor
        executive-confidential:
          allow:
          - executive
      embeddings:
        auth:
          header_name: Authorization
          header_value: Bearer $OPENAI_API_KEY
        model:
          provider: openai
          name: text-embedding-3-large
      vectordb:
        strategy: redis
        redis:
          host: !env REDIS_HOST
          port: 6379
        distance_metric: cosine
        dimensions: 3072
    global: true

Make sure to replace the following placeholders with your own values:

AI_GATEWAY_ID: The id of your AI Gateway.
!env OPENAI_API_KEY: The API key to use to connect to OpenAI
!env REDIS_HOST: The Redis server’s host

curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "rag-injector-acls",
      "display_name": "RAG injection with ACLs using OpenAI and Redis",
      "type": "ai-rag-injector",
      "enabled": true,
      "config": {
        "inject_template": "Use the following context to answer the question. If the context doesnt contain relevant information, say so.\nContext:\n<CONTEXT>\nQuestion: <PROMPT>\n",
        "inject_as_role": "system",
        "consumer_identifier": "consumer_group",
        "global_acl_config": {
          "allow": [
            "public"
          ],
          "deny": []
        },
        "collection_acl_config": {
          "public-docs": {
            "allow": [],
            "deny": []
          },
          "finance-reports": {
            "allow": [
              "finance",
              "executive"
            ],
            "deny": [
              "contractor"
            ]
          },
          "executive-confidential": {
            "allow": [
              "executive"
            ]
          }
        },
        "embeddings": {
          "auth": {
            "header_name": "Authorization",
            "header_value": "Bearer '$OPENAI_API_KEY'"
          },
          "model": {
            "provider": "openai",
            "name": "text-embedding-3-large"
          }
        },
        "vectordb": {
          "strategy": "redis",
          "redis": {
            "host": "'$REDIS_HOST'",
            "port": 6379
          },
          "distance_metric": "cosine",
          "dimensions": 3072
        }
      },
      "global": true
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
AIGatewayId: The id of the AI Gateway.

See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration:

resource "konnect_ai_gateway_policy" "my_policy" {
  name = "rag-injector-acls"
  display_name = "RAG injection with ACLs using OpenAI and Redis"
  type = "ai-rag-injector"
  enabled = true
  global = true
  config = jsonencode({
    inject_template = <<EOF
Use the following context to answer the question. If the context doesnt contain relevant information, say so.
Context:
<CONTEXT>
Question: <PROMPT>
EOF
    inject_as_role = "system"
    consumer_identifier = "consumer_group"

    global_acl_config = {
      allow = ["public"]
      deny = []
    }

    collection_acl_config = {

      public-docs = {
        allow = []
        deny = []
      }

      finance-reports = {
        allow = ["finance", "executive"]
        deny = ["contractor"]
      }

      executive-confidential = {
        allow = ["executive"]
      }
    }

    embeddings = {

      auth = {
        header_name = "Authorization"
        header_value = "Bearer var.openai_api_key"
      }

      model = {
        provider = "openai"
        name = "text-embedding-3-large"
      }
    }

    vectordb = {
      strategy = "redis"

      redis = {
        host = var.redis_host
        port = 6379
      }
      distance_metric = "cosine"
      dimensions = 3072
    }
  })


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "openai_api_key" {
  type = string
}
variable "redis_host" {
  type = string
}

Copied!

Attach the policy

After creating the policy, add rag-injector-acls to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.

kongctl

model.yaml

Copied!

ai_gateway_models:
  - ref: my-gpt-4o
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    display_name: my-gpt-4o
    name: my-gpt-4o
    type: model
    capabilities:
    - generate
    formats:
    - type: openai
    targets:
    - name: gpt-4o
      provider: my-openai-account
      config:
        type: openai
    config:
      route:
        paths:
        - "/v1"
        model:
          body_param: model
          values:
          - my-gpt-4o
      logging:
        payloads: false
    policies:
    - !ref rag-injector-acls#name

After creating the policy, add rag-injector-acls to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.

curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/models/my-gpt-4o \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "display_name": "my-gpt-4o",
      "name": "my-gpt-4o",
      "type": "model",
      "capabilities": [
        "generate"
      ],
      "formats": [
        {
          "type": "openai"
        }
      ],
      "policies": [
        "rag-injector-acls"
      ],
      "targets": [
        {
          "name": "gpt-4o",
          "provider": "my-openai-account",
          "config": {
            "type": "openai"
          }
        }
      ],
      "config": {
        "route": {
          "paths": [
            "/v1"
          ],
          "model": {
            "body_param": "model",
            "values": [
              "my-gpt-4o"
            ]
          }
        },
        "logging": {
          "payloads": false
        }
      }
    }
    '

Copied!

After creating the policy, add rag-injector-acls to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.

resource "konnect_ai_gateway_model" "my_model" {
  display_name = "my-gpt-4o"
  name = "my-gpt-4o"
  type = "model"
  capabilities = ["generate"]
  formats = [
    {
      type = "openai"
    }  ]
  targets = [
    {
      name = "gpt-4o"
      provider = "my-openai-account"

      config = {
        type = "openai"
      }
    }  ]
  config = jsonencode({

    route = {
      paths = ["/v1"]

      model = {
        body_param = "model"
        values = ["my-gpt-4o"]
      }
    }

    logging = {
      payloads = false
    }
  })
  policies = [konnect_ai_gateway_policy.my_policy.name]


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "openai_api_key" {
  type = string
}
variable "redis_host" {
  type = string
}

Copied!

After creating the policy, add rag-injector-acls to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.

kongctl

consumer.yaml

Copied!

ai_gateway_consumers:
  - ref: mobile-app-production
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    display_name: Mobile App - Production
    name: mobile-app-production
    type: api-key
    policies:
    - !ref rag-injector-acls#name

After creating the policy, add rag-injector-acls to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.

curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumers/mobile-app-production \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "display_name": "Mobile App - Production",
      "name": "mobile-app-production",
      "type": "api-key",
      "policies": [
        "rag-injector-acls"
      ]
    }
    '

Copied!

After creating the policy, add rag-injector-acls to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.

resource "konnect_ai_gateway_consumer" "my_consumer" {
  display_name = "Mobile App - Production"
  name = "mobile-app-production"
  type = "api-key"
  policies = [konnect_ai_gateway_policy.my_policy.name]


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "openai_api_key" {
  type = string
}
variable "redis_host" {
  type = string
}

Copied!

After creating the policy, add rag-injector-acls to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.

kongctl

consumer_group.yaml

Copied!

ai_gateway_consumer_groups:
  - ref: internal-teams
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    display_name: Internal Teams
    name: internal-teams
    policies:
    - !ref rag-injector-acls#name

After creating the policy, add rag-injector-acls to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.

curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumer-groups/internal-teams \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "display_name": "Internal Teams",
      "name": "internal-teams",
      "policies": [
        "rag-injector-acls"
      ]
    }
    '

Copied!

After creating the policy, add rag-injector-acls to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.

resource "konnect_ai_gateway_consumer_group" "my_consumer_group" {
  display_name = "Internal Teams"
  name = "internal-teams"
  policies = [konnect_ai_gateway_policy.my_policy.name]


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "openai_api_key" {
  type = string
}
variable "redis_host" {
  type = string
}

Copied!

AI RAG Injector Policy

RAG injection with ACLs using OpenAI and Redis

Prerequisites

Environment variables

Set up the policy

Attach the policy

Help us make these docs great!

Still need help?