Only allow messages about a specific topic
Only allow messages about a specific topic. For example, only allow messages about DevOps.
If you use the
text-embedding-ada-002as an embedding model, you must set a fixed dimension of1536, as required by the official model specification. Alternatively, use thetext-embedding-3-smallmodel, which supports dynamic dimensions and works without specifying a fixed value.
Prerequisites
-
An existing AI Model.
-
A Redis instance.
-
Port
6379, or your custom Redis port, is open and reachable from AI Gateway.
Environment variables
-
OPENAI_API_KEY: Your OpenAI API key -
REDIS_HOST: The host where your Redis instance runs
ai_gateway_policies:
- ref: allow-prompts
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: allow-prompts
display_name: Only allow messages about a specific topic
type: ai-semantic-prompt-guard
enabled: true
config:
embeddings:
auth:
header_name: Authorization
header_value: Bearer $OPENAI_API_KEY
model:
name: text-embedding-3-small
provider: openai
search:
threshold: 0.7
vectordb:
strategy: redis
distance_metric: cosine
threshold: 0.5
dimensions: 1024
redis:
host: !env REDIS_HOST
port: 6379
rules:
match_all_conversation_history: true
allow_prompts:
- Network troubleshooting and diagnostics
- Cloud infrastructure management (AWS, Azure, GCP)
- Cybersecurity best practices and incident response
- DevOps workflows and automation
- Programming concepts and language usage
- IT policy and compliance guidance
- Software development lifecycle and CI/CD
- Documentation writing and technical explanation
- System administration and configuration
- Productivity and collaboration tools usage
global: falseMake sure to replace the following placeholders with your own values:
-
AI_GATEWAY_ID: Theidof your AI Gateway. -
!env OPENAI_API_KEY: Your OpenAI API key -
!env REDIS_HOST: The host where your Redis instance runs
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "allow-prompts",
"display_name": "Only allow messages about a specific topic",
"type": "ai-semantic-prompt-guard",
"enabled": true,
"config": {
"embeddings": {
"auth": {
"header_name": "Authorization",
"header_value": "Bearer '$OPENAI_API_KEY'"
},
"model": {
"name": "text-embedding-3-small",
"provider": "openai"
}
},
"search": {
"threshold": 0.7
},
"vectordb": {
"strategy": "redis",
"distance_metric": "cosine",
"threshold": 0.5,
"dimensions": 1024,
"redis": {
"host": "'$REDIS_HOST'",
"port": 6379
}
},
"rules": {
"match_all_conversation_history": true,
"allow_prompts": [
"Network troubleshooting and diagnostics",
"Cloud infrastructure management (AWS, Azure, GCP)",
"Cybersecurity best practices and incident response",
"DevOps workflows and automation",
"Programming concepts and language usage",
"IT policy and compliance guidance",
"Software development lifecycle and CI/CD",
"Documentation writing and technical explanation",
"System administration and configuration",
"Productivity and collaboration tools usage"
]
}
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "allow-prompts"
display_name = "Only allow messages about a specific topic"
type = "ai-semantic-prompt-guard"
enabled = true
global = false
config = jsonencode({
embeddings = {
auth = {
header_name = "Authorization"
header_value = "Bearer var.openai_api_key"
}
model = {
name = "text-embedding-3-small"
provider = "openai"
}
}
search = {
threshold = 0.7
}
vectordb = {
strategy = "redis"
distance_metric = "cosine"
threshold = 0.5
dimensions = 1024
redis = {
host = var.redis_host
port = 6379
}
}
rules = {
match_all_conversation_history = true
allow_prompts = ["Network troubleshooting and diagnostics", "Cloud infrastructure management (AWS, Azure, GCP)", "Cybersecurity best practices and incident response", "DevOps workflows and automation", "Programming concepts and language usage", "IT policy and compliance guidance", "Software development lifecycle and CI/CD", "Documentation writing and technical explanation", "System administration and configuration", "Productivity and collaboration tools usage"]
}
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "openai_api_key" {
type = string
}
variable "redis_host" {
type = string
}ai_gateway_policies:
- ref: allow-prompts
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: allow-prompts
display_name: Only allow messages about a specific topic
type: ai-semantic-prompt-guard
enabled: true
config:
embeddings:
auth:
header_name: Authorization
header_value: Bearer $OPENAI_API_KEY
model:
name: text-embedding-3-small
provider: openai
search:
threshold: 0.7
vectordb:
strategy: redis
distance_metric: cosine
threshold: 0.5
dimensions: 1024
redis:
host: !env REDIS_HOST
port: 6379
rules:
match_all_conversation_history: true
allow_prompts:
- Network troubleshooting and diagnostics
- Cloud infrastructure management (AWS, Azure, GCP)
- Cybersecurity best practices and incident response
- DevOps workflows and automation
- Programming concepts and language usage
- IT policy and compliance guidance
- Software development lifecycle and CI/CD
- Documentation writing and technical explanation
- System administration and configuration
- Productivity and collaboration tools usage
global: falseMake sure to replace the following placeholders with your own values:
-
AI_GATEWAY_ID: Theidof your AI Gateway. -
!env OPENAI_API_KEY: Your OpenAI API key -
!env REDIS_HOST: The host where your Redis instance runs
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "allow-prompts",
"display_name": "Only allow messages about a specific topic",
"type": "ai-semantic-prompt-guard",
"enabled": true,
"config": {
"embeddings": {
"auth": {
"header_name": "Authorization",
"header_value": "Bearer '$OPENAI_API_KEY'"
},
"model": {
"name": "text-embedding-3-small",
"provider": "openai"
}
},
"search": {
"threshold": 0.7
},
"vectordb": {
"strategy": "redis",
"distance_metric": "cosine",
"threshold": 0.5,
"dimensions": 1024,
"redis": {
"host": "'$REDIS_HOST'",
"port": 6379
}
},
"rules": {
"match_all_conversation_history": true,
"allow_prompts": [
"Network troubleshooting and diagnostics",
"Cloud infrastructure management (AWS, Azure, GCP)",
"Cybersecurity best practices and incident response",
"DevOps workflows and automation",
"Programming concepts and language usage",
"IT policy and compliance guidance",
"Software development lifecycle and CI/CD",
"Documentation writing and technical explanation",
"System administration and configuration",
"Productivity and collaboration tools usage"
]
}
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "allow-prompts"
display_name = "Only allow messages about a specific topic"
type = "ai-semantic-prompt-guard"
enabled = true
global = false
config = jsonencode({
embeddings = {
auth = {
header_name = "Authorization"
header_value = "Bearer var.openai_api_key"
}
model = {
name = "text-embedding-3-small"
provider = "openai"
}
}
search = {
threshold = 0.7
}
vectordb = {
strategy = "redis"
distance_metric = "cosine"
threshold = 0.5
dimensions = 1024
redis = {
host = var.redis_host
port = 6379
}
}
rules = {
match_all_conversation_history = true
allow_prompts = ["Network troubleshooting and diagnostics", "Cloud infrastructure management (AWS, Azure, GCP)", "Cybersecurity best practices and incident response", "DevOps workflows and automation", "Programming concepts and language usage", "IT policy and compliance guidance", "Software development lifecycle and CI/CD", "Documentation writing and technical explanation", "System administration and configuration", "Productivity and collaboration tools usage"]
}
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "openai_api_key" {
type = string
}
variable "redis_host" {
type = string
}ai_gateway_policies:
- ref: allow-prompts
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: allow-prompts
display_name: Only allow messages about a specific topic
type: ai-semantic-prompt-guard
enabled: true
config:
embeddings:
auth:
header_name: Authorization
header_value: Bearer $OPENAI_API_KEY
model:
name: text-embedding-3-small
provider: openai
search:
threshold: 0.7
vectordb:
strategy: redis
distance_metric: cosine
threshold: 0.5
dimensions: 1024
redis:
host: !env REDIS_HOST
port: 6379
rules:
match_all_conversation_history: true
allow_prompts:
- Network troubleshooting and diagnostics
- Cloud infrastructure management (AWS, Azure, GCP)
- Cybersecurity best practices and incident response
- DevOps workflows and automation
- Programming concepts and language usage
- IT policy and compliance guidance
- Software development lifecycle and CI/CD
- Documentation writing and technical explanation
- System administration and configuration
- Productivity and collaboration tools usage
global: falseMake sure to replace the following placeholders with your own values:
-
AI_GATEWAY_ID: Theidof your AI Gateway. -
!env OPENAI_API_KEY: Your OpenAI API key -
!env REDIS_HOST: The host where your Redis instance runs
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "allow-prompts",
"display_name": "Only allow messages about a specific topic",
"type": "ai-semantic-prompt-guard",
"enabled": true,
"config": {
"embeddings": {
"auth": {
"header_name": "Authorization",
"header_value": "Bearer '$OPENAI_API_KEY'"
},
"model": {
"name": "text-embedding-3-small",
"provider": "openai"
}
},
"search": {
"threshold": 0.7
},
"vectordb": {
"strategy": "redis",
"distance_metric": "cosine",
"threshold": 0.5,
"dimensions": 1024,
"redis": {
"host": "'$REDIS_HOST'",
"port": 6379
}
},
"rules": {
"match_all_conversation_history": true,
"allow_prompts": [
"Network troubleshooting and diagnostics",
"Cloud infrastructure management (AWS, Azure, GCP)",
"Cybersecurity best practices and incident response",
"DevOps workflows and automation",
"Programming concepts and language usage",
"IT policy and compliance guidance",
"Software development lifecycle and CI/CD",
"Documentation writing and technical explanation",
"System administration and configuration",
"Productivity and collaboration tools usage"
]
}
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "allow-prompts"
display_name = "Only allow messages about a specific topic"
type = "ai-semantic-prompt-guard"
enabled = true
global = false
config = jsonencode({
embeddings = {
auth = {
header_name = "Authorization"
header_value = "Bearer var.openai_api_key"
}
model = {
name = "text-embedding-3-small"
provider = "openai"
}
}
search = {
threshold = 0.7
}
vectordb = {
strategy = "redis"
distance_metric = "cosine"
threshold = 0.5
dimensions = 1024
redis = {
host = var.redis_host
port = 6379
}
}
rules = {
match_all_conversation_history = true
allow_prompts = ["Network troubleshooting and diagnostics", "Cloud infrastructure management (AWS, Azure, GCP)", "Cybersecurity best practices and incident response", "DevOps workflows and automation", "Programming concepts and language usage", "IT policy and compliance guidance", "Software development lifecycle and CI/CD", "Documentation writing and technical explanation", "System administration and configuration", "Productivity and collaboration tools usage"]
}
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "openai_api_key" {
type = string
}
variable "redis_host" {
type = string
}ai_gateway_policies:
- ref: allow-prompts
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: allow-prompts
display_name: Only allow messages about a specific topic
type: ai-semantic-prompt-guard
enabled: true
config:
embeddings:
auth:
header_name: Authorization
header_value: Bearer $OPENAI_API_KEY
model:
name: text-embedding-3-small
provider: openai
search:
threshold: 0.7
vectordb:
strategy: redis
distance_metric: cosine
threshold: 0.5
dimensions: 1024
redis:
host: !env REDIS_HOST
port: 6379
rules:
match_all_conversation_history: true
allow_prompts:
- Network troubleshooting and diagnostics
- Cloud infrastructure management (AWS, Azure, GCP)
- Cybersecurity best practices and incident response
- DevOps workflows and automation
- Programming concepts and language usage
- IT policy and compliance guidance
- Software development lifecycle and CI/CD
- Documentation writing and technical explanation
- System administration and configuration
- Productivity and collaboration tools usage
global: trueMake sure to replace the following placeholders with your own values:
-
AI_GATEWAY_ID: Theidof your AI Gateway. -
!env OPENAI_API_KEY: Your OpenAI API key -
!env REDIS_HOST: The host where your Redis instance runs
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "allow-prompts",
"display_name": "Only allow messages about a specific topic",
"type": "ai-semantic-prompt-guard",
"enabled": true,
"config": {
"embeddings": {
"auth": {
"header_name": "Authorization",
"header_value": "Bearer '$OPENAI_API_KEY'"
},
"model": {
"name": "text-embedding-3-small",
"provider": "openai"
}
},
"search": {
"threshold": 0.7
},
"vectordb": {
"strategy": "redis",
"distance_metric": "cosine",
"threshold": 0.5,
"dimensions": 1024,
"redis": {
"host": "'$REDIS_HOST'",
"port": 6379
}
},
"rules": {
"match_all_conversation_history": true,
"allow_prompts": [
"Network troubleshooting and diagnostics",
"Cloud infrastructure management (AWS, Azure, GCP)",
"Cybersecurity best practices and incident response",
"DevOps workflows and automation",
"Programming concepts and language usage",
"IT policy and compliance guidance",
"Software development lifecycle and CI/CD",
"Documentation writing and technical explanation",
"System administration and configuration",
"Productivity and collaboration tools usage"
]
}
},
"global": true
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "allow-prompts"
display_name = "Only allow messages about a specific topic"
type = "ai-semantic-prompt-guard"
enabled = true
global = true
config = jsonencode({
embeddings = {
auth = {
header_name = "Authorization"
header_value = "Bearer var.openai_api_key"
}
model = {
name = "text-embedding-3-small"
provider = "openai"
}
}
search = {
threshold = 0.7
}
vectordb = {
strategy = "redis"
distance_metric = "cosine"
threshold = 0.5
dimensions = 1024
redis = {
host = var.redis_host
port = 6379
}
}
rules = {
match_all_conversation_history = true
allow_prompts = ["Network troubleshooting and diagnostics", "Cloud infrastructure management (AWS, Azure, GCP)", "Cybersecurity best practices and incident response", "DevOps workflows and automation", "Programming concepts and language usage", "IT policy and compliance guidance", "Software development lifecycle and CI/CD", "Documentation writing and technical explanation", "System administration and configuration", "Productivity and collaboration tools usage"]
}
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "openai_api_key" {
type = string
}
variable "redis_host" {
type = string
}After creating the policy, add allow-prompts to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
ai_gateway_models:
- ref: my-gpt-4o
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: my-gpt-4o
name: my-gpt-4o
type: model
capabilities:
- generate
formats:
- type: openai
targets:
- name: gpt-4o
provider: my-openai-account
config:
type: openai
config:
route:
paths:
- "/v1"
model:
body_param: model
values:
- my-gpt-4o
logging:
payloads: false
policies:
- !ref allow-prompts#nameAfter creating the policy, add allow-prompts to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/models/my-gpt-4o \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "my-gpt-4o",
"name": "my-gpt-4o",
"type": "model",
"capabilities": [
"generate"
],
"formats": [
{
"type": "openai"
}
],
"policies": [
"allow-prompts"
],
"targets": [
{
"name": "gpt-4o",
"provider": "my-openai-account",
"config": {
"type": "openai"
}
}
],
"config": {
"route": {
"paths": [
"/v1"
],
"model": {
"body_param": "model",
"values": [
"my-gpt-4o"
]
}
},
"logging": {
"payloads": false
}
}
}
'After creating the policy, add allow-prompts to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
resource "konnect_ai_gateway_model" "my_model" {
display_name = "my-gpt-4o"
name = "my-gpt-4o"
type = "model"
capabilities = ["generate"]
formats = [
{
type = "openai"
} ]
targets = [
{
name = "gpt-4o"
provider = "my-openai-account"
config = {
type = "openai"
}
} ]
config = jsonencode({
route = {
paths = ["/v1"]
model = {
body_param = "model"
values = ["my-gpt-4o"]
}
}
logging = {
payloads = false
}
})
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "openai_api_key" {
type = string
}
variable "redis_host" {
type = string
}After creating the policy, add allow-prompts to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
ai_gateway_consumers:
- ref: mobile-app-production
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: Mobile App - Production
name: mobile-app-production
type: api-key
policies:
- !ref allow-prompts#nameAfter creating the policy, add allow-prompts to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumers/mobile-app-production \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "Mobile App - Production",
"name": "mobile-app-production",
"type": "api-key",
"policies": [
"allow-prompts"
]
}
'After creating the policy, add allow-prompts to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
resource "konnect_ai_gateway_consumer" "my_consumer" {
display_name = "Mobile App - Production"
name = "mobile-app-production"
type = "api-key"
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "openai_api_key" {
type = string
}
variable "redis_host" {
type = string
}After creating the policy, add allow-prompts to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
ai_gateway_consumer_groups:
- ref: internal-teams
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: Internal Teams
name: internal-teams
policies:
- !ref allow-prompts#nameAfter creating the policy, add allow-prompts to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumer-groups/internal-teams \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "Internal Teams",
"name": "internal-teams",
"policies": [
"allow-prompts"
]
}
'After creating the policy, add allow-prompts to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
resource "konnect_ai_gateway_consumer_group" "my_consumer_group" {
display_name = "Internal Teams"
name = "internal-teams"
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "openai_api_key" {
type = string
}
variable "redis_host" {
type = string
}