AI Semantic Response Guard: Allow and deny responses using Valkey as a vector database - Policy

Allow and deny responses using Valkey as a vector database

The AI Semantic Response Guard policy analyzes the full response from an LLM service and filters it based on semantic similarity to configured allow or deny patterns.

Deny rules take precedence over allow rules. Responses matching a deny pattern are blocked, even if they also match an allow pattern. Responses not matching any allow pattern are blocked when allow rules are set.

Valkey is automatically detected when using the redis vectordb strategy. AI Gateway queries the server and uses the Valkey-specific driver when it detects a Valkey backend.

Prerequisites

An existing AI Model.
A Valkey 8.x instance.
Port 6379, or your custom Valkey port, is open and reachable from AI Gateway.

Environment variables

OPENAI_API_KEY: Your OpenAI API key
VALKEY_HOST: The host where your Valkey instance runs

Set up the policy

kongctl

policy.yaml

Copied!

ai_gateway_policies:
  - ref: allow-and-deny-responses-valkey
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    name: allow-and-deny-responses-valkey
    display_name: Allow and deny responses using Valkey as a vector database
    type: ai-semantic-response-guard
    enabled: true
    config:
      embeddings:
        auth:
          header_name: Authorization
          header_value: Bearer $OPENAI_API_KEY
        model:
          name: text-embedding-3-small
          provider: openai
      search:
        threshold: 0.7
      vectordb:
        strategy: redis
        distance_metric: cosine
        threshold: 0.7
        dimensions: 1024
        redis:
          host: !env VALKEY_HOST
          port: 6379
      rules:
        allow_responses:
        - Network troubleshooting and diagnostics
        - Cloud infrastructure management (AWS, Azure, GCP)
        - Cybersecurity best practices and incident response
        - DevOps workflows and automation
        - Programming concepts and language usage
        - IT policy and compliance guidance
        - Software development lifecycle and CI/CD
        - Documentation writing and technical explanation
        - System administration and configuration
        - Productivity and collaboration tools usage
        deny_responses:
        - Hacking techniques or penetration testing without authorization
        - Bypassing software licensing or digital rights management
        - Instructions on exploiting vulnerabilities or writing malware
        - Circumventing security controls or access restrictions
        - Gathering personal or confidential employee information
        - Using AI to impersonate or phish others
        - Social engineering tactics or manipulation techniques
        - Guidance on violating company IT policies
        - Content unrelated to work, such as entertainment or dating
        - Political, religious, or sensitive non-work-related discussions
    global: false

Make sure to replace the following placeholders with your own values:

AI_GATEWAY_ID: The id of your AI Gateway.
!env OPENAI_API_KEY: Your OpenAI API key
!env VALKEY_HOST: The host where your Valkey instance runs

curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "allow-and-deny-responses-valkey",
      "display_name": "Allow and deny responses using Valkey as a vector database",
      "type": "ai-semantic-response-guard",
      "enabled": true,
      "config": {
        "embeddings": {
          "auth": {
            "header_name": "Authorization",
            "header_value": "Bearer '$OPENAI_API_KEY'"
          },
          "model": {
            "name": "text-embedding-3-small",
            "provider": "openai"
          }
        },
        "search": {
          "threshold": 0.7
        },
        "vectordb": {
          "strategy": "redis",
          "distance_metric": "cosine",
          "threshold": 0.7,
          "dimensions": 1024,
          "redis": {
            "host": "'$VALKEY_HOST'",
            "port": 6379
          }
        },
        "rules": {
          "allow_responses": [
            "Network troubleshooting and diagnostics",
            "Cloud infrastructure management (AWS, Azure, GCP)",
            "Cybersecurity best practices and incident response",
            "DevOps workflows and automation",
            "Programming concepts and language usage",
            "IT policy and compliance guidance",
            "Software development lifecycle and CI/CD",
            "Documentation writing and technical explanation",
            "System administration and configuration",
            "Productivity and collaboration tools usage"
          ],
          "deny_responses": [
            "Hacking techniques or penetration testing without authorization",
            "Bypassing software licensing or digital rights management",
            "Instructions on exploiting vulnerabilities or writing malware",
            "Circumventing security controls or access restrictions",
            "Gathering personal or confidential employee information",
            "Using AI to impersonate or phish others",
            "Social engineering tactics or manipulation techniques",
            "Guidance on violating company IT policies",
            "Content unrelated to work, such as entertainment or dating",
            "Political, religious, or sensitive non-work-related discussions"
          ]
        }
      },
      "global": false
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
AIGatewayId: The id of the AI Gateway.

See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration:

resource "konnect_ai_gateway_policy" "my_policy" {
  name = "allow-and-deny-responses-valkey"
  display_name = "Allow and deny responses using Valkey as a vector database"
  type = "ai-semantic-response-guard"
  enabled = true
  global = false
  config = jsonencode({

    embeddings = {

      auth = {
        header_name = "Authorization"
        header_value = "Bearer var.openai_api_key"
      }

      model = {
        name = "text-embedding-3-small"
        provider = "openai"
      }
    }

    search = {
      threshold = 0.7
    }

    vectordb = {
      strategy = "redis"
      distance_metric = "cosine"
      threshold = 0.7
      dimensions = 1024

      redis = {
        host = var.valkey_host
        port = 6379
      }
    }

    rules = {
      allow_responses = ["Network troubleshooting and diagnostics", "Cloud infrastructure management (AWS, Azure, GCP)", "Cybersecurity best practices and incident response", "DevOps workflows and automation", "Programming concepts and language usage", "IT policy and compliance guidance", "Software development lifecycle and CI/CD", "Documentation writing and technical explanation", "System administration and configuration", "Productivity and collaboration tools usage"]
      deny_responses = ["Hacking techniques or penetration testing without authorization", "Bypassing software licensing or digital rights management", "Instructions on exploiting vulnerabilities or writing malware", "Circumventing security controls or access restrictions", "Gathering personal or confidential employee information", "Using AI to impersonate or phish others", "Social engineering tactics or manipulation techniques", "Guidance on violating company IT policies", "Content unrelated to work, such as entertainment or dating", "Political, religious, or sensitive non-work-related discussions"]
    }
  })


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "openai_api_key" {
  type = string
}
variable "valkey_host" {
  type = string
}

Copied!

kongctl

policy.yaml

Copied!

ai_gateway_policies:
  - ref: allow-and-deny-responses-valkey
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    name: allow-and-deny-responses-valkey
    display_name: Allow and deny responses using Valkey as a vector database
    type: ai-semantic-response-guard
    enabled: true
    config:
      embeddings:
        auth:
          header_name: Authorization
          header_value: Bearer $OPENAI_API_KEY
        model:
          name: text-embedding-3-small
          provider: openai
      search:
        threshold: 0.7
      vectordb:
        strategy: redis
        distance_metric: cosine
        threshold: 0.7
        dimensions: 1024
        redis:
          host: !env VALKEY_HOST
          port: 6379
      rules:
        allow_responses:
        - Network troubleshooting and diagnostics
        - Cloud infrastructure management (AWS, Azure, GCP)
        - Cybersecurity best practices and incident response
        - DevOps workflows and automation
        - Programming concepts and language usage
        - IT policy and compliance guidance
        - Software development lifecycle and CI/CD
        - Documentation writing and technical explanation
        - System administration and configuration
        - Productivity and collaboration tools usage
        deny_responses:
        - Hacking techniques or penetration testing without authorization
        - Bypassing software licensing or digital rights management
        - Instructions on exploiting vulnerabilities or writing malware
        - Circumventing security controls or access restrictions
        - Gathering personal or confidential employee information
        - Using AI to impersonate or phish others
        - Social engineering tactics or manipulation techniques
        - Guidance on violating company IT policies
        - Content unrelated to work, such as entertainment or dating
        - Political, religious, or sensitive non-work-related discussions
    global: false

Make sure to replace the following placeholders with your own values:

AI_GATEWAY_ID: The id of your AI Gateway.
!env OPENAI_API_KEY: Your OpenAI API key
!env VALKEY_HOST: The host where your Valkey instance runs

curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "allow-and-deny-responses-valkey",
      "display_name": "Allow and deny responses using Valkey as a vector database",
      "type": "ai-semantic-response-guard",
      "enabled": true,
      "config": {
        "embeddings": {
          "auth": {
            "header_name": "Authorization",
            "header_value": "Bearer '$OPENAI_API_KEY'"
          },
          "model": {
            "name": "text-embedding-3-small",
            "provider": "openai"
          }
        },
        "search": {
          "threshold": 0.7
        },
        "vectordb": {
          "strategy": "redis",
          "distance_metric": "cosine",
          "threshold": 0.7,
          "dimensions": 1024,
          "redis": {
            "host": "'$VALKEY_HOST'",
            "port": 6379
          }
        },
        "rules": {
          "allow_responses": [
            "Network troubleshooting and diagnostics",
            "Cloud infrastructure management (AWS, Azure, GCP)",
            "Cybersecurity best practices and incident response",
            "DevOps workflows and automation",
            "Programming concepts and language usage",
            "IT policy and compliance guidance",
            "Software development lifecycle and CI/CD",
            "Documentation writing and technical explanation",
            "System administration and configuration",
            "Productivity and collaboration tools usage"
          ],
          "deny_responses": [
            "Hacking techniques or penetration testing without authorization",
            "Bypassing software licensing or digital rights management",
            "Instructions on exploiting vulnerabilities or writing malware",
            "Circumventing security controls or access restrictions",
            "Gathering personal or confidential employee information",
            "Using AI to impersonate or phish others",
            "Social engineering tactics or manipulation techniques",
            "Guidance on violating company IT policies",
            "Content unrelated to work, such as entertainment or dating",
            "Political, religious, or sensitive non-work-related discussions"
          ]
        }
      },
      "global": false
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
AIGatewayId: The id of the AI Gateway.

See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration:

resource "konnect_ai_gateway_policy" "my_policy" {
  name = "allow-and-deny-responses-valkey"
  display_name = "Allow and deny responses using Valkey as a vector database"
  type = "ai-semantic-response-guard"
  enabled = true
  global = false
  config = jsonencode({

    embeddings = {

      auth = {
        header_name = "Authorization"
        header_value = "Bearer var.openai_api_key"
      }

      model = {
        name = "text-embedding-3-small"
        provider = "openai"
      }
    }

    search = {
      threshold = 0.7
    }

    vectordb = {
      strategy = "redis"
      distance_metric = "cosine"
      threshold = 0.7
      dimensions = 1024

      redis = {
        host = var.valkey_host
        port = 6379
      }
    }

    rules = {
      allow_responses = ["Network troubleshooting and diagnostics", "Cloud infrastructure management (AWS, Azure, GCP)", "Cybersecurity best practices and incident response", "DevOps workflows and automation", "Programming concepts and language usage", "IT policy and compliance guidance", "Software development lifecycle and CI/CD", "Documentation writing and technical explanation", "System administration and configuration", "Productivity and collaboration tools usage"]
      deny_responses = ["Hacking techniques or penetration testing without authorization", "Bypassing software licensing or digital rights management", "Instructions on exploiting vulnerabilities or writing malware", "Circumventing security controls or access restrictions", "Gathering personal or confidential employee information", "Using AI to impersonate or phish others", "Social engineering tactics or manipulation techniques", "Guidance on violating company IT policies", "Content unrelated to work, such as entertainment or dating", "Political, religious, or sensitive non-work-related discussions"]
    }
  })


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "openai_api_key" {
  type = string
}
variable "valkey_host" {
  type = string
}

Copied!

kongctl

policy.yaml

Copied!

ai_gateway_policies:
  - ref: allow-and-deny-responses-valkey
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    name: allow-and-deny-responses-valkey
    display_name: Allow and deny responses using Valkey as a vector database
    type: ai-semantic-response-guard
    enabled: true
    config:
      embeddings:
        auth:
          header_name: Authorization
          header_value: Bearer $OPENAI_API_KEY
        model:
          name: text-embedding-3-small
          provider: openai
      search:
        threshold: 0.7
      vectordb:
        strategy: redis
        distance_metric: cosine
        threshold: 0.7
        dimensions: 1024
        redis:
          host: !env VALKEY_HOST
          port: 6379
      rules:
        allow_responses:
        - Network troubleshooting and diagnostics
        - Cloud infrastructure management (AWS, Azure, GCP)
        - Cybersecurity best practices and incident response
        - DevOps workflows and automation
        - Programming concepts and language usage
        - IT policy and compliance guidance
        - Software development lifecycle and CI/CD
        - Documentation writing and technical explanation
        - System administration and configuration
        - Productivity and collaboration tools usage
        deny_responses:
        - Hacking techniques or penetration testing without authorization
        - Bypassing software licensing or digital rights management
        - Instructions on exploiting vulnerabilities or writing malware
        - Circumventing security controls or access restrictions
        - Gathering personal or confidential employee information
        - Using AI to impersonate or phish others
        - Social engineering tactics or manipulation techniques
        - Guidance on violating company IT policies
        - Content unrelated to work, such as entertainment or dating
        - Political, religious, or sensitive non-work-related discussions
    global: false

Make sure to replace the following placeholders with your own values:

AI_GATEWAY_ID: The id of your AI Gateway.
!env OPENAI_API_KEY: Your OpenAI API key
!env VALKEY_HOST: The host where your Valkey instance runs

curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "allow-and-deny-responses-valkey",
      "display_name": "Allow and deny responses using Valkey as a vector database",
      "type": "ai-semantic-response-guard",
      "enabled": true,
      "config": {
        "embeddings": {
          "auth": {
            "header_name": "Authorization",
            "header_value": "Bearer '$OPENAI_API_KEY'"
          },
          "model": {
            "name": "text-embedding-3-small",
            "provider": "openai"
          }
        },
        "search": {
          "threshold": 0.7
        },
        "vectordb": {
          "strategy": "redis",
          "distance_metric": "cosine",
          "threshold": 0.7,
          "dimensions": 1024,
          "redis": {
            "host": "'$VALKEY_HOST'",
            "port": 6379
          }
        },
        "rules": {
          "allow_responses": [
            "Network troubleshooting and diagnostics",
            "Cloud infrastructure management (AWS, Azure, GCP)",
            "Cybersecurity best practices and incident response",
            "DevOps workflows and automation",
            "Programming concepts and language usage",
            "IT policy and compliance guidance",
            "Software development lifecycle and CI/CD",
            "Documentation writing and technical explanation",
            "System administration and configuration",
            "Productivity and collaboration tools usage"
          ],
          "deny_responses": [
            "Hacking techniques or penetration testing without authorization",
            "Bypassing software licensing or digital rights management",
            "Instructions on exploiting vulnerabilities or writing malware",
            "Circumventing security controls or access restrictions",
            "Gathering personal or confidential employee information",
            "Using AI to impersonate or phish others",
            "Social engineering tactics or manipulation techniques",
            "Guidance on violating company IT policies",
            "Content unrelated to work, such as entertainment or dating",
            "Political, religious, or sensitive non-work-related discussions"
          ]
        }
      },
      "global": false
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
AIGatewayId: The id of the AI Gateway.

See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration:

resource "konnect_ai_gateway_policy" "my_policy" {
  name = "allow-and-deny-responses-valkey"
  display_name = "Allow and deny responses using Valkey as a vector database"
  type = "ai-semantic-response-guard"
  enabled = true
  global = false
  config = jsonencode({

    embeddings = {

      auth = {
        header_name = "Authorization"
        header_value = "Bearer var.openai_api_key"
      }

      model = {
        name = "text-embedding-3-small"
        provider = "openai"
      }
    }

    search = {
      threshold = 0.7
    }

    vectordb = {
      strategy = "redis"
      distance_metric = "cosine"
      threshold = 0.7
      dimensions = 1024

      redis = {
        host = var.valkey_host
        port = 6379
      }
    }

    rules = {
      allow_responses = ["Network troubleshooting and diagnostics", "Cloud infrastructure management (AWS, Azure, GCP)", "Cybersecurity best practices and incident response", "DevOps workflows and automation", "Programming concepts and language usage", "IT policy and compliance guidance", "Software development lifecycle and CI/CD", "Documentation writing and technical explanation", "System administration and configuration", "Productivity and collaboration tools usage"]
      deny_responses = ["Hacking techniques or penetration testing without authorization", "Bypassing software licensing or digital rights management", "Instructions on exploiting vulnerabilities or writing malware", "Circumventing security controls or access restrictions", "Gathering personal or confidential employee information", "Using AI to impersonate or phish others", "Social engineering tactics or manipulation techniques", "Guidance on violating company IT policies", "Content unrelated to work, such as entertainment or dating", "Political, religious, or sensitive non-work-related discussions"]
    }
  })


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "openai_api_key" {
  type = string
}
variable "valkey_host" {
  type = string
}

Copied!

kongctl

policy.yaml

Copied!

ai_gateway_policies:
  - ref: allow-and-deny-responses-valkey
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    name: allow-and-deny-responses-valkey
    display_name: Allow and deny responses using Valkey as a vector database
    type: ai-semantic-response-guard
    enabled: true
    config:
      embeddings:
        auth:
          header_name: Authorization
          header_value: Bearer $OPENAI_API_KEY
        model:
          name: text-embedding-3-small
          provider: openai
      search:
        threshold: 0.7
      vectordb:
        strategy: redis
        distance_metric: cosine
        threshold: 0.7
        dimensions: 1024
        redis:
          host: !env VALKEY_HOST
          port: 6379
      rules:
        allow_responses:
        - Network troubleshooting and diagnostics
        - Cloud infrastructure management (AWS, Azure, GCP)
        - Cybersecurity best practices and incident response
        - DevOps workflows and automation
        - Programming concepts and language usage
        - IT policy and compliance guidance
        - Software development lifecycle and CI/CD
        - Documentation writing and technical explanation
        - System administration and configuration
        - Productivity and collaboration tools usage
        deny_responses:
        - Hacking techniques or penetration testing without authorization
        - Bypassing software licensing or digital rights management
        - Instructions on exploiting vulnerabilities or writing malware
        - Circumventing security controls or access restrictions
        - Gathering personal or confidential employee information
        - Using AI to impersonate or phish others
        - Social engineering tactics or manipulation techniques
        - Guidance on violating company IT policies
        - Content unrelated to work, such as entertainment or dating
        - Political, religious, or sensitive non-work-related discussions
    global: true

Make sure to replace the following placeholders with your own values:

AI_GATEWAY_ID: The id of your AI Gateway.
!env OPENAI_API_KEY: Your OpenAI API key
!env VALKEY_HOST: The host where your Valkey instance runs

curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "allow-and-deny-responses-valkey",
      "display_name": "Allow and deny responses using Valkey as a vector database",
      "type": "ai-semantic-response-guard",
      "enabled": true,
      "config": {
        "embeddings": {
          "auth": {
            "header_name": "Authorization",
            "header_value": "Bearer '$OPENAI_API_KEY'"
          },
          "model": {
            "name": "text-embedding-3-small",
            "provider": "openai"
          }
        },
        "search": {
          "threshold": 0.7
        },
        "vectordb": {
          "strategy": "redis",
          "distance_metric": "cosine",
          "threshold": 0.7,
          "dimensions": 1024,
          "redis": {
            "host": "'$VALKEY_HOST'",
            "port": 6379
          }
        },
        "rules": {
          "allow_responses": [
            "Network troubleshooting and diagnostics",
            "Cloud infrastructure management (AWS, Azure, GCP)",
            "Cybersecurity best practices and incident response",
            "DevOps workflows and automation",
            "Programming concepts and language usage",
            "IT policy and compliance guidance",
            "Software development lifecycle and CI/CD",
            "Documentation writing and technical explanation",
            "System administration and configuration",
            "Productivity and collaboration tools usage"
          ],
          "deny_responses": [
            "Hacking techniques or penetration testing without authorization",
            "Bypassing software licensing or digital rights management",
            "Instructions on exploiting vulnerabilities or writing malware",
            "Circumventing security controls or access restrictions",
            "Gathering personal or confidential employee information",
            "Using AI to impersonate or phish others",
            "Social engineering tactics or manipulation techniques",
            "Guidance on violating company IT policies",
            "Content unrelated to work, such as entertainment or dating",
            "Political, religious, or sensitive non-work-related discussions"
          ]
        }
      },
      "global": true
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
AIGatewayId: The id of the AI Gateway.

See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration:

resource "konnect_ai_gateway_policy" "my_policy" {
  name = "allow-and-deny-responses-valkey"
  display_name = "Allow and deny responses using Valkey as a vector database"
  type = "ai-semantic-response-guard"
  enabled = true
  global = true
  config = jsonencode({

    embeddings = {

      auth = {
        header_name = "Authorization"
        header_value = "Bearer var.openai_api_key"
      }

      model = {
        name = "text-embedding-3-small"
        provider = "openai"
      }
    }

    search = {
      threshold = 0.7
    }

    vectordb = {
      strategy = "redis"
      distance_metric = "cosine"
      threshold = 0.7
      dimensions = 1024

      redis = {
        host = var.valkey_host
        port = 6379
      }
    }

    rules = {
      allow_responses = ["Network troubleshooting and diagnostics", "Cloud infrastructure management (AWS, Azure, GCP)", "Cybersecurity best practices and incident response", "DevOps workflows and automation", "Programming concepts and language usage", "IT policy and compliance guidance", "Software development lifecycle and CI/CD", "Documentation writing and technical explanation", "System administration and configuration", "Productivity and collaboration tools usage"]
      deny_responses = ["Hacking techniques or penetration testing without authorization", "Bypassing software licensing or digital rights management", "Instructions on exploiting vulnerabilities or writing malware", "Circumventing security controls or access restrictions", "Gathering personal or confidential employee information", "Using AI to impersonate or phish others", "Social engineering tactics or manipulation techniques", "Guidance on violating company IT policies", "Content unrelated to work, such as entertainment or dating", "Political, religious, or sensitive non-work-related discussions"]
    }
  })


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "openai_api_key" {
  type = string
}
variable "valkey_host" {
  type = string
}

Copied!

Attach the policy

After creating the policy, add allow-and-deny-responses-valkey to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.

kongctl

model.yaml

Copied!

ai_gateway_models:
  - ref: my-gpt-4o
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    display_name: my-gpt-4o
    name: my-gpt-4o
    type: model
    capabilities:
    - generate
    formats:
    - type: openai
    targets:
    - name: gpt-4o
      provider: my-openai-account
      config:
        type: openai
    config:
      route:
        paths:
        - "/v1"
        model:
          body_param: model
          values:
          - my-gpt-4o
      logging:
        payloads: false
    policies:
    - !ref allow-and-deny-responses-valkey#name

After creating the policy, add allow-and-deny-responses-valkey to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.

curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/models/my-gpt-4o \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "display_name": "my-gpt-4o",
      "name": "my-gpt-4o",
      "type": "model",
      "capabilities": [
        "generate"
      ],
      "formats": [
        {
          "type": "openai"
        }
      ],
      "policies": [
        "allow-and-deny-responses-valkey"
      ],
      "targets": [
        {
          "name": "gpt-4o",
          "provider": "my-openai-account",
          "config": {
            "type": "openai"
          }
        }
      ],
      "config": {
        "route": {
          "paths": [
            "/v1"
          ],
          "model": {
            "body_param": "model",
            "values": [
              "my-gpt-4o"
            ]
          }
        },
        "logging": {
          "payloads": false
        }
      }
    }
    '

Copied!

After creating the policy, add allow-and-deny-responses-valkey to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.

resource "konnect_ai_gateway_model" "my_model" {
  display_name = "my-gpt-4o"
  name = "my-gpt-4o"
  type = "model"
  capabilities = ["generate"]
  formats = [
    {
      type = "openai"
    }  ]
  targets = [
    {
      name = "gpt-4o"
      provider = "my-openai-account"

      config = {
        type = "openai"
      }
    }  ]
  config = jsonencode({

    route = {
      paths = ["/v1"]

      model = {
        body_param = "model"
        values = ["my-gpt-4o"]
      }
    }

    logging = {
      payloads = false
    }
  })
  policies = [konnect_ai_gateway_policy.my_policy.name]


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "openai_api_key" {
  type = string
}
variable "valkey_host" {
  type = string
}

Copied!

After creating the policy, add allow-and-deny-responses-valkey to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.

kongctl

consumer.yaml

Copied!

ai_gateway_consumers:
  - ref: mobile-app-production
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    display_name: Mobile App - Production
    name: mobile-app-production
    type: api-key
    policies:
    - !ref allow-and-deny-responses-valkey#name

After creating the policy, add allow-and-deny-responses-valkey to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.

curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumers/mobile-app-production \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "display_name": "Mobile App - Production",
      "name": "mobile-app-production",
      "type": "api-key",
      "policies": [
        "allow-and-deny-responses-valkey"
      ]
    }
    '

Copied!

After creating the policy, add allow-and-deny-responses-valkey to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.

resource "konnect_ai_gateway_consumer" "my_consumer" {
  display_name = "Mobile App - Production"
  name = "mobile-app-production"
  type = "api-key"
  policies = [konnect_ai_gateway_policy.my_policy.name]


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "openai_api_key" {
  type = string
}
variable "valkey_host" {
  type = string
}

Copied!

After creating the policy, add allow-and-deny-responses-valkey to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.

kongctl

consumer_group.yaml

Copied!

ai_gateway_consumer_groups:
  - ref: internal-teams
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    display_name: Internal Teams
    name: internal-teams
    policies:
    - !ref allow-and-deny-responses-valkey#name

After creating the policy, add allow-and-deny-responses-valkey to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.

curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumer-groups/internal-teams \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "display_name": "Internal Teams",
      "name": "internal-teams",
      "policies": [
        "allow-and-deny-responses-valkey"
      ]
    }
    '

Copied!

After creating the policy, add allow-and-deny-responses-valkey to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.

resource "konnect_ai_gateway_consumer_group" "my_consumer_group" {
  display_name = "Internal Teams"
  name = "internal-teams"
  policies = [konnect_ai_gateway_policy.my_policy.name]


  gateway_id = konnect_ai_gateway.my_ai_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "openai_api_key" {
  type = string
}
variable "valkey_host" {
  type = string
}

Copied!

AI Semantic Response Guard Policy

Allow and deny responses using Valkey as a vector database

Prerequisites

Environment variables

Set up the policy

Attach the policy

Help us make these docs great!

Still need help?