Deny only responses
The AI Semantic Response Guard policy analyzes the full response from an LLM service and blocks it if it semantically matches one of the configured deny patterns.
Responses that do not match any deny pattern are permitted.
Prerequisites
-
An existing AI Model.
-
A Redis instance or another supported vector database.
-
Port
6379, or your custom Redis port, is open and reachable from AI Gateway.
Environment variables
-
OPENAI_API_KEY: Your OpenAI API key -
REDIS_HOST: The host where your Redis instance runs
ai_gateway_policies:
- ref: deny-responses
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: deny-responses
display_name: Deny only responses
type: ai-semantic-response-guard
enabled: true
config:
embeddings:
auth:
header_name: Authorization
header_value: Bearer $OPENAI_API_KEY
model:
name: text-embedding-3-small
provider: openai
search:
threshold: 0.7
vectordb:
strategy: redis
distance_metric: cosine
threshold: 0.7
dimensions: 1024
redis:
host: !env REDIS_HOST
port: 6379
rules:
deny_responses:
- Hacking techniques or penetration testing without authorization
- Bypassing software licensing or digital rights management
- Instructions on exploiting vulnerabilities or writing malware
- Circumventing security controls or access restrictions
- Gathering personal or confidential employee information
- Using AI to impersonate or phish others
- Social engineering tactics or manipulation techniques
- Guidance on violating company IT policies
- Content unrelated to work, such as entertainment or dating
- Political, religious, or sensitive non-work-related discussions
global: falseMake sure to replace the following placeholders with your own values:
-
AI_GATEWAY_ID: Theidof your AI Gateway. -
!env OPENAI_API_KEY: Your OpenAI API key -
!env REDIS_HOST: The host where your Redis instance runs
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "deny-responses",
"display_name": "Deny only responses",
"type": "ai-semantic-response-guard",
"enabled": true,
"config": {
"embeddings": {
"auth": {
"header_name": "Authorization",
"header_value": "Bearer '$OPENAI_API_KEY'"
},
"model": {
"name": "text-embedding-3-small",
"provider": "openai"
}
},
"search": {
"threshold": 0.7
},
"vectordb": {
"strategy": "redis",
"distance_metric": "cosine",
"threshold": 0.7,
"dimensions": 1024,
"redis": {
"host": "'$REDIS_HOST'",
"port": 6379
}
},
"rules": {
"deny_responses": [
"Hacking techniques or penetration testing without authorization",
"Bypassing software licensing or digital rights management",
"Instructions on exploiting vulnerabilities or writing malware",
"Circumventing security controls or access restrictions",
"Gathering personal or confidential employee information",
"Using AI to impersonate or phish others",
"Social engineering tactics or manipulation techniques",
"Guidance on violating company IT policies",
"Content unrelated to work, such as entertainment or dating",
"Political, religious, or sensitive non-work-related discussions"
]
}
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "deny-responses"
display_name = "Deny only responses"
type = "ai-semantic-response-guard"
enabled = true
global = false
config = jsonencode({
embeddings = {
auth = {
header_name = "Authorization"
header_value = "Bearer var.openai_api_key"
}
model = {
name = "text-embedding-3-small"
provider = "openai"
}
}
search = {
threshold = 0.7
}
vectordb = {
strategy = "redis"
distance_metric = "cosine"
threshold = 0.7
dimensions = 1024
redis = {
host = var.redis_host
port = 6379
}
}
rules = {
deny_responses = ["Hacking techniques or penetration testing without authorization", "Bypassing software licensing or digital rights management", "Instructions on exploiting vulnerabilities or writing malware", "Circumventing security controls or access restrictions", "Gathering personal or confidential employee information", "Using AI to impersonate or phish others", "Social engineering tactics or manipulation techniques", "Guidance on violating company IT policies", "Content unrelated to work, such as entertainment or dating", "Political, religious, or sensitive non-work-related discussions"]
}
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "openai_api_key" {
type = string
}
variable "redis_host" {
type = string
}ai_gateway_policies:
- ref: deny-responses
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: deny-responses
display_name: Deny only responses
type: ai-semantic-response-guard
enabled: true
config:
embeddings:
auth:
header_name: Authorization
header_value: Bearer $OPENAI_API_KEY
model:
name: text-embedding-3-small
provider: openai
search:
threshold: 0.7
vectordb:
strategy: redis
distance_metric: cosine
threshold: 0.7
dimensions: 1024
redis:
host: !env REDIS_HOST
port: 6379
rules:
deny_responses:
- Hacking techniques or penetration testing without authorization
- Bypassing software licensing or digital rights management
- Instructions on exploiting vulnerabilities or writing malware
- Circumventing security controls or access restrictions
- Gathering personal or confidential employee information
- Using AI to impersonate or phish others
- Social engineering tactics or manipulation techniques
- Guidance on violating company IT policies
- Content unrelated to work, such as entertainment or dating
- Political, religious, or sensitive non-work-related discussions
global: falseMake sure to replace the following placeholders with your own values:
-
AI_GATEWAY_ID: Theidof your AI Gateway. -
!env OPENAI_API_KEY: Your OpenAI API key -
!env REDIS_HOST: The host where your Redis instance runs
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "deny-responses",
"display_name": "Deny only responses",
"type": "ai-semantic-response-guard",
"enabled": true,
"config": {
"embeddings": {
"auth": {
"header_name": "Authorization",
"header_value": "Bearer '$OPENAI_API_KEY'"
},
"model": {
"name": "text-embedding-3-small",
"provider": "openai"
}
},
"search": {
"threshold": 0.7
},
"vectordb": {
"strategy": "redis",
"distance_metric": "cosine",
"threshold": 0.7,
"dimensions": 1024,
"redis": {
"host": "'$REDIS_HOST'",
"port": 6379
}
},
"rules": {
"deny_responses": [
"Hacking techniques or penetration testing without authorization",
"Bypassing software licensing or digital rights management",
"Instructions on exploiting vulnerabilities or writing malware",
"Circumventing security controls or access restrictions",
"Gathering personal or confidential employee information",
"Using AI to impersonate or phish others",
"Social engineering tactics or manipulation techniques",
"Guidance on violating company IT policies",
"Content unrelated to work, such as entertainment or dating",
"Political, religious, or sensitive non-work-related discussions"
]
}
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "deny-responses"
display_name = "Deny only responses"
type = "ai-semantic-response-guard"
enabled = true
global = false
config = jsonencode({
embeddings = {
auth = {
header_name = "Authorization"
header_value = "Bearer var.openai_api_key"
}
model = {
name = "text-embedding-3-small"
provider = "openai"
}
}
search = {
threshold = 0.7
}
vectordb = {
strategy = "redis"
distance_metric = "cosine"
threshold = 0.7
dimensions = 1024
redis = {
host = var.redis_host
port = 6379
}
}
rules = {
deny_responses = ["Hacking techniques or penetration testing without authorization", "Bypassing software licensing or digital rights management", "Instructions on exploiting vulnerabilities or writing malware", "Circumventing security controls or access restrictions", "Gathering personal or confidential employee information", "Using AI to impersonate or phish others", "Social engineering tactics or manipulation techniques", "Guidance on violating company IT policies", "Content unrelated to work, such as entertainment or dating", "Political, religious, or sensitive non-work-related discussions"]
}
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "openai_api_key" {
type = string
}
variable "redis_host" {
type = string
}ai_gateway_policies:
- ref: deny-responses
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: deny-responses
display_name: Deny only responses
type: ai-semantic-response-guard
enabled: true
config:
embeddings:
auth:
header_name: Authorization
header_value: Bearer $OPENAI_API_KEY
model:
name: text-embedding-3-small
provider: openai
search:
threshold: 0.7
vectordb:
strategy: redis
distance_metric: cosine
threshold: 0.7
dimensions: 1024
redis:
host: !env REDIS_HOST
port: 6379
rules:
deny_responses:
- Hacking techniques or penetration testing without authorization
- Bypassing software licensing or digital rights management
- Instructions on exploiting vulnerabilities or writing malware
- Circumventing security controls or access restrictions
- Gathering personal or confidential employee information
- Using AI to impersonate or phish others
- Social engineering tactics or manipulation techniques
- Guidance on violating company IT policies
- Content unrelated to work, such as entertainment or dating
- Political, religious, or sensitive non-work-related discussions
global: falseMake sure to replace the following placeholders with your own values:
-
AI_GATEWAY_ID: Theidof your AI Gateway. -
!env OPENAI_API_KEY: Your OpenAI API key -
!env REDIS_HOST: The host where your Redis instance runs
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "deny-responses",
"display_name": "Deny only responses",
"type": "ai-semantic-response-guard",
"enabled": true,
"config": {
"embeddings": {
"auth": {
"header_name": "Authorization",
"header_value": "Bearer '$OPENAI_API_KEY'"
},
"model": {
"name": "text-embedding-3-small",
"provider": "openai"
}
},
"search": {
"threshold": 0.7
},
"vectordb": {
"strategy": "redis",
"distance_metric": "cosine",
"threshold": 0.7,
"dimensions": 1024,
"redis": {
"host": "'$REDIS_HOST'",
"port": 6379
}
},
"rules": {
"deny_responses": [
"Hacking techniques or penetration testing without authorization",
"Bypassing software licensing or digital rights management",
"Instructions on exploiting vulnerabilities or writing malware",
"Circumventing security controls or access restrictions",
"Gathering personal or confidential employee information",
"Using AI to impersonate or phish others",
"Social engineering tactics or manipulation techniques",
"Guidance on violating company IT policies",
"Content unrelated to work, such as entertainment or dating",
"Political, religious, or sensitive non-work-related discussions"
]
}
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "deny-responses"
display_name = "Deny only responses"
type = "ai-semantic-response-guard"
enabled = true
global = false
config = jsonencode({
embeddings = {
auth = {
header_name = "Authorization"
header_value = "Bearer var.openai_api_key"
}
model = {
name = "text-embedding-3-small"
provider = "openai"
}
}
search = {
threshold = 0.7
}
vectordb = {
strategy = "redis"
distance_metric = "cosine"
threshold = 0.7
dimensions = 1024
redis = {
host = var.redis_host
port = 6379
}
}
rules = {
deny_responses = ["Hacking techniques or penetration testing without authorization", "Bypassing software licensing or digital rights management", "Instructions on exploiting vulnerabilities or writing malware", "Circumventing security controls or access restrictions", "Gathering personal or confidential employee information", "Using AI to impersonate or phish others", "Social engineering tactics or manipulation techniques", "Guidance on violating company IT policies", "Content unrelated to work, such as entertainment or dating", "Political, religious, or sensitive non-work-related discussions"]
}
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "openai_api_key" {
type = string
}
variable "redis_host" {
type = string
}ai_gateway_policies:
- ref: deny-responses
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: deny-responses
display_name: Deny only responses
type: ai-semantic-response-guard
enabled: true
config:
embeddings:
auth:
header_name: Authorization
header_value: Bearer $OPENAI_API_KEY
model:
name: text-embedding-3-small
provider: openai
search:
threshold: 0.7
vectordb:
strategy: redis
distance_metric: cosine
threshold: 0.7
dimensions: 1024
redis:
host: !env REDIS_HOST
port: 6379
rules:
deny_responses:
- Hacking techniques or penetration testing without authorization
- Bypassing software licensing or digital rights management
- Instructions on exploiting vulnerabilities or writing malware
- Circumventing security controls or access restrictions
- Gathering personal or confidential employee information
- Using AI to impersonate or phish others
- Social engineering tactics or manipulation techniques
- Guidance on violating company IT policies
- Content unrelated to work, such as entertainment or dating
- Political, religious, or sensitive non-work-related discussions
global: trueMake sure to replace the following placeholders with your own values:
-
AI_GATEWAY_ID: Theidof your AI Gateway. -
!env OPENAI_API_KEY: Your OpenAI API key -
!env REDIS_HOST: The host where your Redis instance runs
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "deny-responses",
"display_name": "Deny only responses",
"type": "ai-semantic-response-guard",
"enabled": true,
"config": {
"embeddings": {
"auth": {
"header_name": "Authorization",
"header_value": "Bearer '$OPENAI_API_KEY'"
},
"model": {
"name": "text-embedding-3-small",
"provider": "openai"
}
},
"search": {
"threshold": 0.7
},
"vectordb": {
"strategy": "redis",
"distance_metric": "cosine",
"threshold": 0.7,
"dimensions": 1024,
"redis": {
"host": "'$REDIS_HOST'",
"port": 6379
}
},
"rules": {
"deny_responses": [
"Hacking techniques or penetration testing without authorization",
"Bypassing software licensing or digital rights management",
"Instructions on exploiting vulnerabilities or writing malware",
"Circumventing security controls or access restrictions",
"Gathering personal or confidential employee information",
"Using AI to impersonate or phish others",
"Social engineering tactics or manipulation techniques",
"Guidance on violating company IT policies",
"Content unrelated to work, such as entertainment or dating",
"Political, religious, or sensitive non-work-related discussions"
]
}
},
"global": true
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "deny-responses"
display_name = "Deny only responses"
type = "ai-semantic-response-guard"
enabled = true
global = true
config = jsonencode({
embeddings = {
auth = {
header_name = "Authorization"
header_value = "Bearer var.openai_api_key"
}
model = {
name = "text-embedding-3-small"
provider = "openai"
}
}
search = {
threshold = 0.7
}
vectordb = {
strategy = "redis"
distance_metric = "cosine"
threshold = 0.7
dimensions = 1024
redis = {
host = var.redis_host
port = 6379
}
}
rules = {
deny_responses = ["Hacking techniques or penetration testing without authorization", "Bypassing software licensing or digital rights management", "Instructions on exploiting vulnerabilities or writing malware", "Circumventing security controls or access restrictions", "Gathering personal or confidential employee information", "Using AI to impersonate or phish others", "Social engineering tactics or manipulation techniques", "Guidance on violating company IT policies", "Content unrelated to work, such as entertainment or dating", "Political, religious, or sensitive non-work-related discussions"]
}
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "openai_api_key" {
type = string
}
variable "redis_host" {
type = string
}After creating the policy, add deny-responses to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
ai_gateway_models:
- ref: my-gpt-4o
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: my-gpt-4o
name: my-gpt-4o
type: model
capabilities:
- generate
formats:
- type: openai
targets:
- name: gpt-4o
provider: my-openai-account
config:
type: openai
config:
route:
paths:
- "/v1"
model:
body_param: model
values:
- my-gpt-4o
logging:
payloads: false
policies:
- !ref deny-responses#nameAfter creating the policy, add deny-responses to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/models/my-gpt-4o \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "my-gpt-4o",
"name": "my-gpt-4o",
"type": "model",
"capabilities": [
"generate"
],
"formats": [
{
"type": "openai"
}
],
"policies": [
"deny-responses"
],
"targets": [
{
"name": "gpt-4o",
"provider": "my-openai-account",
"config": {
"type": "openai"
}
}
],
"config": {
"route": {
"paths": [
"/v1"
],
"model": {
"body_param": "model",
"values": [
"my-gpt-4o"
]
}
},
"logging": {
"payloads": false
}
}
}
'After creating the policy, add deny-responses to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
resource "konnect_ai_gateway_model" "my_model" {
display_name = "my-gpt-4o"
name = "my-gpt-4o"
type = "model"
capabilities = ["generate"]
formats = [
{
type = "openai"
} ]
targets = [
{
name = "gpt-4o"
provider = "my-openai-account"
config = {
type = "openai"
}
} ]
config = jsonencode({
route = {
paths = ["/v1"]
model = {
body_param = "model"
values = ["my-gpt-4o"]
}
}
logging = {
payloads = false
}
})
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "openai_api_key" {
type = string
}
variable "redis_host" {
type = string
}After creating the policy, add deny-responses to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
ai_gateway_consumers:
- ref: mobile-app-production
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: Mobile App - Production
name: mobile-app-production
type: api-key
policies:
- !ref deny-responses#nameAfter creating the policy, add deny-responses to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumers/mobile-app-production \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "Mobile App - Production",
"name": "mobile-app-production",
"type": "api-key",
"policies": [
"deny-responses"
]
}
'After creating the policy, add deny-responses to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
resource "konnect_ai_gateway_consumer" "my_consumer" {
display_name = "Mobile App - Production"
name = "mobile-app-production"
type = "api-key"
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "openai_api_key" {
type = string
}
variable "redis_host" {
type = string
}After creating the policy, add deny-responses to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
ai_gateway_consumer_groups:
- ref: internal-teams
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: Internal Teams
name: internal-teams
policies:
- !ref deny-responses#nameAfter creating the policy, add deny-responses to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumer-groups/internal-teams \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "Internal Teams",
"name": "internal-teams",
"policies": [
"deny-responses"
]
}
'After creating the policy, add deny-responses to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
resource "konnect_ai_gateway_consumer_group" "my_consumer_group" {
display_name = "Internal Teams"
name = "internal-teams"
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "openai_api_key" {
type = string
}
variable "redis_host" {
type = string
}