The Prisma AIRS API Intercept plugin captures chat completion requests and responses, passes them onto Prisma AIRS, and
acts on the scan result, either blocking or forwarding the data.
The priority of this plugin is 1000 (executes early in the plugin chain).
The following diagram illustrates how the plugin handles requests and responses:
sequenceDiagram
autonumber
participant Client
participant Plugin as Kong Gateway
Prisma AIRS Plugin
participant Prisma as Prisma AIRS
API Intercept
participant LLM
Client->>Plugin: Send request with user prompt
Plugin->>Plugin: Extract user prompt
Plugin->>Prisma: Send prompt for scanning
Prisma-->>Plugin: Scan result
alt Prompt is malicious
Plugin->>Client: Return 403 Forbidden
else Prompt is benign
Plugin->>LLM: Forward request
LLM-->>Plugin: Return completion
Plugin->>Plugin: Buffer and extract response text
Plugin->>Prisma: Send response for scanning
Prisma-->>Plugin: Scan result
alt Response is malicious
Plugin->>Client: Return 403 Forbidden
else Response is benign
Plugin->>Client: Return LLM response
end
end
In the access phase:
-
Request interception: Plugin captures incoming chat completion requests.
-
Prompt extraction: Extracts user messages from the request payload.
-
Security scan: Sends prompt to Prisma AIRS for threat analysis.
-
Verdict enforcement: Blocks (403) or allows request based on scan results.
In the response phase:
-
Response buffering: Captures LLM response for post-processing.
-
Response scan: Scans the LLM completion for security issues.
-
Final delivery: Returns response to client if both scans pass.
The plugin expects OpenAI-compatible chat completion format:
{
"model": "gpt-3.5-turbo",
"messages": [
{
"role": "user",
"content": "Your prompt here"
}
]
}
The plugin sends enriched metadata to Prisma AIRS. Here’s an example of a scan payload:
{
"tr_id": "{request_id}",
"ai_profile": {
"profile_name": "configured-profile"
},
"contents": [{
"prompt": "user message",
"response": "llm completion"
}],
"metadata": {
"app_name": "kong",
"app_user": "service-name",
"ai_model": "model-identifier"
}
}
The plugin fails closed (blocks requests) in the following scenarios:
- Missing or empty user prompt.
- API communication failures.
- Non-200 API responses.
- Malformed API responses.
- Security verdict is not “allow”.
You can find details on each error in the logs.
