Policies

The Policies module defines what AI Gateway does with each request that reaches a route before forwarding it to the LLM Provider, and what it does with the returned response. Each policy is linked to a single route and combines three optional blocks: Prompt Guard (filtering by moderation or regex), Prompt Enrichment (messages injected before the prompt), and Rate Limit (quotas by requests or tokens).

IMPORTANT

You must configure at least one section to save the policy. The form lets you combine Prompt Guard (Request), Prompt Guard (Response), Prompt Enrichment, and Rate Limit in any arrangement, but at least one must be filled in.

Quick links

Learn how to:

• Filter and list policies
• View a policy
• Create a policy
• Edit a policy
• Delete a policy
• Review the route field
• Configure Prompt Guard (Request)
• Configure Prompt Guard (Response)
• Configure Prompt Enrichment
• Configure Rate Limit
• Review the required permissions

Listing

The Policies page lists registered policies with pagination. You can filter by:

• Route (optional): route associated with the policy.

Use Search to apply the filter and Clear to reset it.

Columns shown in the table:

• Route: associated route.
• Configured sections: indicates which sections are configured (Prompt Guard / Prompt Enrichment / Rate Limit).
• Created At: creation date and time.
• Actions: View and Delete icons for each row.

View Policy

In the Actions column of the row you want, click the View icon. The Policy details screen opens in read-only mode, showing:

• Route, Configured sections, and Created At at the top of the card, before the sections.
• Below that, only the sections actually configured on that policy — Prompt Guard (Request), Prompt Guard (Response), Prompt Enrichment, and Rate Limit — each with the same labels used in the form. A section that is not configured does not appear on the screen.

No field is editable on this screen. To change the policy, click the Edit button in the card header — see Edit Policy.

Create Policy

Edit Policy

Open the policy you want (see View Policy) and, on the Policy details screen, click the Edit button in the card header. The Update Policy form opens with the current data. Change the required fields and click Save.

Delete Policy

In the Actions column of the row you want, click the Delete icon. Confirm the operation in the "Do you want to delete policy [policyId]?" dialog.

IMPORTANT

Deletion is permanent and cannot be undone. Deleting a policy makes the associated route accept requests without guardrails, prompt enrichment, or rate limiting.

Required field

Prompt Guard (Request)

This optional block validates the request before it reaches the LLM provider. It combines three subfeatures: moderation, regex, and custom response.

MODERATION AND REGEX CAN BE COMBINED

Moderation and regex can be used together in the same Prompt Guard Request. Filling in one does not disable the other: when both are configured, the request must pass both checks, and the same custom response applies to whichever one blocks it.

Fields: Moderation subblock

Fields: Regex subblock

Fields: Custom response subblock

Custom response returned when the request is rejected by moderation or regex.

The two fields are always filled in together: providing one makes the other required. In addition, the whole Custom response pair becomes required when:

• the Moderation subblock is configured; or
• the Regex action is Reject.

WHEN THE CUSTOM RESPONSE IS OPTIONAL

The Custom response pair is optional only when the Prompt Guard Request is limited to a regex with Regex action = Mask, without moderation. In that case the content is masked and the request continues to the provider, so there is no blocking response to return.

Prompt Guard (Response)

This optional block validates the response returned by the provider before returning it to the requester. There is no moderation here, only regex and custom response, with the same pairing logic as the request.

STREAMING RESPONSES

For now, only responses returned without streaming are masked by the expressions configured in this section.

Fields: Regex subblock (response)

Fields: Custom response subblock (response)

Prompt Enrichment

This block is optional as a section, but has required internal rules when enabled. When you add at least one message, you must provide at least one complete entry (role + content). Messages are prepended to the original prompt in the order they appear in the list.

Use Add message to add a new Message entry and the delete icon to remove entries.

Fields by message

AVAILABLE ROLES

system and developer are the only selectable roles. They are the ones that make sense for instructions prepended to the prompt. If a policy shows a different role when opened for editing, the form flags it with the message This role is no longer supported. Select "system" or "developer". and requires the change before saving.

Rate Limit

This optional block limits consumption by time window. When enabled, it requires you to choose exactly one limit type: requests or tokens.

MUTUAL EXCLUSION

The policy cannot include requestCount and tokenCount at the same time. Choose one of them.

The screen shows a Rate limit type selector with Tokens and Requests buttons that determine which format is used.

Fields

Permissions

Access to each action in the Policies journey depends on its own permission. Without the corresponding permission, the screen element does not appear — the interface never shows an unavailable action as disabled.

Permissions are granted in Access Control, on the Roles screen, under the AI Gateway product. The table below lists each one exactly as Access Control displays it.

The last two belong to other journeys and are required by specific Policies actions, shown in the next table.

View: the Moderation API Key's (provider) suffix additionally requires View API Key. Without it, the field shows only the bare id.

Create and Edit: List Routes is what feeds the form's Route field with the available routes.

EDITING REQUIRES VIEWING

The Edit button only exists inside the Policy details screen. Because of that, a user holding Create and Update Policies but not View Policy has no path to edit an existing policy. This is expected platform behavior, not a bug.