Copy page

Policies

Akamai AI Firewall

akamai-ai-firewall-v2-inbound

The Akamai AI Firewall policy sends an app's prompts and completions to Akamai Firewall for AI and blocks a request or response that your Akamai configuration denies. It's the gateway's guardrail policy: it can answer a request itself instead of letting it reach the provider.

One entry covers both directions. The policy scans the prompt before the provider call and the completion afterward, including streaming responses—there's no separate outbound policy to add.

Detection rules and their categories live in Akamai Control Center, not in Zuplo. The policy forwards text and enforces the decision that comes back, acting only on rules that deny. Rules set to alert are ignored.

Adding the policy to an app

To protect every new app in a team, add the policy to the team's policy template.

Options

Option	Default	What it does
configurationId	—	Required. Your Akamai configuration
api-key	—	Required. Note the hyphen—apiKey is rejected
applicationId	—	Optional Akamai application identifier
endpoints	All shapes	Which API shapes to inspect
onUnknownShape	deny	What to do with a request shape the policy can't read
streamingAccumulation.enabled	true	Scan streaming completions. false stops scanning responses for streaming requests
streamingAccumulation.eventsInterval	5	How many streamed events to buffer between checks
streamingAccumulation.checkIntervalMs	none	Also check on a timer. Off unless set

Unknown option keys are rejected.

What a blocked caller sees

A block returns 400 in the provider's own error format—not problem details—with the Akamai rule ID in code:

Code
{
  "error": {
    "message": "Request blocked by AI Firewall during completion request. <rule message> (Rule: <ruleId>)",
    "code": "<ruleId>"
  }
}

For a streaming response, the gateway withholds output until each check passes, so blocked content never reaches the client. The stream then ends with a content-filter stop rather than an HTTP error, so clients see a content-filter finish reason. Holding events until a check returns adds to time to first token.

Blocked requests are counted against the app and appear in its Dashboard—see Monitoring usage.

Failure modes

Situation	Result
Options are invalid or incomplete	Fails closed—request rejected
The request body can't be read	Fails closed—request rejected
An endpoint shape the policy can't inspect, such as embeddings	400, code guardrail_uninspectable
Akamai is unreachable, or returns an error	Fails open—traffic proceeds unguarded

An endpoint the policy can't inspect is denied by default. That's different from an endpoint you exclude with endpoints, which passes through silently. A provider error response is never scanned.

If a request is rejected with a configuration error, the usual cause is a chain entry that overrode options and dropped the credential—entry options replace the declared ones wholesale rather than merging. Omit them to inherit. See Options and secrets.

Additional resources

• Akamai Firewall for AI
• Akamai AI security solutions