Policies
AI Gateway policies
The gateway's config/policies.json declares which policies apps may use, and
each app picks from that menu in the order it wants. See
Policy Chains for how a chain executes and how options
and secrets are inherited.
| Policy | What it does |
|---|---|
| API key authentication | Requires an app API key and resolves the calling app from it |
| Model Filtering | Restricts the app to an allow list or block list of models, and supplies the default model |
| Fallback Model | Adds a backup model for provider errors and timeouts, and a cheaper model for when a budget runs out |
| Budgets and Costs | Records usage and enforces the app's budgets for spend, tokens, and requests |
| Semantic cache | Returns a cached response when a new prompt is close enough to one already seen |
| Akamai AI Firewall | Scans prompts and completions with your Akamai configuration and blocks what it denies |
| Comet Opik tracing | Sends a trace of each request and response to Comet Opik |
| Galileo tracing | Sends a trace of each request and response to Galileo |
| Configuration Executor | Loads the app's configuration and runs its chain—this is what makes app chains work |
The Configuration Executor and its companion Configuration Loader sit on the gateway's route rather than in an app's chain. API key authentication runs in an app's chain and protects that app alone. Any custom policy you declare joins the menu alongside these.
Last modified on