# AI Gateway policies

The gateway's `config/policies.json` declares which policies apps may use, and
each app picks from that menu in the order it wants. See
[Policy Chains](../policy-chains.mdx) for how a chain executes and how options
and secrets are inherited.

| Policy                                                                | What it does                                                                                         |
| --------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| [API key authentication](./authentication.mdx)                        | Requires an app API key and resolves the calling app from it                                         |
| [Model Filtering](./model-filtering.mdx)                              | Restricts the app to an allow list or block list of models, and supplies the default model           |
| [Fallback Model](./fallback-model.mdx)                                | Adds a backup model for provider errors and timeouts, and a cheaper model for when a budget runs out |
| [Budgets and Costs](./metering.mdx)                                   | Records usage and enforces the app's budgets for spend, tokens, and requests                         |
| [Semantic cache](./semantic-cache.mdx)                                | Returns a cached response when a new prompt is close enough to one already seen                      |
| [Akamai AI Firewall](./akamai-ai-firewall.mdx)                        | Scans prompts and completions with your Akamai configuration and blocks what it denies               |
| [Comet Opik tracing](./comet-opik-tracing.mdx)                        | Sends a trace of each request and response to Comet Opik                                             |
| [Galileo tracing](./galileo-tracing.mdx)                              | Sends a trace of each request and response to Galileo                                                |
| [Configuration Executor](../policy-chains.mdx#configuration-executor) | Loads the app's configuration and runs its chain—this is what makes app chains work                  |

The Configuration Executor and its companion Configuration Loader sit on the
gateway's route rather than in an app's chain. API key authentication runs in an
app's chain and protects that app alone. Any
[custom policy](../custom-policies.mdx) you declare joins the menu alongside
these.