A policy attaches behavior to a gateway’s traffic. Each policy configures one built-in
plugin — identified by its slug (e.g. rate_limiter, semantic_cache, cors) — with
settings, and runs at one or more lifecycle stages, with a mode, priority, and a
scope (global or per consumer).
A policy’s slug is the plugin name it configures — always the underscore form
(rate_limiter, token_rate_limiter, request_size_limiter, semantic_cache, …). Browse
the live catalog and its settings schema at GET /v1/policies-catalog.
Built-in policies
TrustGate ships 16 built-in plugins, grouped by purpose:
Traffic control
Policy (slug) | Purpose |
|---|
rate_limiter | Per-consumer / per-gateway request rate limiting (sliding window). |
request_size_limiter | Reject requests above a byte / character budget. |
per_tool_rate_limiter | Rate-limit individual tool calls observed in responses. |
cors | Cross-origin resource sharing for browser clients. |
Quota & cost
Policy (slug) | Purpose |
|---|
token_rate_limiter (“LLM Budget”) | Token or dollar budgets over time windows, aggregate or per-model. |
cost_cap (“LLM Cost Cap”) | Per-request guard on a model’s list price per 1k tokens. |
Routing
Policy (slug) | Purpose |
|---|
semantic_cache | Exact or embedding-similarity response caching. |
model_allowlist | Restrict which models a consumer/gateway may call. |
tool_allowlist | Allow/deny the tools in a request tools[] array. |
Prompt management
Policy (slug) | Purpose |
|---|
prompt_template | Inject context-bound system prompts and render named, versioned templates. |
Policy (slug) | Purpose |
|---|
tool_call_validation | Validate / redact the tool calls a model returns. |
tool_definition_transformation | Patch tool schemas, override descriptions, and inject tools. |
Guardrails
Policy (slug) | Purpose |
|---|
trustguard | Inspect prompts/responses with TrustGuard (jailbreaks, PII, toxicity, tool abuse). |
openai_moderation | Screen text with the OpenAI Moderations API. |
azure_content_safety | Screen text with Azure AI Content Safety. |
bedrock_guardrail | Apply an AWS Bedrock guardrail (topics, content, PII, grounding). |
NeuralTrust-native detection. The gateway ships several guardrail plugins, but the
deepest jailbreak / PII / toxicity / tool-abuse detection is TrustGuard,
attached via the trustguard policy. See the
TrustGate integration.
Stages
A policy fires in one or more lifecycle stages:
| Stage | When |
|---|
pre_request | Before the request is forwarded upstream. |
pre_response | After the upstream responds, before returning to the client. |
post_response | After the response is returned (e.g. cache populate, budget accrual). |
pre_request and populates at post_response; the
LLM Budget checks at pre_request and accrues usage at
post_response. (A post_request stage exists in the model but is not executed on the proxy
forward path.)
Mode
A policy’s mode sets its enforcement intent. Not every plugin supports every mode:
| Mode | Behavior |
|---|
enforce | Act on violations — reject, transform, or block (default). |
throttle | Delay rather than reject (supported by the rate/budget plugins). |
observe | Record only — no enforcement. |
Ordering and scope
| Field | Meaning |
|---|
slug | The built-in plugin this policy configures. |
settings | The policy’s configuration (limits, thresholds, origins…). |
priority | Lower runs earlier. |
parallel | Run alongside other same-priority policies concurrently. |
global | Apply to all consumers in the gateway. |
enabled | Toggle without deleting. |
priority order. When same-priority policies run in parallel, only one may mutate
a given part of the request/response per batch. Policies that partition by a key (the rate
limiters and budgets) also accept a group_by_header to sub-partition within scope.
Managing policies
CRUD lives under /v1/gateways/{gateway_id}/policies, plus:
…/{id}/global (POST/DELETE) — promote/demote to global.…/{id}/duplicate (POST) — clone a policy.- Attach to a consumer via
…/consumers/{id}/policies/{policy_id}.
See the Policies API. 
