A policy attaches one built-in plugin to a gateway. It runs at one or more lifecycle stages and can cover the whole gateway or selected consumers.
Rate limits and budgets
Request rate, per-tool rate, and LLM token budgets.
Request size
Cap payload size before the request is forwarded.
Prompt and model controls
Prompt templates and compression.
Tool governance
Allow-lists, injection, and per-tool limits for MCP and function calling.
Guardrails
TrustGuard, provider moderation, and regex replace.
TrustGuard integration
Native collector — no
tgk_ key on the TrustGate path.Policies screen
Open Agent Gateway → Policies.Create or edit
- Catalog → pick a plugin, or New policy.
- Set Name (catalog types use a fixed prefix where required).
- Scope
- Mode: Enforce · Observe · Throttle (when the plugin supports it).
- Coverage: Gateway-wide or Targeted (pick consumers).
- Fill Configuration (dedicated form or schema-driven fields).
- Save. Use Pause / Resume / Delete from the detail panel without losing history of attachments.
Attach from a consumer
Open a consumer → Policies → Add Policy, or Clone policies from another consumer. Global policies still apply automatically.Catalog (UI plugins)
Traffic control
Quota
Prompt management
Tool governance
Guardrails
TrustGuard in the UI. Adding the TrustGuard policy walks you through selecting or creating an Agent Runtime collector. Connection details are injected by the platform; you do not paste base URLs by hand in normal SaaS use.The live Catalog tab is authoritative for what you can add in your tenant.