Skip to main content
A policy attaches behavior to a gateway’s traffic. Each policy configures one built-in plugin — identified by its slug (e.g. rate_limiter, semantic_cache, trustguard) — with settings, and runs at one or more lifecycle stages, with a mode, priority, and a scope (global or per consumer).
A policy’s slug is the plugin name it configures — always the underscore form (rate_limiter, token_rate_limiter, request_size_limiter, semantic_cache, …). Browse the live catalog and its settings schema at GET /v1/policies-catalog (same grouping as the Admin Console policy picker).

Built-in policies

TrustGate ships 13 policies in the Admin Console catalog, grouped as below:

Traffic control

Quota

Routing

Prompt management

Tool governance

Guardrails

NeuralTrust-native detection. The gateway ships several guardrail plugins, but the deepest jailbreak / PII / toxicity / tool-abuse detection is TrustGuard, attached via the trustguard policy. See the TrustGate integration.
To restrict which models a consumer may call, use consumer model_policies rather than a catalog policy.

Stages

A policy fires in one or more lifecycle stages: Some policies span two stages — the semantic cache looks up at pre_request and populates at post_response; the LLM Budget checks at pre_request and accrues usage at post_response. (A post_request stage exists in the model but is not executed on the proxy forward path.)

Mode

A policy’s mode sets its enforcement intent. Not every plugin supports every mode:

Ordering and scope

Global policies are the gateway-wide baseline (e.g. a default request-size guard); consumer-scoped policies tune behavior per tenant. The proxy resolves both sets and runs them in priority order. When same-priority policies run in parallel, only one may mutate a given part of the request/response per batch. Policies that partition by a key (the rate limiters and budgets) also accept a group_by_header to sub-partition within scope.

Managing policies

CRUD lives under /v1/gateways/{gateway_id}/policies, plus:
  • …/{id}/global (POST/DELETE) — promote/demote to global.
  • …/{id}/duplicate (POST) — clone a policy.
  • Attach to a consumer via …/consumers/{id}/policies/{policy_id}.
See the Policies API.