ACL Policy

The ACL (access control list) policy allows you to restrict AI Consumers or AI Consumer Groups access to AI Gateway entities. This is the same capability provided by access.acls for AI Models, AI MCP Servers, and AI Agents. However, the policy provides additional configuration options.

You can configure either an allow list or a deny list with AI Consumers, AI Consumer Groups or authenticated groups (discovered by an AI Auth Strategy running in openid-connect mode).

The ACL policy requires that AI Consumers are authenticated and you should set up AI Auth Strategies before enabling this policy.

If hide_groups_header is set to false and an AI Consumer is validated, AI Gateway appends a X-Consumer-Groups header to the request before proxying it to the upstream service. The header contains a comma separated list of groups that belong to the AI Consumer, for example admin, pro_user. This allows you to identify the groups associated with the AI Consumer.