AI Semantic Prompt Guard: Allow and deny messages - Plugin

Allow and deny messagesv3.8+

Allows messages about a topic as long as they don’t contain information about another topic. For example, only allow questions about cats that aren’t related to dogs. Topics on the deny list take precedence over the allowed topics.

Prerequisites

A Redis instance

Environment variables

OPENAI_API_KEY: Your OpenAI API key

Set up the plugin

Add this section to your declarative configuration file:

_format_version: "3.0"
plugins:
  - name: ai-semantic-prompt-guard
    config:
      embeddings:
        auth:
          header_name: Authorization
          header_value: ${{ env "DECK_OPENAI_API_KEY" }}
        model:
          name: text-embedding-3-small
          provider: openai
      search:
        threshold: 0.7
      vectordb:
        strategy: redis
        distance_metric: cosine
        threshold: 0.5
        dimensions: 1024
        redis:
          host: localhost
          port: 6379
      rules:
        match_all_conversation_history: true
        allow_prompts:
        - Questions about cats
        deny_prompts:
        - Anything related to dogs

Make the following request:

curl -i -X POST http://localhost:8001/plugins/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "ai-semantic-prompt-guard",
      "config": {
        "embeddings": {
          "auth": {
            "header_name": "Authorization",
            "header_value": "'$OPENAI_API_KEY'"
          },
          "model": {
            "name": "text-embedding-3-small",
            "provider": "openai"
          }
        },
        "search": {
          "threshold": 0.7
        },
        "vectordb": {
          "strategy": "redis",
          "distance_metric": "cosine",
          "threshold": 0.5,
          "dimensions": 1024,
          "redis": {
            "host": "localhost",
            "port": 6379
          }
        },
        "rules": {
          "match_all_conversation_history": true,
          "allow_prompts": [
            "Questions about cats"
          ],
          "deny_prompts": [
            "Anything related to dogs"
          ]
        }
      }
    }
    '

Make the following request:

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/plugins/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "ai-semantic-prompt-guard",
      "config": {
        "embeddings": {
          "auth": {
            "header_name": "Authorization",
            "header_value": "'$OPENAI_API_KEY'"
          },
          "model": {
            "name": "text-embedding-3-small",
            "provider": "openai"
          }
        },
        "search": {
          "threshold": 0.7
        },
        "vectordb": {
          "strategy": "redis",
          "distance_metric": "cosine",
          "threshold": 0.5,
          "dimensions": 1024,
          "redis": {
            "host": "localhost",
            "port": 6379
          }
        },
        "rules": {
          "match_all_conversation_history": true,
          "allow_prompts": [
            "Questions about cats"
          ],
          "deny_prompts": [
            "Anything related to dogs"
          ]
        }
      }
    }
    '

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
controlPlaneId: The id of the control plane.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.

See the Konnect API reference to learn about region-specific URLs and personal access tokens.

echo "
apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: ai-semantic-prompt-guard
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
  labels:
    global: 'true'
config:
  embeddings:
    auth:
      header_name: Authorization
      header_value: '$OPENAI_API_KEY'
    model:
      name: text-embedding-3-small
      provider: openai
  search:
    threshold: 0.7
  vectordb:
    strategy: redis
    distance_metric: cosine
    threshold: 0.5
    dimensions: 1024
    redis:
      host: localhost
      port: 6379
  rules:
    match_all_conversation_history: true
    allow_prompts:
    - Questions about cats
    deny_prompts:
    - Anything related to dogs
plugin: ai-semantic-prompt-guard
" | kubectl apply -f -

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Add the following to your Terraform configuration to create a Konnect Gateway Plugin:

resource "konnect_gateway_plugin_ai_semantic_prompt_guard" "my_ai_semantic_prompt_guard" {
  enabled = true

  config = {

    embeddings = {

      auth = {
        header_name = "Authorization"
        header_value = var.openai_api_key
      }

      model = {
        name = "text-embedding-3-small"
        provider = "openai"
      }
    }

    search = {
      threshold = 0.7
    }

    vectordb = {
      strategy = "redis"
      distance_metric = "cosine"
      threshold = 0.5
      dimensions = 1024

      redis = {
        host = "localhost"
        port = 6379
      }
    }

    rules = {
      match_all_conversation_history = true
      allow_prompts = ["Questions about cats"]
      deny_prompts = ["Anything related to dogs"]
    }
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
}

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "openai_api_key" {
  type = string
}

Add this section to your declarative configuration file:

_format_version: "3.0"
plugins:
  - name: ai-semantic-prompt-guard
    service: serviceName|Id
    config:
      embeddings:
        auth:
          header_name: Authorization
          header_value: ${{ env "DECK_OPENAI_API_KEY" }}
        model:
          name: text-embedding-3-small
          provider: openai
      search:
        threshold: 0.7
      vectordb:
        strategy: redis
        distance_metric: cosine
        threshold: 0.5
        dimensions: 1024
        redis:
          host: localhost
          port: 6379
      rules:
        match_all_conversation_history: true
        allow_prompts:
        - Questions about cats
        deny_prompts:
        - Anything related to dogs

Make sure to replace the following placeholders with your own values:

serviceName|Id: The id or name of the service the plugin configuration will target.

Make the following request:

curl -i -X POST http://localhost:8001/services/{serviceName|Id}/plugins/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "ai-semantic-prompt-guard",
      "config": {
        "embeddings": {
          "auth": {
            "header_name": "Authorization",
            "header_value": "'$OPENAI_API_KEY'"
          },
          "model": {
            "name": "text-embedding-3-small",
            "provider": "openai"
          }
        },
        "search": {
          "threshold": 0.7
        },
        "vectordb": {
          "strategy": "redis",
          "distance_metric": "cosine",
          "threshold": 0.5,
          "dimensions": 1024,
          "redis": {
            "host": "localhost",
            "port": 6379
          }
        },
        "rules": {
          "match_all_conversation_history": true,
          "allow_prompts": [
            "Questions about cats"
          ],
          "deny_prompts": [
            "Anything related to dogs"
          ]
        }
      }
    }
    '

Make sure to replace the following placeholders with your own values:

serviceName|Id: The id or name of the service the plugin configuration will target.

Make the following request:

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/services/{serviceId}/plugins/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "ai-semantic-prompt-guard",
      "config": {
        "embeddings": {
          "auth": {
            "header_name": "Authorization",
            "header_value": "'$OPENAI_API_KEY'"
          },
          "model": {
            "name": "text-embedding-3-small",
            "provider": "openai"
          }
        },
        "search": {
          "threshold": 0.7
        },
        "vectordb": {
          "strategy": "redis",
          "distance_metric": "cosine",
          "threshold": 0.5,
          "dimensions": 1024,
          "redis": {
            "host": "localhost",
            "port": 6379
          }
        },
        "rules": {
          "match_all_conversation_history": true,
          "allow_prompts": [
            "Questions about cats"
          ],
          "deny_prompts": [
            "Anything related to dogs"
          ]
        }
      }
    }
    '

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
controlPlaneId: The id of the control plane.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
serviceId: The id of the service the plugin configuration will target.

See the Konnect API reference to learn about region-specific URLs and personal access tokens.

echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: ai-semantic-prompt-guard
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
config:
  embeddings:
    auth:
      header_name: Authorization
      header_value: '$OPENAI_API_KEY'
    model:
      name: text-embedding-3-small
      provider: openai
  search:
    threshold: 0.7
  vectordb:
    strategy: redis
    distance_metric: cosine
    threshold: 0.5
    dimensions: 1024
    redis:
      host: localhost
      port: 6379
  rules:
    match_all_conversation_history: true
    allow_prompts:
    - Questions about cats
    deny_prompts:
    - Anything related to dogs
plugin: ai-semantic-prompt-guard
" | kubectl apply -f -

Next, apply the KongPlugin resource by annotating the service resource:

kubectl annotate -n kong service SERVICE_NAME konghq.com/plugins=ai-semantic-prompt-guard

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Add the following to your Terraform configuration to create a Konnect Gateway Plugin:

resource "konnect_gateway_plugin_ai_semantic_prompt_guard" "my_ai_semantic_prompt_guard" {
  enabled = true

  config = {

    embeddings = {

      auth = {
        header_name = "Authorization"
        header_value = var.openai_api_key
      }

      model = {
        name = "text-embedding-3-small"
        provider = "openai"
      }
    }

    search = {
      threshold = 0.7
    }

    vectordb = {
      strategy = "redis"
      distance_metric = "cosine"
      threshold = 0.5
      dimensions = 1024

      redis = {
        host = "localhost"
        port = 6379
      }
    }

    rules = {
      match_all_conversation_history = true
      allow_prompts = ["Questions about cats"]
      deny_prompts = ["Anything related to dogs"]
    }
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
  service = {
    id = konnect_gateway_service.my_service.id
  }
}

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "openai_api_key" {
  type = string
}

Add this section to your declarative configuration file:

_format_version: "3.0"
plugins:
  - name: ai-semantic-prompt-guard
    route: routeName|Id
    config:
      embeddings:
        auth:
          header_name: Authorization
          header_value: ${{ env "DECK_OPENAI_API_KEY" }}
        model:
          name: text-embedding-3-small
          provider: openai
      search:
        threshold: 0.7
      vectordb:
        strategy: redis
        distance_metric: cosine
        threshold: 0.5
        dimensions: 1024
        redis:
          host: localhost
          port: 6379
      rules:
        match_all_conversation_history: true
        allow_prompts:
        - Questions about cats
        deny_prompts:
        - Anything related to dogs

Make sure to replace the following placeholders with your own values:

routeName|Id: The id or name of the route the plugin configuration will target.

Make the following request:

curl -i -X POST http://localhost:8001/routes/{routeName|Id}/plugins/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "ai-semantic-prompt-guard",
      "config": {
        "embeddings": {
          "auth": {
            "header_name": "Authorization",
            "header_value": "'$OPENAI_API_KEY'"
          },
          "model": {
            "name": "text-embedding-3-small",
            "provider": "openai"
          }
        },
        "search": {
          "threshold": 0.7
        },
        "vectordb": {
          "strategy": "redis",
          "distance_metric": "cosine",
          "threshold": 0.5,
          "dimensions": 1024,
          "redis": {
            "host": "localhost",
            "port": 6379
          }
        },
        "rules": {
          "match_all_conversation_history": true,
          "allow_prompts": [
            "Questions about cats"
          ],
          "deny_prompts": [
            "Anything related to dogs"
          ]
        }
      }
    }
    '

Make sure to replace the following placeholders with your own values:

routeName|Id: The id or name of the route the plugin configuration will target.

Make the following request:

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/routes/{routeId}/plugins/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "ai-semantic-prompt-guard",
      "config": {
        "embeddings": {
          "auth": {
            "header_name": "Authorization",
            "header_value": "'$OPENAI_API_KEY'"
          },
          "model": {
            "name": "text-embedding-3-small",
            "provider": "openai"
          }
        },
        "search": {
          "threshold": 0.7
        },
        "vectordb": {
          "strategy": "redis",
          "distance_metric": "cosine",
          "threshold": 0.5,
          "dimensions": 1024,
          "redis": {
            "host": "localhost",
            "port": 6379
          }
        },
        "rules": {
          "match_all_conversation_history": true,
          "allow_prompts": [
            "Questions about cats"
          ],
          "deny_prompts": [
            "Anything related to dogs"
          ]
        }
      }
    }
    '

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
controlPlaneId: The id of the control plane.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
routeId: The id of the route the plugin configuration will target.

See the Konnect API reference to learn about region-specific URLs and personal access tokens.

echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: ai-semantic-prompt-guard
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
config:
  embeddings:
    auth:
      header_name: Authorization
      header_value: '$OPENAI_API_KEY'
    model:
      name: text-embedding-3-small
      provider: openai
  search:
    threshold: 0.7
  vectordb:
    strategy: redis
    distance_metric: cosine
    threshold: 0.5
    dimensions: 1024
    redis:
      host: localhost
      port: 6379
  rules:
    match_all_conversation_history: true
    allow_prompts:
    - Questions about cats
    deny_prompts:
    - Anything related to dogs
plugin: ai-semantic-prompt-guard
" | kubectl apply -f -

Next, apply the KongPlugin resource by annotating the httproute or ingress resource:

kubectl annotate -n kong httproute  konghq.com/plugins=ai-semantic-prompt-guard

kubectl annotate -n kong ingress  konghq.com/plugins=ai-semantic-prompt-guard

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Add the following to your Terraform configuration to create a Konnect Gateway Plugin:

resource "konnect_gateway_plugin_ai_semantic_prompt_guard" "my_ai_semantic_prompt_guard" {
  enabled = true

  config = {

    embeddings = {

      auth = {
        header_name = "Authorization"
        header_value = var.openai_api_key
      }

      model = {
        name = "text-embedding-3-small"
        provider = "openai"
      }
    }

    search = {
      threshold = 0.7
    }

    vectordb = {
      strategy = "redis"
      distance_metric = "cosine"
      threshold = 0.5
      dimensions = 1024

      redis = {
        host = "localhost"
        port = 6379
      }
    }

    rules = {
      match_all_conversation_history = true
      allow_prompts = ["Questions about cats"]
      deny_prompts = ["Anything related to dogs"]
    }
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
  route = {
    id = konnect_gateway_route.my_route.id
  }
}

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "openai_api_key" {
  type = string
}

Add this section to your declarative configuration file:

_format_version: "3.0"
plugins:
  - name: ai-semantic-prompt-guard
    consumer: consumerName|Id
    config:
      embeddings:
        auth:
          header_name: Authorization
          header_value: ${{ env "DECK_OPENAI_API_KEY" }}
        model:
          name: text-embedding-3-small
          provider: openai
      search:
        threshold: 0.7
      vectordb:
        strategy: redis
        distance_metric: cosine
        threshold: 0.5
        dimensions: 1024
        redis:
          host: localhost
          port: 6379
      rules:
        match_all_conversation_history: true
        allow_prompts:
        - Questions about cats
        deny_prompts:
        - Anything related to dogs

Make sure to replace the following placeholders with your own values:

consumerName|Id: The id or name of the consumer the plugin configuration will target.

Make the following request:

curl -i -X POST http://localhost:8001/consumers/{consumerName|Id}/plugins/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "ai-semantic-prompt-guard",
      "config": {
        "embeddings": {
          "auth": {
            "header_name": "Authorization",
            "header_value": "'$OPENAI_API_KEY'"
          },
          "model": {
            "name": "text-embedding-3-small",
            "provider": "openai"
          }
        },
        "search": {
          "threshold": 0.7
        },
        "vectordb": {
          "strategy": "redis",
          "distance_metric": "cosine",
          "threshold": 0.5,
          "dimensions": 1024,
          "redis": {
            "host": "localhost",
            "port": 6379
          }
        },
        "rules": {
          "match_all_conversation_history": true,
          "allow_prompts": [
            "Questions about cats"
          ],
          "deny_prompts": [
            "Anything related to dogs"
          ]
        }
      }
    }
    '

Make sure to replace the following placeholders with your own values:

consumerName|Id: The id or name of the consumer the plugin configuration will target.

Make the following request:

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/consumers/{consumerId}/plugins/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "ai-semantic-prompt-guard",
      "config": {
        "embeddings": {
          "auth": {
            "header_name": "Authorization",
            "header_value": "'$OPENAI_API_KEY'"
          },
          "model": {
            "name": "text-embedding-3-small",
            "provider": "openai"
          }
        },
        "search": {
          "threshold": 0.7
        },
        "vectordb": {
          "strategy": "redis",
          "distance_metric": "cosine",
          "threshold": 0.5,
          "dimensions": 1024,
          "redis": {
            "host": "localhost",
            "port": 6379
          }
        },
        "rules": {
          "match_all_conversation_history": true,
          "allow_prompts": [
            "Questions about cats"
          ],
          "deny_prompts": [
            "Anything related to dogs"
          ]
        }
      }
    }
    '

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
controlPlaneId: The id of the control plane.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
consumerId: The id of the consumer the plugin configuration will target.

See the Konnect API reference to learn about region-specific URLs and personal access tokens.

echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: ai-semantic-prompt-guard
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
config:
  embeddings:
    auth:
      header_name: Authorization
      header_value: '$OPENAI_API_KEY'
    model:
      name: text-embedding-3-small
      provider: openai
  search:
    threshold: 0.7
  vectordb:
    strategy: redis
    distance_metric: cosine
    threshold: 0.5
    dimensions: 1024
    redis:
      host: localhost
      port: 6379
  rules:
    match_all_conversation_history: true
    allow_prompts:
    - Questions about cats
    deny_prompts:
    - Anything related to dogs
plugin: ai-semantic-prompt-guard
" | kubectl apply -f -

Next, apply the KongPlugin resource by annotating the KongConsumer resource:

kubectl annotate -n kong  CONSUMER_NAME konghq.com/plugins=ai-semantic-prompt-guard

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Add the following to your Terraform configuration to create a Konnect Gateway Plugin:

resource "konnect_gateway_plugin_ai_semantic_prompt_guard" "my_ai_semantic_prompt_guard" {
  enabled = true

  config = {

    embeddings = {

      auth = {
        header_name = "Authorization"
        header_value = var.openai_api_key
      }

      model = {
        name = "text-embedding-3-small"
        provider = "openai"
      }
    }

    search = {
      threshold = 0.7
    }

    vectordb = {
      strategy = "redis"
      distance_metric = "cosine"
      threshold = 0.5
      dimensions = 1024

      redis = {
        host = "localhost"
        port = 6379
      }
    }

    rules = {
      match_all_conversation_history = true
      allow_prompts = ["Questions about cats"]
      deny_prompts = ["Anything related to dogs"]
    }
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
  consumer = {
    id = konnect_gateway_consumer.my_consumer.id
  }
}

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "openai_api_key" {
  type = string
}

Add this section to your declarative configuration file:

_format_version: "3.0"
plugins:
  - name: ai-semantic-prompt-guard
    consumer_group: consumerGroupName|Id
    config:
      embeddings:
        auth:
          header_name: Authorization
          header_value: ${{ env "DECK_OPENAI_API_KEY" }}
        model:
          name: text-embedding-3-small
          provider: openai
      search:
        threshold: 0.7
      vectordb:
        strategy: redis
        distance_metric: cosine
        threshold: 0.5
        dimensions: 1024
        redis:
          host: localhost
          port: 6379
      rules:
        match_all_conversation_history: true
        allow_prompts:
        - Questions about cats
        deny_prompts:
        - Anything related to dogs

Make sure to replace the following placeholders with your own values:

consumerGroupName|Id: The id or name of the consumer group the plugin configuration will target.

Make the following request:

curl -i -X POST http://localhost:8001/consumer_groups/{consumerGroupName|Id}/plugins/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "ai-semantic-prompt-guard",
      "config": {
        "embeddings": {
          "auth": {
            "header_name": "Authorization",
            "header_value": "'$OPENAI_API_KEY'"
          },
          "model": {
            "name": "text-embedding-3-small",
            "provider": "openai"
          }
        },
        "search": {
          "threshold": 0.7
        },
        "vectordb": {
          "strategy": "redis",
          "distance_metric": "cosine",
          "threshold": 0.5,
          "dimensions": 1024,
          "redis": {
            "host": "localhost",
            "port": 6379
          }
        },
        "rules": {
          "match_all_conversation_history": true,
          "allow_prompts": [
            "Questions about cats"
          ],
          "deny_prompts": [
            "Anything related to dogs"
          ]
        }
      }
    }
    '

Make sure to replace the following placeholders with your own values:

consumerGroupName|Id: The id or name of the consumer group the plugin configuration will target.

Make the following request:

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/consumer_groups/{consumerGroupId}/plugins/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "ai-semantic-prompt-guard",
      "config": {
        "embeddings": {
          "auth": {
            "header_name": "Authorization",
            "header_value": "'$OPENAI_API_KEY'"
          },
          "model": {
            "name": "text-embedding-3-small",
            "provider": "openai"
          }
        },
        "search": {
          "threshold": 0.7
        },
        "vectordb": {
          "strategy": "redis",
          "distance_metric": "cosine",
          "threshold": 0.5,
          "dimensions": 1024,
          "redis": {
            "host": "localhost",
            "port": 6379
          }
        },
        "rules": {
          "match_all_conversation_history": true,
          "allow_prompts": [
            "Questions about cats"
          ],
          "deny_prompts": [
            "Anything related to dogs"
          ]
        }
      }
    }
    '

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
controlPlaneId: The id of the control plane.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
consumerGroupId: The id of the consumer group the plugin configuration will target.

See the Konnect API reference to learn about region-specific URLs and personal access tokens.

echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: ai-semantic-prompt-guard
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
config:
  embeddings:
    auth:
      header_name: Authorization
      header_value: '$OPENAI_API_KEY'
    model:
      name: text-embedding-3-small
      provider: openai
  search:
    threshold: 0.7
  vectordb:
    strategy: redis
    distance_metric: cosine
    threshold: 0.5
    dimensions: 1024
    redis:
      host: localhost
      port: 6379
  rules:
    match_all_conversation_history: true
    allow_prompts:
    - Questions about cats
    deny_prompts:
    - Anything related to dogs
plugin: ai-semantic-prompt-guard
" | kubectl apply -f -

Next, apply the KongPlugin resource by annotating the KongConsumerGroup resource:

kubectl annotate -n kong  CONSUMERGROUP_NAME konghq.com/plugins=ai-semantic-prompt-guard

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Add the following to your Terraform configuration to create a Konnect Gateway Plugin:

resource "konnect_gateway_plugin_ai_semantic_prompt_guard" "my_ai_semantic_prompt_guard" {
  enabled = true

  config = {

    embeddings = {

      auth = {
        header_name = "Authorization"
        header_value = var.openai_api_key
      }

      model = {
        name = "text-embedding-3-small"
        provider = "openai"
      }
    }

    search = {
      threshold = 0.7
    }

    vectordb = {
      strategy = "redis"
      distance_metric = "cosine"
      threshold = 0.5
      dimensions = 1024

      redis = {
        host = "localhost"
        port = 6379
      }
    }

    rules = {
      match_all_conversation_history = true
      allow_prompts = ["Questions about cats"]
      deny_prompts = ["Anything related to dogs"]
    }
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
  consumer_group = {
    id = konnect_gateway_consumer_group.my_consumer_group.id
  }
}

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "openai_api_key" {
  type = string
}

AI Semantic Prompt Guard

Allow and deny messagesv3.8+

Prerequisites

Environment variables

Set up the plugin

Help us make these docs great!

Still need help