Skip to main content

AI Gateway policy

Stacklok Enterprise

The AI Gateway is a component of Stacklok Enterprise. For a full comparison of ToolHive Community and Stacklok Enterprise capabilities, see Stacklok Enterprise.

The AI Gateway sits between your AI tools and your large language model (LLM) providers, so every model request passes your policy, identity, and audit controls before it leaves your environment. This section covers the day-to-day governance decisions: which providers you connect, which models your users can reach, what gets screened out of prompts, and what any one person or team is allowed to spend.

How configuration works​

Gateway configuration is declarative. A single AIGateway custom resource describes the whole gateway, and the operator reconciles the running infrastructure to match it. You apply changes with kubectl apply (or through whatever GitOps flow you already use) and the operator converges.

Two things do not live on that resource:

  • Budgets and pricing are rows you manage through a REST API, not manifest fields. A budget is created, edited, and deleted independently of every other budget. See Budgets and pricing.
  • Access lists and MCP policy live on a separate AIPolicy resource, so they can be edited frequently without touching gateway infrastructure.

For every field on both resources, see the AI Gateway CRD reference. The pages in this section cover the tasks; the reference covers the fields.

Before you start​

The AI Gateway must already be installed. See Configure the AI Gateway for the install-time settings, and Deploy the platform for the full sequence.

Examples on these pages use -n <NAMESPACE>, where <NAMESPACE> is the namespace your AI Gateway is installed into.

Contents​