Replies: 2 comments
-
|
We initially explored implementing system policies directly inside the policy-engine (compiled in via system policy manifests and enforced at the engine layer), but that approach had several limitations and complexities when complying with the current architecture. Based on those findings, we’ve now moved the system policy logic into the gateway-controller, where policies are injected into the derived policy chains before they are sent to the policy-engine. New approach (gateway-controller driven):
|
Beta Was this translation helpful? Give feedback.
-
|
This is completed. Closing the discussion. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Problem
This requirement emerged during the implementation of the API analytics feature, specifically for AI and MCP analytics use cases.
AI analytics requires access to metadata such as:
For MCP analytics, it requires access to metadata such as:
In the current gateway behavior, when an API is deployed without any policies attached, the policy engine does not provide a way to intercept requests or responses. As a result, extracting the required metadata is not possible unless a policy is explicitly attached, which is not appropriate for system-level concerns.
Beyond the current analytics use case, similar interception capabilities may be required as new platform features are introduced in the future. These requirements may arise during feature implementation and should be supported without requiring API developers to attach policies or modify their API configurations.
Proposed Approach
Introduce a system-managed interception mechanism (system logic / system policy).
Key characteristics:
Capabilities:
Beta Was this translation helpful? Give feedback.
All reactions