Create Your First AI Gateway Policy

• A policy in Monitor only mode, so nothing is blocked while you tune it
• Model access, size limits, and a rate limit that fit your app
• A daily budget with the enforcement style you choose
• A tested path from a simulated request to a real one

You will need an owner or admin role in your organization, an AI plan (policy enforcement is part of the AI plans), and a virtual key for the app you want to govern. Virtual keys are in AI → Credentials & Keys.

A policy supplies the rules for steps two to six. If a request breaks a rule in an enforcing policy, it stops there, and the provider never sees it.

1. 1

   Choose Create policy

   You will find it at the top of the Policies tab.

2. 2

   Name it for what it governs

   A name like support-app-production tells a reviewer what the policy covers. Names are 3 to 128 characters.

3. 3

   Set Enforcement mode to Monitor only

   The form starts on Enforce. Monitor only records activity and blocks nothing, which is the safe way to tune.

4. 4

   Leave Model access preset on All models for now

   You will narrow it in the next section, once you know which models the app uses.

5. 5

   Save

   The policy exists but is not bound to anything yet. You bind it in the second guide.

1. 1

   Add a binding

   Choose the binding type that fits, such as App, and add the environment if the policy is only for production.

2. 2

   Open the Request Simulator

   It is in the Policies tab. Enter a model and, optionally, the key, team, app, and environment. It reports which policy applies and whether the request would be allowed.

3. 3

   Send a real request

   Use the virtual key. If the key does not carry a team and app, add them as headers.

curl https://api.cloptima.ai/v1/ai/chat/completions \
  -H "Authorization: Bearer $CLOPTIMA_VIRTUAL_KEY" \
  -H "X-Cloptima-Team: support" \
  -H "X-Cloptima-App: support-assistant" \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-4o-mini", "messages": [{"role": "user", "content": "Say hello"}]}'

1. 1

   Switch Mode to Enforce

   Do this on a policy bound to one app first.

2. 2

   Send a request with a model you did not allow

   Use a model that is on your deny list or not on the allow list.

3. 3

   Read the response

   You should see HTTP 403 with a reason that names the rule.

{
  "error": "Your AI request was blocked because this model is not allowed by the active Cloptima policy.",
  "reason": "model_not_allowed",
  "violations": ["model_not_allowed"]
}