Skip to main content

Conditional chain configuration

policies.chain accepts plain policy types or conditional chain entries. A conditional entry adds when, stage, parallel, and targeting data to a policy type.

Chain entry structures​

Plain entry​

Use a plain string when the policy must always run in its default execution phase.

policies:
  chain:
    - prompt-injection
    - pii-detector
    - audit-logger

Conditional entry​

Use an object when the policy must run only in specified conditions or in a specified phase.

policies:
  chain:
    - prompt-injection
    - pii-detector:
        when:
          path: "/v1/chat"
          header:
            x-team: "finance"
        stage: pre-request
        parallel: true
    - quality-scorer:
        when:
          model:
            - "your-primary-openai-model"
            - "your-secondary-openai-model"
        stage: pre-response

The policy type is the key. The nested object contains the conditional data.

when predicates​

All fields in when use AND logic. Each condition must match before the chain entry runs.

Path matching​

- prompt-injection:
    when:
      path: "/v1/chat"

path matches the start of the request path.

Header matching​

- dlp-filter:
    when:
      header:
        x-team: "compliance"
        x-environment: "prod"

All listed headers must be available. The gateway compares header names and values without case sensitivity. Use lowercase header names in the configuration.

Model matching​

- quality-scorer:
    when:
      model:
        - "your-openai-model"
        - "your-second-openai-model"

Stage control​

Supported stage values:

StageMeaning
pre-requestThis stage occurs before the gateway sends the request upstream.
post-requestThis stage occurs after the gateway prepares the request and before last response handling.
pre-responseThis stage occurs before the gateway returns the response to the caller.

Use pre-response for a control that must block or change output. Use runtime Events for request evidence.

Standard defaults​

If you do not specify stage, the gateway uses the default phase for that policy type.

  • Most input policies use pre-request by default.
  • Output-only policies include flagged-review, quality-scorer, human-oversight, citation-verifier, mnpi-filter, financial-compliance, healthcare-compliance, legal-privilege, upl-filter, bias-monitor, and response-rewriter.

Parallel execution​

Set parallel: true when policies in the same stage have no dependencies and can run at the same time.

policies:
  chain:
    - prompt-injection:
        stage: pre-request
        parallel: true
    - pii-detector:
        stage: pre-request
        parallel: true
    - dlp-filter:
        stage: pre-request
        parallel: false

The gateway waits for all parallel entries in a stage before it starts the next operation.

Targeting​

Use targeting to scope a chain entry to specified teams or gateways.

- audit-logger:
    stage: pre-request
    targeting:
      scope: team
      teams:
        - compliance
      gateways:
        regex: "^prod-.*$"

targeting fields​

FieldTypeDescription
scopestringorganization or team
teamsstring[]This field is necessary when scope: team. It matches authenticated team membership from API claims, not identity data from a caller.
gatewaysselectorThis selector is a specified name, string array, or regex object.

Team entries become active only when the authenticated team context matches teams. On connected and authenticated gateways, only API membership supplies team context.

Callers cannot make or limit team membership for policy chain selection.

Gateway selector formats​

# exact name
gateways: "prod-east"

# list of exact names
gateways:
  - "prod-east"
  - "prod-west"

# regex selector
gateways:
  regex: "^prod-.*$"

Complete example​

pack:
  name: conditional-gateway
  version: 1.0.0
  enabled: true

providers:
  targets:
    - id: openai-prod
      provider: openai
      model: your-openai-model
      secret_key_ref:
        env: VERDICTAN_OPENAI_API_KEY

policies:
  chain:
    - prompt-injection
    - pii-detector:
        stage: pre-request
        parallel: true
        when:
          path: "/v1/chat"
          header:
            x-team: "compliance"
    - dlp-filter:
        stage: pre-request
        when:
          header:
            x-team: "compliance"
    - quality-scorer:
        stage: pre-response
        when:
          model:
            - "your-openai-model"
    - audit-logger:
        stage: pre-request
        targeting:
          scope: team
          teams:
            - compliance
          gateways:
            regex: "^prod-.*$"

policy:
  pii-detector:
    action: redact
    pci_mode: true
  dlp-filter:
    blocked_terms:
      - "inside information"
      - "share this customer export"
    action: block
  quality-scorer:
    thresholds:
      min_aggregate: 0.8
  audit-logger: {}

Select chains or routes​

TaskPrefer
Different policy chains for Chat Completions and Responses pathsRoutes
One upstream with different policies for each path, header, or modelConditional chain entries
Execution for specified teams or gatewaysConditional chain entries
ordered path dispatch before policy executionRoutes

Routes select only policy chains. Configure provider selection in providers:.

Next steps​