# Kong Gateway & Mesh Integration

Compile Mandrel specs directly into declarative Kong AI Gateway policies and Kong Mesh traffic permissions.

Source: https://mandrel-web-363efb.gitlab.io/docs/guides/kong-integration/

---


The **Kong Gateway & Mesh Integration** allows Mandrel to act as the declarative contract layer ("The Brain") while delegating high-performance edge traffic control and routing enforcement to the Kong AI Connectivity platform ("The Muscle").

By compiling a **Realized Spec** into native Kong Custom Resource Definitions (CRDs), platform teams can secure agent networks, restrict tool usage, and prevent runaway LLM loops without changing a single line of agent code.

---

## The Translation Plugin (`mandrel-generator-kong`)

Mandrel features a subprocess-based `mandrel-cli` plugin discovered automatically on `$PATH` as `mandrel-generator-kong`. 

You can run the generator against any spec file to output Kong-specific deployment artifacts:

```bash
mandrel-cli generate <spec.yaml> <output-dir> \
  --plugins-dir /path/to/plugins/dir \
  --plugin mandrel.io/kong-generator
```

This compiles the spec into two separate declarative config files in your output directory:
1.  **`kong-mesh-traffic-permissions.yaml`**: Standard Kong Mesh (Kuma) traffic permissions.
2.  **`kong-gateway-plugins.yaml`**: Unified `KongPlugin` CRD configurations for the API gateway.

---

## Inbound workload Authorization (Mesh)

The generator compiles `network.ingress-spiffe-allow-list` arrays into Kubernetes `MeshTrafficPermission` resources. This enables secure east-west workload-to-workload communication utilizing **SPIFFE SVIDs** inside **Kong Mesh**:

```yaml
apiVersion: kuma.io/v1alpha1
kind: MeshTrafficPermission
mesh: default
metadata:
  name: finance-specialist-traffic-permission
  namespace: domain-finance
spec:
  targetRef:
    kind: MeshService
    name: finance-specialist
  from:
    - targetRef:
        kind: MeshService
        name: finance-orchestrator
      default:
        action: Allow
```

---

## Edge Gateway Enforcement (Gateway)

The plugin generates individual `KongPlugin` resources targeting north-south client traffic and A2A routing:

### 1. User & Client Auth (OIDC Plugin)
Required user access scopes (`identity.required-oidc-scopes`) are bound to the native Kong OIDC routing plugin, ensuring that authentication is verified at the ingress gateway before propagating tool calls downstream.

### 2. Prompt & Prompt Safety (`ai-prompt-guard`)
The generator compiles risk limits from `spec.governance.enforcement-matrices` and `spec.extensions.kong` directly into `ai-prompt-guard` regex deny/allow patterns:
*   Matches forbidden inputs (e.g., matching credit card or PII injection patterns).
*   Fails fast at the gateway edge with a `400 Bad Request` if a policy match occurs, shielding LLMs from red-team exploits.

### 3. PII Redaction (`ai-request-transformer`)
If custom request-transformer instructions are defined in the `kong` extension, the generator configures `ai-request-transformer` to redact or format client requests dynamically using an upstream LLM before sending them to target specialists.

---

## Supported Custom Extensions

You can extend the default translation rules by defining a `kong` section in your spec's `extensions` block:

```yaml
spec:
  extensions:
    kong:
      ai-prompt-guard:
        deny:
          - ".*ssn.*"
        allow:
          - ".*safe-prompt.*"
      ai-request-transformer:
        prompt: "Redact all PII"
```