Kong Gateway & Mesh Integration

The Kong Gateway & Mesh Integration allows Mandrel to act as the declarative contract layer (“The Brain”) while delegating high-performance edge traffic control and routing enforcement to the Kong AI Connectivity platform (“The Muscle”).

By compiling a Realized Spec into native Kong Custom Resource Definitions (CRDs), platform teams can secure agent networks, restrict tool usage, and prevent runaway LLM loops without changing a single line of agent code.

The Translation Plugin (mandrel-generator-kong)

Mandrel features a subprocess-based mandrel-cli plugin discovered automatically on $PATH as mandrel-generator-kong.

You can run the generator against any spec file to output Kong-specific deployment artifacts:

mandrel-cli generate <spec.yaml> <output-dir> \
  --plugins-dir /path/to/plugins/dir \
  --plugin mandrel.io/kong-generator

This compiles the spec into two separate declarative config files in your output directory:

1. kong-mesh-traffic-permissions.yaml: Standard Kong Mesh (Kuma) traffic permissions.
2. kong-gateway-plugins.yaml: Unified KongPlugin CRD configurations for the API gateway.

Inbound workload Authorization (Mesh)

The generator compiles network.ingress-spiffe-allow-list arrays into Kubernetes MeshTrafficPermission resources. This enables secure east-west workload-to-workload communication utilizing SPIFFE SVIDs inside Kong Mesh:

apiVersion: kuma.io/v1alpha1
kind: MeshTrafficPermission
mesh: default
metadata:
  name: finance-specialist-traffic-permission
  namespace: domain-finance
spec:
  targetRef:
    kind: MeshService
    name: finance-specialist
  from:
    - targetRef:
        kind: MeshService
        name: finance-orchestrator
      default:
        action: Allow

Edge Gateway Enforcement (Gateway)

The plugin generates individual KongPlugin resources targeting north-south client traffic and A2A routing:

1. User & Client Auth (OIDC Plugin)

Required user access scopes (identity.required-oidc-scopes) are bound to the native Kong OIDC routing plugin, ensuring that authentication is verified at the ingress gateway before propagating tool calls downstream.

2. Prompt & Prompt Safety (ai-prompt-guard)

The generator compiles risk limits from spec.governance.enforcement-matrices and spec.extensions.kong directly into ai-prompt-guard regex deny/allow patterns:

• Matches forbidden inputs (e.g., matching credit card or PII injection patterns).
• Fails fast at the gateway edge with a 400 Bad Request if a policy match occurs, shielding LLMs from red-team exploits.

3. PII Redaction (ai-request-transformer)

If custom request-transformer instructions are defined in the kong extension, the generator configures ai-request-transformer to redact or format client requests dynamically using an upstream LLM before sending them to target specialists.

Supported Custom Extensions

You can extend the default translation rules by defining a kong section in your spec’s extensions block:

spec:
  extensions:
    kong:
      ai-prompt-guard:
        deny:
          - ".*ssn.*"
        allow:
          - ".*safe-prompt.*"
      ai-request-transformer:
        prompt: "Redact all PII"