fea(ai-gateway): RAG ACL and metadata filtering #3594

tomek-labuk · 2025-12-01T12:49:23Z

Description

Preview Links

https://deploy-preview-3594--kongdeveloper.netlify.app/plugins/ai-rag-injector/#access-control-and-metadata-filtering
https://deploy-preview-3594--kongdeveloper.netlify.app//how-to/use-ai-rag-injector-acls/
https://deploy-preview-3594--kongdeveloper.netlify.app//how-to/filter-knowledge-based-queries-with-rag-injector/

Checklist

Tested how-to docs. If not, note why here.
All pages contain metadata.
Any new docs link to existing docs.
All autogenerated instructions render correctly (API, decK, Konnect, Kong Manager).
Style guide (capitalized gateway entities, placeholder URLs) implemented correctly.
Every page has a description entry in frontmatter.
Add new pages to the product documentation index (if applicable).

netlify · 2025-12-01T12:49:29Z

✅ Deploy Preview for kongdeveloper ready!

Name	Link
🔨 Latest commit	`c529ceb`
🔍 Latest deploy log	https://app.netlify.com/projects/kongdeveloper/deploys/6937b69ed4cbf200086ef4af
😎 Deploy Preview	https://deploy-preview-3594--kongdeveloper.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

app/_kong_plugins/ai-rag-injector/index.md

app/_how-tos/use-ai-rag-injector-acls.md

xiaocang

LGTM, this document is clear

xiaocang · 2025-12-03T07:15:09Z

There’s a discussion about the request body structure, and perhaps the request body structure may need to be adjusted as well. https://github.com/Kong/kong-ee/pull/15327

xiaocang · 2025-12-03T07:56:59Z

According to the OpenAI SDK behavior when users call:

  client.chat.completions.create(
      model="gpt-4",
      messages=[...],
      extra_body={"ai-rag-injector": {...}}
  )

The SDK merges extra_body contents at the root level of the HTTP request body. Kong actually receives:

  {
    "model": "gpt-4",
    "messages": [...],
    "ai-rag-injector": {...}
  }

NOT nested under an extra_body key.

so, let's request without extra_body wrapper in the doc, after this PR https://github.com/Kong/kong-ee/pull/15348 merged

tomek-labuk · 2025-12-03T12:14:18Z

According to the OpenAI SDK behavior when users call:
  client.chat.completions.create(
      model="gpt-4",
      messages=[...],
      extra_body={"ai-rag-injector": {...}}
  )
The SDK merges extra_body contents at the root level of the HTTP request body. Kong actually receives:
  {
    "model": "gpt-4",
    "messages": [...],
    "ai-rag-injector": {...}
  }
NOT nested under an extra_body key.

so, let's request without extra_body wrapper in the doc, after this PR Kong/kong-ee#15348 merged

@xiaocang - I've updated both the how-to and the main overview. Also, I've tested with a dev image from your PR and it does work without the extra_body param.

Co-authored-by: Johnny Wang <johnnywang1991@msn.com>

Guaris

This is a really good and detailed PR.

app/_how-tos/filter-knowledge-based-queries-with-rag-injector.md

Guaris · 2025-12-08T18:56:18Z

app/_how-tos/filter-knowledge-based-queries-with-rag-injector.md

+{:.info}
+> If your Redis instance runs in a separate Docker container from Kong, use `host.docker.internal` for `vectordb.redis.host`.
+
+## Ingest content with metadata


Is there a way to ingest everything as one step, then we can tell the user what was ingested. Having so many ingestion steps made sense in the validation step but actually copy and pasting them in didn't add anything to my understanding of the doc.

Let me try a python script. The thing is that when I tried it in the first place, the collections were not ingested properly which messed up everything

Now, I've included python scripts for ingesting both collections :) – tested and it works as expected

app/_how-tos/use-ai-rag-injector-acls.md

Guaris · 2025-12-08T19:49:45Z

app/_kong_plugins/ai-rag-injector/index.md

+{:.info}
+> GCP Memorystore Redis clusters do not support the AI RAG Injector plugin. The Redis JSON module required for vector operations is not available in GCP's managed Redis service.
+>
+> Attempting to ingest chunks with GCP Redis results in the following error:
+>
+> ```json
+> {"message":"Failed to load the 'redis' vector database driver: failed to initialize vector database strategy: failed to create index: JSON module is not loaded."}
+>```
+
+{% include_cached /plugins/ai-vector-db.md name=page.name %}
+
+## Access control and metadata filtering {% new_in 3.13 %}
+
+Once you've configured your vector database and ingested content, you can control which [Consumers](/gateway/entities/consumer/) access specific knowledge base articles and refine query results using metadata filters.
+
+### Collections
+
+A collection is a logical grouping of knowledge base articles with independent access control rules. When you ingest content via the Admin API, assign it to a collection using the `collection` field in the metadata.
+
+Example metadata structure:
+
+```json
+{
+  "content": "Quarterly revenue increased 15%...",
+  "metadata": {
+    "collection": "finance-reports",
+    "date": "2023-10-14",
+    "tags": ["finance", "quarterly"],
+    "source": "internal"
+  }
+}
+```


Would it be worth adding this to an FAQ instead of at the top of this section?

Good point, done!

app/_kong_plugins/ai-rag-injector/index.md

Co-authored-by: Angel <Guaris@users.noreply.github.com>

tomek-labuk changed the base branch from main to release/gateway-3.13 December 1, 2025 12:49

tomek-labuk marked this pull request as ready for review December 2, 2025 09:01

tomek-labuk requested a review from a team as a code owner December 2, 2025 09:01

xiaocang suggested changes Dec 3, 2025

View reviewed changes

app/_kong_plugins/ai-rag-injector/index.md Outdated Show resolved Hide resolved

app/_how-tos/use-ai-rag-injector-acls.md Outdated Show resolved Hide resolved

xiaocang approved these changes Dec 3, 2025

View reviewed changes

lena-larionova force-pushed the release/gateway-3.13 branch from c948b7c to 02318c9 Compare December 3, 2025 16:23

tomek-labuk and others added 14 commits December 3, 2025 08:30

add initial content

52560a3

Add how-to

0a1d0d0

update min-version

171bd54

update tags

e04e23b

add missing links

f5aa7a7

add response bodies

0678ca4

Fixes

c66b612

Add filtering how-to

9959ca1

Add configuration example

047fd56

Add version tag

a47d40c

Update

3c17586

Update app/_kong_plugins/ai-rag-injector/index.md

74a7fb9

Co-authored-by: Johnny Wang <johnnywang1991@msn.com>

Fix spelling

a747e76

fix spelling

95199ba

lena-larionova force-pushed the feat/rag-acl branch from dfb4471 to e2a915e Compare December 3, 2025 16:31

tomek-labuk added 3 commits December 3, 2025 08:37

fix

8fe0f60

add dictionary entries

9adfc13

add vale tags

f9ff7e1

lena-larionova force-pushed the feat/rag-acl branch from e2a915e to f9ff7e1 Compare December 3, 2025 16:37

Add note for using GCP with Redis

49a1f35

Merge branch 'release/gateway-3.13' into feat/rag-acl

5523663

Guaris self-assigned this Dec 8, 2025

Guaris requested changes Dec 8, 2025

View reviewed changes

tomek-labuk and others added 3 commits December 9, 2025 05:50

Apply suggestions from code review

9a7a7ef

Co-authored-by: Angel <Guaris@users.noreply.github.com>

Apply review feedback

e1bbc4f

Update faqs

c529ceb

tomek-labuk requested a review from Guaris December 9, 2025 13:39

Guaris approved these changes Dec 9, 2025

View reviewed changes

fea(ai-gateway): RAG ACL and metadata filtering #3594

Are you sure you want to change the base?

fea(ai-gateway): RAG ACL and metadata filtering #3594

Uh oh!

Conversation

tomek-labuk commented Dec 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Preview Links

Checklist

Uh oh!

netlify bot commented Dec 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for kongdeveloper ready!

Uh oh!

Uh oh!

Uh oh!

xiaocang left a comment

Choose a reason for hiding this comment

Uh oh!

xiaocang commented Dec 3, 2025

Uh oh!

xiaocang commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tomek-labuk commented Dec 3, 2025

Uh oh!

Guaris left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Guaris Dec 8, 2025

Choose a reason for hiding this comment

Uh oh!

tomek-labuk Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

tomek-labuk Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Guaris Dec 8, 2025

Choose a reason for hiding this comment

Uh oh!

tomek-labuk Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

tomek-labuk commented Dec 1, 2025 •

edited

Loading

netlify bot commented Dec 1, 2025 •

edited

Loading

xiaocang commented Dec 3, 2025 •

edited

Loading