Access Policies

Access policies allow the administrator to control access to the AI models from agents. You can define an access policy by configuring traffic match on various criteria. To configure a new Access Policy Group, go to Policies > AI Gateway > New Policy group.

Create New Access Policy Groups

You can create policy groups and add multiple policies to that group. A default policy group is available.

To create a new access policy group, follow the steps below.

1. Log in to the Netskope tenant UI and go to Policies > AI Gateway.

2. In the AI Gateway page, click the Access Control tab and click New Policy Group.

3. In the New Policy Group page, enter a name for the group in the Group Name parameter.

   

4. Choose the position of the new policy group by selecting a group from the Before policy group or After policy group lists respectively.

5. Click Create.

Create New Access Policy

To create a new access policy, follow the steps below.

1. Log in to the Netskope tenant UI and go to Policies > AI Gateway.

2. In the AI Gateway page, click the Access Control tab and click New Policy.

3. In the New Access Policy page, create a policy that matches one (or more) of the following criteria :

   • Token Group
   • AI Provider and Model
   • Activity – Prompt, Upload, Download and Others (any activity that doesn’t match the first three and clubbed into Others)

4. From the Add Exclusion Criteria Group list, choose the token group that you want to exclude from the match criteria. For example, you want to match against all openai AI Providers, but not for traffic with token group admin. In that case you can specify this exclusion criteria by selecting Add Exclusion Criteria Group, choose Token Group and select the required token group from the drop down.

5. From the Action parameter, select the enforcement action to be applied when traffic matches your specified criteria:

   • Monitor: Logs the traffic activity for visibility and allows the request to proceed to the subsequent policy.
   • Block: Immediately terminates the connection and drops the traffic.
   • Replace: Intercepts the response and replaces the content with a custom, administrator-defined message.

6.  Specify the name of the policy, description, the policy group that it should be part of, and the position of the policy within that policy group.

7. Click Save and apply changes to your creation.