Omni Gateway Agent Policies
Policies enforce rules when Omni Gateway processes requests, enabling you to secure and govern your server instances. Omni Gateway includes A2A and MCP specific policies that provide enhanced security and control over agent interactions.
To apply a policy, see Applying Policies for Managed Omni Gateways and Connected Mode.
Omni Gateway MCP and A2A server instances also support other Omni Gateway policies to protect server instances through rate limiting, authentication, authorization, threat protection, monitoring, and logging. For more information about MuleSoft-provided policies, see the Inbound Policies Directory and Outbound Policies Directory.
To extend existing functionality or define new functionality, create custom policies based on your specific business requirements. For information about creating custom policies, see Omni Gateway Policy Development Kit (PDK) Overview.
| All agent policies are inbound policies and are not supported as automated policies. |
SSE Policies
Both A2A and MCP support the following policies for Server-Sent Events (SSE) streaming:
| Policy | Summary |
|---|---|
Logs every SSE event while streaming |
A2A Policies
| Policy | Summary |
|---|---|
Rewrites the Agent Card URL to match the server instance public URL |
|
Detects personally identifiable information (PII) in requests sent to the agent |
|
Decorates prompts with context information |
|
Validates agent requests to ensure they conform to the A2A specification |
A2A v1 Policies
| Policy | Summary |
|---|---|
Rewrites interface URLs in the A2A v1.0 agent card to match the gateway’s public address |
|
Detects personally identifiable information (PII) in A2A v1 requests across all transports |
|
Decorates A2A v1 prompts with additional context information |
|
Verifies that requests to the agent are compliant with the A2A v1.0 specification |
|
Transcodes protocol messages bidirectionally between A2A v1.0 JSON-RPC clients and A2A v0.3 backend servers |
|
Rate limits v1 A2A agent usage of upstream resources |
MCP Policies
| Policy | Summary |
|---|---|
Controls access to tools, resources, and prompts based on user information such as Tiers, IP, Headers, or Claims |
|
Restricts which MCP tools are exposed by defining Allow and Block rules |
|
Blocks elicitation responses containing personally identifiable information (PII) from reaching MCP servers |
|
Reduces tool response token consumption using one or more configurable methods: remove structural noise, trim oversized responses to match agent intent, or compress repeated structures into TOON |
|
Reduces context window token cost by exposing tools on-demand through search |
|
Validates MCP requests to ensure they conform to the MCP specification |
|
Adds MCP support to an Omni Gateway MCP server instance. This policy is required for your MCP server instance to function properly. |
|
Redefines tool names and descriptions to reduce prompt complexity and improve LLM comprehension |
LLM Policies
| Policy | Summary |
|---|---|
Evaluates LLM prompts and responses against Azure AI Content Safety for harmful content, jailbreak attempts, hallucinations, and copyrighted material |
|
Evaluates LLM prompts and responses against Amazon Bedrock guardrails for content safety, PII detection, and contextual grounding |
|
Detects personally identifiable information (PII) in OpenAI-format LLM Proxy requests and responses |
|
Limits LLM Proxy usage based on the number of tokens consumed |
|
Blocks LLM requests that match deny-list regex patterns |