Applying Model Proxy Policies
Model Proxy enforces three policies by default to secure and route LLM traffic without additional configuration. Apply additional supported policies through API Manager to add content safety, PII detection, and token rate limiting controls. Outbound policies and the Rate Limiting SLA policy are not supported.
By default, Model Proxy applies these policies:
-
Client ID Enforcement
-
Model Proxy Core Policy
-
Model Based Routing Policy or Semantic Routing Policy (policy name dependent on embedded service provider)
You don’t need to modify these policies.
Model Proxy supports most included policies, but doesn’t support outbound policies.
| Model Proxy doesn’t support Rate Limiting: SLA-Based Policy. |
These policies are specific and useful for Model Proxies:
Apply Policies to Model Proxies
-
From API Manager, click Model Proxies.
-
Click the name of the Model Proxy you want to apply a policy to.
-
Click AI Policies.
-
Click Add inbound policy.
-
Select the policy to apply.
-
Configure the required parameters.
For policy configuration parameters, see Inbound Policies Directory.
-
If necessary, configure Advanced options.
-
Click Apply.
Model Proxy Authentication Policy
By default, the Model Proxy has the Client ID Enforcement policy applied.
This is required because the Client ID Enforcement populates the Authentication.clientName variable in the Authentication object that is used as a unique identifier for LLM Metrics.
To remove the Client ID Enforcement policy, ensure that you either:
-
Apply a policy that populates
Authentication.clientName:-
OAuth 2.0 Token Introspection Policy (If Client ID enforcement is configured,
skipClientIdValidation=false) -
OpenID Connect OAuth 2.0 Token Enforcement Policy (If Client ID enforcement is configured,
skipClientIdValidation=false) -
JWT Validation Policy (If Client ID enforcement is configured,
skipClientIdValidation=false) -
A custom policy that populates
Authentication.clientName
-
Edit the DataWeave variable in Model Proxy Core to extract a different unique identifier, such as
clientid,userid, ordepartmentid.You can’t filter by this unique identifier in Usage Reports.



