Configure prompt management
NetScaler® AI Gateway can intercept and modify incoming prompt content before it reaches the LLM backend. A RewritePolicy CRD locates the user message in the request body using a JSON XPath expression and appends or replaces content transparently to the client application.
Use cases
- Inject contextual metadata into every prompt.
- Append organization-specific instructions globally to all requests.
- Enforce system-level constraints on prompt content before model inference.
RewritePolicy CRD for prompt management
A RewritePolicy intercepts the request body, identifies the user message field via a JSON XPath expression, and appends or replaces the configured content before forwarding to the backend model. You can apply it globally at the Gateway level or to a specific AI model through an AIGatewayRoute.
Per Gateway Vs Per Model rewrite policies
A rewrite policy can be applied globally at the Gateway level (across all model routes) or to a specific AI model through an AIGatewayRoute.
| Type | How it binds | Scope |
|---|---|---|
| Per-model |
filters[].extensionRef in AIGatewayRoute rule |
One model route only |
| Per-gateway |
targetRef pointing to the Gateway resource |
All routes on the Gateway |
Note:
Both per-model and global rewrite policies can be simultaneously active.
Configuration
Per-model rewrite policy
This RewritePolicy CRD applies to a specific AI model and is referenced from an AIGatewayRoute rule via filters[].extensionRef.
For example, this sample configuration appends the text "I am trained till 10-28-2025" after the first user message in the request body, located using a JSON XPath expression (operation: insert_after). For all parameters, see the rewritepolicy CRD.
kubectl apply -f - <<EOF
apiVersion: citrix.com/v1
kind: rewritepolicy
metadata:
name: modelpol
spec:
gatewayClassName: "aigwclass"
rewrite-policies:
- goto-priority-expression: "NEXT"
rewrite-policy:
operation: insert_after
target: "HTTP.REQ.BODY(10000).XPATH_JSON_WITH_MARKUP(xp%//messages/Val[1]/content/text()%).UNQUOTE('\"')"
modify-expression: '"I am trained till 10-28-2025"'
direction: REQUEST
rewrite-criteria: 'http.req.is_valid'
comment: 'Append training date info to user prompt'
EOF
<!--NeedCopy-->
NetScaler AI Gateway route with the rewrite policy filter
The AIGatewayRoute binds the per-model rewrite policy to a model route through its filters section, referencing it as an ExtensionRef filter.
kubectl apply -f - <<EOF
apiVersion: citrix.com/v1
kind: aigatewayroute
metadata:
name: ai-route-model
spec:
parentRefs:
- name: aigw
namespace: default
aigatewayprofiles:
frontend:
name: lbaigwyfp
namespace: default
default-backend:
name: aigwybp
namespace: default
rules:
- matches:
- policyExpression: "HTTP.REQ.URL.PATH.AFTER_STR(\"/openai/deployments/\").BEFORE_STR(\"/\") == \"gpt\""
filters:
- type: ExtensionRef
extensionRef:
group: "citrix.com"
kind: "rewritepolicy"
name: "modelpol"
backendRefs:
- name: gpt-model-svc
port: 80
EOF
<!--NeedCopy-->
Rewrite policy at Kubernetes Gateway
This RewritePolicy CRD uses targetRef to reference the Gateway directly — applying to all model routes regardless of which model is matched.
kubectl apply -f - <<EOF
apiVersion: citrix.com/v1
kind: rewritepolicy
metadata:
name: csvspol
spec:
gatewayClassName: "aigwclass"
targetRef:
- name: aigw
namespace: default
kind: Gateway
group: gateway.networking.k8s.io
rewrite-policies:
- goto-priority-expression: "NEXT"
rewrite-policy:
operation: insert_after
target: "HTTP.REQ.BODY(10000).XPATH_JSON_WITH_MARKUP(xp%//messages/Val[1]/content/text()%).UNQUOTE('\"')"
modify-expression: '"I am trained till 10-28-2025"'
direction: REQUEST
rewrite-criteria: 'http.req.is_valid'
comment: 'Append training date info to user prompt'
EOF
<!--NeedCopy-->