Skip to content
Version 2026.6.3 is the latest release with the newest features, but gets no long-term support. To stay supported, upgrade with every new release or use a quarterly stable release instead.

Conditional policies

Page as Markdown
Run different variants of a policy on the same route based on a CEL expression evaluated against the request.
Conditional policies
 
A policy normally applies the same configuration to every request on the route it attaches to. Conditional execution lets you nest a list of policy variants under a conditional field. Each variant has a 



CEL



 expression that determines whether it applies. For each request, agentgateway evaluates the entries in order and runs the first variant whose expression returns true.
A common use case is choosing between two external authorization servers based on the request. For example, you might send admin paths to a stricter authorization server and route everything else to a standard one.
The following policies support conditional execution:
  • External authorization (extAuth)
  • External processing (extProc)
  • Rate limiting (rateLimit)
  • Transformations (transformation)
  • Direct response (directResponse)
For details on how to write the CEL expressions that go in each condition field, see the CEL expressions reference.
How conditional execution works
 
  • First match wins. Agentgateway evaluates each conditional entry in the order you list them and runs the first variant whose condition evaluates to true. Subsequent entries are not evaluated.
  • Optional fallback. An entry without a condition is the unconditional fallback. It must be the last entry in the list, and you can have at most one. If no condition matches and there is no fallback, the policy does not run for that request.
  • Mutually exclusive with the inline form. For a given policy, set either the top-level fields or the conditional list, not both.
  • Limits.
Examples
 
Review the following examples to see how conditional policies work. Conditional execution works the same way for every supported policy. The following examples show one configuration per policy type.
Multiple ext auth servers
 
Route to one of two external authorization servers based on the request path. Requests to a path that starts with /admin go to a stricter authorization server. The fallback entry handles every other request.


Different rate limits
 
Apply a stricter rate limit to write requests and a looser limit to all other traffic.


Transform internal traffic
 
Add a tracing header when the request includes an x-internal: true header. With no fallback entry, agentgateway skips the transformation on every other request.


Filter LLM chats with extproc
 
Send requests on a path that starts with /v1/chat through an external processor. Every other request bypasses the processor.


Short-circuit deprecated paths with a direct response
 
Return a 410 Gone response for any path that starts with /v0/. Every other request proceeds to the backend.
Targeting and merging