Ideas · Builder Notes
Closing egress gaps in the AI gateway
Kognita alpha's gateway now redacts decoded JSON, screens every provider-read field and JSON key, forwards only known endpoints and refuses attachments it cannot inspect.
Before
Review found several ways content could reach a provider unscreened: JSON escapes, tool-call arguments, JSON object keys, unknown endpoints and binary attachments.
After
Redaction runs on decoded JSON values. Every field the provider reads is classified and screened, including keys. Only the supported inference paths are forwarded, and the path is bound into the decision. Image, audio and file parts are refused because the gateway cannot inspect them. Message-shaped input on the responses endpoint is screened like chat.
The gateway now screens the whole request body.
Why it matters
Screening has explicit bounds, and past the bound the request fails closed.
Refusing attachments limits what agents can do through the gateway in this alpha.
If you cannot inspect it, do not forward it.
Sources
Kognita is an open-source alpha. This note comes from Kognita PR #87, Kognita PR #89, Kognita PR #109, Kognita PR #110, Kognita PR #112 in the Kognita repository.