Lab guide: agentgateway on a kind cluster

Gateway: http://localhost:8080   Expecting: open state

[PASS] PROTECT  1. Caller with no identity reaches the LLM -> allowed (no policy yet)
         HTTP 200
[PASS] PROTECT  2. Expired token -> allowed (no policy yet)
         HTTP 200
[PASS] PROTECT  3. Orchestrator with a valid token reaches the LLM -> allowed
         HTTP 200
[PASS] PROTECT  4. Prompt containing an AWS key -> allowed (no policy yet)
         HTTP 200 {"model":"mock-model","usage":{"prompt_tokens":12,"completion_tokens":9,"total_t
[PASS] PROTECT  5. Model answer containing an email and a key -> returned as is
         HTTP 200 content":"Sure, the admin contact is admin@example.com and the key is AKIAIOSFODNN7EXAMPLE.","role":"assistant
[PASS] IDENTIFY 6. Tool inventory seen by each agent
         orchestrator sees 13: ['echo', 'get-annotated-message', 'get-env', 'get-resource-links']... | worker sees 13: ['echo', 'get-annotated-message', 'get-env', 'get-resource-l
[PASS] PROTECT  7. Worker calls a tool reserved for the orchestrator (get-sum) -> allowed (no policy yet)
         {"jsonrpc": "2.0", "id": 3, "result": {"content": [{"type": "text", "text": "The sum of 2 and 3 is 5."}]}}
[PASS] PROTECT  8. Any agent dumps the tool server's environment (get-env) -> allowed (no policy yet)
         environment returned, including DEMO_DB_PASSWORD
[PASS] PROTECT  9. Orchestrator calls get-sum -> allowed
         {"jsonrpc": "2.0", "id": 4, "result": {"content": [{"type": "text", "text": "The sum of 2 and 3 is 5."}]}}
[PASS] PROTECT  10. Caller with no identity opens an MCP session -> allowed (no policy yet)
         HTTP 200
[PASS] PROTECT  11. Worker loops 8 LLM calls in a row -> all served
         200 200 200 200 200 200 200 200

[FAIL] PROTECT  1. Caller with no identity reaches the LLM -> allowed (no policy yet)
         HTTP 401
[FAIL] PROTECT  4. Prompt containing an AWS key -> allowed (no policy yet)
         HTTP 403 Blocked by gateway: the prompt contains a secret or card number.
[FAIL] PROTECT  5. Model answer containing an email and a key -> returned as is
         HTTP 200 content":"Sure, the admin contact is <EMAIL_ADDRESS> and the key is <masked>.","role":"assistant"},"index":0,"
[FAIL] IDENTIFY 6. Tool inventory seen by each agent
         orchestrator sees 2: ['echo', 'get-sum'] | worker sees 1: ['echo']
[FAIL] PROTECT  10. Caller with no identity opens an MCP session -> allowed (no policy yet)
         HTTP 401
[FAIL] PROTECT  11. Worker loops 8 LLM calls in a row -> all served
         200 200 200 200 200 429 429 429

2026-10-04T15:02:58.323097Z	error	request gateway=agentgateway-system/agentgateway-proxy listener=http route=agentic-lab/llm src.addr=127.0.0.1:53068 http.method=POST http.host=localhost http.path=/v1/chat/completions http.version=HTTP/1.1 http.status=429 jwt.sub=worker protocol=http error="rate limit exceeded" reason=RateLimit duration=0ms
2026-10-04T15:02:58.326208Z	error	request gateway=agentgateway-system/agentgateway-proxy listener=http route=agentic-lab/llm src.addr=127.0.0.1:53074 http.method=POST http.host=localhost http.path=/v1/chat/completions http.version=HTTP/1.1 http.status=429 jwt.sub=worker protocol=http error="rate limit exceeded" reason=RateLimit duration=0ms
2026-10-04T15:02:58.331921Z	error	request gateway=agentgateway-system/agentgateway-proxy listener=http route=agentic-lab/llm src.addr=127.0.0.1:53076 http.method=POST http.host=localhost http.path=/v1/chat/completions http.version=HTTP/1.1 http.status=429 jwt.sub=worker protocol=http error="rate limit exceeded" reason=RateLimit duration=0ms

$ curl -s -o /dev/null -w "%{http_code}\n" localhost:8080/v1/chat/completions -H "authorization: Bearer $WORK" ...
200
$ kubectl apply -f manifests/30-respond-block-worker.yaml
agentgatewaypolicy.agentgateway.dev/incident-block-worker created
$ curl -s -o /dev/null -w "%{http_code}\n" localhost:8080/v1/chat/completions -H "authorization: Bearer $WORK" ...
403