feat(gateway/m&b): Entitlement enforcement plugin docs

app/_data/plugins/otel-metrics.yaml

@@ -495,6 +495,15 @@ metrics:
       - kong.route.name
       - kong.workspace.name
       - kong.gen_ai.a2a.task.state
+  - name: kong.entitlement_enforcement.total
+    min_version: "3.16"
+    description: Total number of entitlement enforcement decisions.
+    unit: "{decision}"
+    type: Sum
+    attributes:
+      - kong.entitlement_enforcement.decision
+      - kong.entitlement_enforcement.reason
+      - kong.entitlement_enforcement.feature_key
 
 access_logs:
   - client.address
@@ -693,4 +702,7 @@ attributes:
   kong.gen_ai.a2a.method: A2A method name.
   kong.gen_ai.a2a.binding: A2A binding type.
   kong.gen_ai.a2a.error.type: Type of the A2A error.
-  kong.gen_ai.a2a.task.state: "Task state, such as `completed`, `failed`, or `in_progress`."
+  kong.gen_ai.a2a.task.state: "Task state, such as `completed`, `failed`, or `in_progress`."
+  kong.entitlement_enforcement.decision: "Enforcement decision: `allowed` or `blocked`."
+  kong.entitlement_enforcement.reason: "Denial reason code, such as `USAGE_LIMIT_REACHED`, when the decision is `blocked`."
+  kong.entitlement_enforcement.feature_key: The configured feature key being enforced.

app/_data/plugins/priorities/3.16.json

@@ -0,0 +1,117 @@
+{
+  "ace": 955,
+  "acl": 950,
+  "acme": 1705,
+  "ai-a2a-proxy": 819,
+  "ai-aws-guardrails": 781,
+  "ai-azure-content-safety": 774,
+  "ai-custom-guardrail": 785,
+  "ai-gcp-model-armor": 783,
+  "ai-lakera-guard": 784,
+  "ai-llm-as-judge": 767,
+  "ai-mcp-oauth2": 1015,
+  "ai-mcp-proxy": 820,
+  "ai-prompt-compressor": 769,
+  "ai-prompt-decorator": 772,
+  "ai-prompt-guard": 771,
+  "ai-prompt-template": 773,
+  "ai-proxy": 770,
+  "ai-proxy-advanced": 770,
+  "ai-rag-injector": 778,
+  "ai-rate-limiting-advanced": 905,
+  "ai-request-transformer": 777,
+  "ai-response-transformer": 768,
+  "ai-sanitizer": 776,
+  "ai-semantic-cache": 765,
+  "ai-semantic-prompt-guard": 775,
+  "ai-semantic-response-guard": 782,
+  "app-dynamics": 999999,
+  "aws-lambda": 750,
+  "azure-functions": 749,
+  "basic-auth": 1100,
+  "bot-detection": 2500,
+  "canary": 20,
+  "confluent": 752,
+  "confluent-consume": 754,
+  "correlation-id": 100001,
+  "cors": 2000,
+  "datadog": 10,
+  "datakit": 810,
+  "degraphql": 1500,
+  "entitlement-enforcement": 915,
+  "exit-transformer": 9999,
+  "file-log": 9,
+  "forward-proxy": 50,
+  "graphql-proxy-cache-advanced": 99,
+  "graphql-rate-limiting-advanced": 902,
+  "grpc-gateway": 998,
+  "grpc-web": 3,
+  "header-cert-auth": 1009,
+  "hmac-auth": 1030,
+  "http-log": 12,
+  "injection-protection": 1007,
+  "ip-restriction": 990,
+  "jq": 811,
+  "json-threat-protection": 1009,
+  "jwe-decrypt": 1999,
+  "jwt": 1450,
+  "jwt-signer": 1020,
+  "kafka-consume": 753,
+  "kafka-log": 5,
+  "kafka-upstream": 751,
+  "key-auth": 1250,
+  "key-auth-enc": 1250,
+  "konnect-application-auth": 960,
+  "ldap-auth": 1200,
+  "ldap-auth-advanced": 1200,
+  "loggly": 6,
+  "metering-and-billing": 16,
+  "mocking": -1,
+  "mtls-auth": 1600,
+  "oas-validation": 840,
+  "oauth2": 1400,
+  "oauth2-introspection": 1700,
+  "opa": 920,
+  "openid-connect": 1050,
+  "opentelemetry": 14,
+  "post-function": -1000,
+  "pre-function": 1000000,
+  "prometheus": 13,
+  "proxy-cache": 100,
+  "proxy-cache-advanced": 100,
+  "rate-limiting": 910,
+  "rate-limiting-advanced": 910,
+  "redirect": 779,
+  "request-callout": 812,
+  "request-size-limiting": 951,
+  "request-termination": 2,
+  "request-transformer": 801,
+  "request-transformer-advanced": 802,
+  "request-validator": 999,
+  "response-ratelimiting": 900,
+  "response-transformer": 800,
+  "response-transformer-advanced": 800,
+  "route-by-header": 850,
+  "route-transformer-advanced": 780,
+  "saml": 1010,
+  "service-protection": 901,
+  "session": 1900,
+  "solace-consume": 756,
+  "solace-log": 15,
+  "solace-upstream": 755,
+  "standard-webhooks": 759,
+  "statsd": 11,
+  "statsd-advanced": 11,
+  "syslog": 4,
+  "tcp-log": 7,
+  "tls-handshake-modifier": 997,
+  "tls-metadata-headers": 996,
+  "udp-log": 8,
+  "upstream-oauth": 760,
+  "upstream-timeout": 400,
+  "vault-auth": 1350,
+  "websocket-size-limit": 1003,
+  "websocket-validator": 1006,
+  "xml-threat-protection": 1008,
+  "zipkin": 100000
+}