AI Gateway 2.3 release

.github/styles/base/Dictionary.txt

@@ -78,6 +78,7 @@ backporting
 backports
 backreference
 backreferences
+baseten
 Bingbot
 wget
 meshtrust

app/_ai_gateway_entities/ai-agent.md

@@ -78,7 +78,7 @@ faqs:
     a: |
       Reference an [AI Auth Strategy](/ai-gateway/entities/ai-auth-strategy/) by name or id in the AI Agent's
       [`access.auth_strategies`](#schema-aigateway-agent-access) array, the same field used on AI Models. An AI Agent
-      currently accepts up to one AI Auth Strategy reference. The AI Agent has its own top-level authentication
+      accepts up to one AI Auth Strategy reference. The AI Agent has its own top-level authentication
       mechanism, so attaching an authentication AI Policy directly to its `policies` field isn't supported.
 
   - q: How do I attach AI Policies to an AI Agent?
@@ -92,6 +92,12 @@ faqs:
       signs each proxied request using static IAM credentials, environment auto-detection, or an assumed role. This
       is separate from [`access.auth_strategies`](#schema-aigateway-agent-access), which authenticates inbound
       clients rather than outbound requests to the upstream agent. See [Upstream authentication](#upstream-authentication).
+
+  - q: How do I connect to an upstream agent that requires mTLS or serves a certificate from a private CA?
+    a: |
+      Set [`config.certificates`](#schema-aigateway-agent-config-certificates) for mTLS, or [`config.ca_certificates`](#schema-aigateway-agent-config-ca-certificates) for a private CA.
+      Both fields apply to `a2a` and `http` AI Agents.
+      See [Upstream TLS](#upstream-tls).
 ---
 
 ## What is an AI Agent?
@@ -340,7 +346,11 @@ To restrict which AI Consumers or teams can reach a specific agent, use ACLs. Th
 
 For per-request authentication and identity validation, reference an [AI Auth Strategy](/ai-gateway/entities/ai-auth-strategy/) in the [`access.auth_strategies`](#schema-aigateway-agent-access) array, the same way you would for an [AI Model](/ai-gateway/entities/ai-model/#access-control). The AI Agent has its own top-level authentication mechanism: you configure the authentication through AI Auth Strategies. See [AI Policy scopes](/ai-gateway/entities/ai-policy/#ai-policy-scopes) for details.
 
-An AI Agent currently accepts up to one AI Auth Strategy reference. ACLs are evaluated only after the AI Consumer's identity is resolved through this authentication step.
+An AI Agent accepts up to one AI Auth Strategy reference. ACLs are evaluated only after the AI Consumer's identity is resolved through this authentication step.
+
+### CEL-based ACLs
+
+{% include md/ai-gateway/v2/cel-acls.md entity="AI Agent" anchor="#schema-aigateway-agent-access" %}
 
 ## Upstream authentication
 
@@ -373,6 +383,23 @@ config:
 
 `config.upstream` is available regardless of the AI Agent's [`type`](#schema-aigateway-agent-type); it applies to `a2a` and `http` Agents alike.
 
+## Upstream TLS
+
+{% include md/ai-gateway/v2/upstream-tls.md name='AI Agent' schema_prefix='schema-aigateway-agent-config' %}
+
+These fields apply to both `a2a` and `http` AI Agents.
+
+In the following example, the AI Agent presents the `agent-client-cert` certificate to the upstream and verifies the upstream against the `kongair-internal-root-ca` CA:
+
+```yaml
+config:
+  url: https://booking-agent.internal.kongair.com
+  certificates:
+    - agent-client-cert
+  ca_certificates:
+    - kongair-internal-root-ca
+```
+
 ## Attach AI Policies
 
 To enforce security, transformation, or governance controls on agent traffic (for example, request validation, PII detection, request logging), attach [AI Policies](/ai-gateway/entities/ai-policy/) to the agent. Add policy names or IDs to the AI Agent's [`policies`](#schema-aigateway-agent-policies) field. Multiple AI Policies can attach to one AI Agent; each runs independently in the request lifecycle.

app/_ai_gateway_entities/ai-ca-certificate.md

@@ -29,6 +29,10 @@ related_resources:
     url: /ai-gateway/entities/ai-sni/
   - text: AI Data Plane Certificate
     url: /ai-gateway/entities/ai-data-plane-certificate/
+  - text: AI MCP Server entity
+    url: /ai-gateway/entities/ai-mcp-server/
+  - text: AI Agent entity
+    url: /ai-gateway/entities/ai-agent/
 faqs:
   - q: How is an AI CA Certificate different from a {{site.base_gateway}} CA Certificate?
     a: |
@@ -39,6 +43,12 @@ faqs:
       authority, carries no private key, and is used to verify the certificate a client or an
       upstream server presents. An AI Certificate is an identity the data plane uses itself: it carries a private key and is
       presented to complete a TLS handshake.
+  - q: Can AI MCP Servers and AI Agents use an AI CA Certificate to verify their upstreams?
+    a: |
+      Yes.
+      Reference one or more AI CA Certificates by name in the `config.ca_certificates` field of an [AI MCP Server](/ai-gateway/entities/ai-mcp-server/#upstream-tls) or [AI Agent](/ai-gateway/entities/ai-agent/#upstream-tls).
+      The AI MCP Server or AI Agent then uses them to verify the upstream's certificate, which lets it connect to upstreams signed by a private or internal CA.
+      If you don't set the field, the default trust store is used.
 ---
 
 ## What is an AI CA Certificate

app/_ai_gateway_entities/ai-certificate.md

@@ -31,6 +31,10 @@ related_resources:
     url: /ai-gateway/entities/ai-vault/
   - text: AI Data Plane Certificate entity
     url: /ai-gateway/entities/ai-data-plane-certificate/
+  - text: AI MCP Server entity
+    url: /ai-gateway/entities/ai-mcp-server/
+  - text: AI Agent entity
+    url: /ai-gateway/entities/ai-agent/
 faqs:
   - q: How is an AI Certificate different from a {{site.base_gateway}} Certificate?
     a: |
@@ -62,6 +66,13 @@ faqs:
       No. The `key` and `key_alt` fields are write-only. They're accepted on create and update, but
       never returned by a read. Keep your own copy of any key you register, or store it in an
       [AI Vault](/ai-gateway/entities/ai-vault/) and register a reference to it instead of the literal value.
+
+  - q: Can AI MCP Servers and AI Agents present an AI Certificate to their upstreams?
+    a: |
+      Yes.
+      Reference the AI Certificate by name in the `config.certificates` field of an [AI MCP Server](/ai-gateway/entities/ai-mcp-server/#upstream-tls) or [AI Agent](/ai-gateway/entities/ai-agent/#upstream-tls).
+      The AI MCP Server or AI Agent then presents it as its client certificate, which lets it connect to upstreams that require mutual TLS (mTLS).
+      The AI Certificate must include a private key.
 ---
 
 ## What is an AI Certificate?