stacklok · blkt · Aug 25, 2026 · Aug 25, 2026
diff --git a/.github/upstream-projects.yaml b/.github/upstream-projects.yaml
@@ -110,6 +110,17 @@ projects:
           policy enforcement. Each page below documents one resource - its
           fields, defaults, validation rules, and a minimal example manifest
           - and links to the other resources it references.
+      - source: enterprise/ai-gateway/charts/operator-crds/files
+        out: static/api-specs/ai-gateway-crds
+        pages: docs/platform/reference/crds-ai-gateway
+        landing_title: AI Gateway CRD reference
+        landing_description: >-
+          Reference for the Stacklok AI Gateway custom resource definitions.
+        landing_intro: >-
+          The AI Gateway operator manages the gateway and its policies using
+          Kubernetes custom resources. Each page below documents one resource
+          - its fields, defaults, validation rules, and a minimal example
+          manifest - and links to the other resources it references.
 
   - id: toolhive-studio
     repo: stacklok/toolhive-studio

diff --git a/docs/ai-gateway/index.mdx b/docs/ai-gateway/index.mdx
@@ -31,11 +31,16 @@ governs the **tools** your agents can use, while the AI Gateway governs the
 - Govern people and agents as first-class peers under the same policies,
   budgets, and audit trail
 
-:::note[Documentation in progress]
+The AI Gateway is configured declaratively through two Kubernetes custom
+resources and administered through a REST management API. It ships as part of
+the [Stacklok Enterprise](../platform/index.mdx) Helm chart.
 
-The AI Gateway is rolling out as part of Stacklok Enterprise, and its full
-setup, configuration, and reference documentation is on the way. In the
-meantime, see [Stacklok Enterprise](../platform/index.mdx) for the platform it
-is part of, or reach out to your Stacklok contact for early access.
+## Next steps
 
-:::
+- [Deploy the platform](../platform/enterprise-platform/deployment.mdx) to
+  install the AI Gateway in your Kubernetes cluster.
+- [AI Gateway CRD reference](../platform/reference/crds-ai-gateway/index.mdx)
+  for `AIGateway`, which configures providers, routes, screening, and
+  resilience, and `AIPolicy`, which attaches policy to a gateway.
+- [Management API reference](../platform/reference/ai-gateway-management-api.mdx)
+  for the models, policies, and MCP server endpoints.
diff --git a/docs/platform/enterprise-cloud-ui/ai-assistant.mdx b/docs/platform/enterprise-cloud-ui/ai-assistant.mdx
diff --git a/docs/platform/enterprise-cloud-ui/browse-catalog.mdx b/docs/platform/enterprise-cloud-ui/browse-catalog.mdx
@@ -137,7 +137,5 @@ From the skill detail page you can:
 
 ## Next steps
 
-- [AI assistant](./ai-assistant.mdx) to chat with AI models that call MCP tools
-  from the catalog
 - [Manage entries](./administration/entries.mdx) to publish, update, or delete
   servers in the catalog
diff --git a/docs/platform/enterprise-cloud-ui/configure.mdx b/docs/platform/enterprise-cloud-ui/configure.mdx
@@ -30,8 +30,6 @@ Before configuring, ensure you have:
   deployed and reachable; its API URL is the `apiBaseUrl` value you set below
 - An OIDC-compatible identity provider (Okta, Entra ID, or generic OIDC)
   configured with a client application for the Cloud UI
-- An [OpenRouter](https://openrouter.ai) API key, if you want to enable the
-  [AI assistant](./ai-assistant.mdx)
 - Enterprise Cloud UI distribution access (container image and Helm chart,
   provided by Stacklok during onboarding)
 
@@ -87,8 +85,8 @@ toolhive-cloud-ui:
 
   # Additional env vars not yet exposed as structured keys above.
   # env:
-  #   - name: OPENROUTER_API_KEY
-  #     value: '<OPENROUTER_API_KEY>'
+  #   - name: TRUSTED_ORIGINS
+  #     value: 'https://cloud-ui.example.com'
 ```
 
 ## Environment variables
@@ -136,11 +134,10 @@ them during the sign-in flow.
 Use the `env` array in `values.yaml` for env vars not exposed as structured
 keys:
 
-| Env var              | Description                                                                                                   |
-| -------------------- | ------------------------------------------------------------------------------------------------------------- |
-| `OPENROUTER_API_KEY` | OpenRouter API key for the AI assistant                                                                       |
-| `TRUSTED_ORIGINS`    | Comma-separated list of trusted origins for CORS and auth callbacks                                           |
-| `DATABASE_URL`       | PostgreSQL connection string for session storage (required for large OIDC tokens, for example, with Entra ID) |
+| Env var           | Description                                                                                                   |
+| ----------------- | ------------------------------------------------------------------------------------------------------------- |
+| `TRUSTED_ORIGINS` | Comma-separated list of trusted origins for CORS and auth callbacks                                           |
+| `DATABASE_URL`    | PostgreSQL connection string for session storage (required for large OIDC tokens, for example, with Entra ID) |
 
 ## White-label branding
 
@@ -280,26 +277,10 @@ This means you can omit `API_BASE_URL` entirely and let the Enterprise Manager
 control the registry URL, or set `API_BASE_URL` as a fallback for when the
 Enterprise Manager is unreachable.
 
-## Feature flags
-
-The [Enterprise Manager](../enterprise-manager/index.mdx) controls Cloud UI
-feature visibility via the `assistant` directive. To hide the AI assistant for
-all users, set it in the Enterprise Manager's section of your platform
-`values.yaml`:
-
-```yaml title="values.yaml"
-enterprise-manager:
-  enterpriseConfig:
-    assistant:
-      value: false
-      enforcement: 'enforced'
-```
-
 ## Next steps
 
 - [Browse the catalog](./browse-catalog.mdx) to verify the deployment and
   explore available MCP servers
-- [AI assistant](./ai-assistant.mdx) to configure and use the chat sidebar
 - [Registry management](./administration/) to manage entries, sources, and
   registries
 - [Configure the Enterprise Manager](../enterprise-manager/configure.mdx) to set

diff --git a/docs/platform/enterprise-cloud-ui/intro.mdx b/docs/platform/enterprise-cloud-ui/intro.mdx
@@ -17,13 +17,12 @@ The Enterprise Cloud UI gives platform teams and developers a web-based
 interface for the MCP server and skills catalog managed by the
 [Registry Server](../../toolhive/guides-registry/index.mdx). It extends the
 [open source ToolHive Cloud UI](../../toolhive/guides-cloud-ui/intro.mdx) with
-skills discovery and installation, one-click Stacklok Desktop integration, an AI
-assistant, and full catalog management for platform teams. Use it to:
+skills discovery and installation, one-click Stacklok Desktop integration, and
+full catalog management for platform teams. Use it to:
 
 - Browse and search the MCP server catalog
 - Install servers into Stacklok Desktop with one click
 - Add servers to AI clients (Claude Code, Cursor, Visual Studio Code)
-- Chat with AI models that can call MCP tools directly
 - Publish, update, and delete MCP server entries
 - Manage registry sources and registries
 
@@ -91,24 +90,16 @@ does not perform client-side access control.
 
 ## Feature flags
 
-The [Enterprise Manager](../enterprise-manager/index.mdx) can control Cloud UI
-features through policy directives. Each directive carries an `enforcement`
-level (`enforced` or `default`):
-
-| Feature     | Controls                              |
-| ----------- | ------------------------------------- |
-| `assistant` | Show or hide the AI assistant sidebar |
-
-When `assistant` is set to `false` with `enforcement: "enforced"`, the sidebar
-is hidden for all users. Other feature flags such as `playground` and
-`non_registry_servers` apply to the desktop app only - see
+The [Enterprise Manager](../enterprise-manager/index.mdx) can control client
+features through policy directives, each carrying an `enforcement` level
+(`enforced` or `default`). The directives that exist today, `playground` and
+`non_registry_servers`, apply to the desktop app only - see
 [Enterprise Manager policies](../enterprise-manager/policies/) for details.
 
 ## Next steps
 
 - [Deploy the platform](../enterprise-platform/deployment.mdx) to install the
   Cloud UI in your Kubernetes cluster
 - [Browse the catalog](./browse-catalog.mdx) to discover and install MCP servers
-- [AI assistant](./ai-assistant.mdx) to chat with AI models that call MCP tools
 - [Registry management](./administration/) to manage entries, sources, and
   registries
diff --git a/docs/platform/enterprise-manager/intro.mdx b/docs/platform/enterprise-manager/intro.mdx
@@ -28,9 +28,7 @@ ToolHive CLI and desktop app) behave across your organization. Use it to:
 The Enterprise Manager runs as a service in your Kubernetes cluster. Clients
 authenticate, fetch their configuration, and poll again on a refresh interval
 you control, so policy updates propagate across your fleet without manual client
-changes. The [Enterprise Cloud UI](../enterprise-cloud-ui/index.mdx) also
-consumes feature flags from the Enterprise Manager to control UI features like
-the AI assistant.
+changes.
 
 ```mermaid
 flowchart LR

diff --git a/docs/platform/enterprise-manager/policies/index.mdx b/docs/platform/enterprise-manager/policies/index.mdx
@@ -12,15 +12,14 @@ flows, and what parts of the Stacklok Desktop are visible.
 
 ## Available directives
 
-| Directive                                                             | Use it to                                               |
-| --------------------------------------------------------------------- | ------------------------------------------------------- |
-| [Registry](./registry.mdx)                                            | Enforce a specific MCP registry URL                     |
-| [Non-registry servers](./non-registry-servers.mdx)                    | Block or allow MCP servers that are not in the registry |
-| [Telemetry](./telemetry.mdx)                                          | Standardize OpenTelemetry collector configuration       |
-| [CA certificate](./ca-certificate.mdx)                                | Inject a custom CA certificate into MCP containers      |
-| [Build environment](./build-env.mdx)                                  | Inject environment variables into MCP containers        |
-| [Stacklok Desktop](./desktop-app.mdx)                                 | Show or hide the Playground tab and help menu           |
-| [AI assistant](../../enterprise-cloud-ui/configure.mdx#feature-flags) | Show or hide the AI assistant in the Cloud UI           |
+| Directive                                          | Use it to                                               |
+| -------------------------------------------------- | ------------------------------------------------------- |
+| [Registry](./registry.mdx)                         | Enforce a specific MCP registry URL                     |
+| [Non-registry servers](./non-registry-servers.mdx) | Block or allow MCP servers that are not in the registry |
+| [Telemetry](./telemetry.mdx)                       | Standardize OpenTelemetry collector configuration       |
+| [CA certificate](./ca-certificate.mdx)             | Inject a custom CA certificate into MCP containers      |
+| [Build environment](./build-env.mdx)               | Inject environment variables into MCP containers        |
+| [Stacklok Desktop](./desktop-app.mdx)              | Show or hide the Playground tab and help menu           |
 
 Advanced directives, such as LLM Gateway configuration, are not covered in these
 guides.

diff --git a/docs/platform/reference/ai-gateway-management-api.mdx b/docs/platform/reference/ai-gateway-management-api.mdx
@@ -0,0 +1,12 @@
+---
+title: AI Gateway management API reference
+sidebar_label: AI Gateway API
+description:
+  REST API reference for the Stacklok AI Gateway management API, covering
+  models, policies, and MCP server registration.
+hide_table_of_contents: true
+---
+
+import ApiDocMdx from '@theme/ApiDocMdx';
+
+<ApiDocMdx id='ai-gateway-management-api' />
diff --git a/docs/platform/reference/crds-ai-gateway/aigateway.mdx b/docs/platform/reference/crds-ai-gateway/aigateway.mdx
@@ -0,0 +1,46 @@
+---
+title: AIGateway
+description: >-
+  Schema reference for AIGateway, which configures model providers, routes,
+  authentication, content screening, and resilience for the Stacklok AI Gateway.
+toc_max_heading_level: 4
+---
+
+`AIGateway` is the top-level resource for the Stacklok AI Gateway. One resource
+configures the whole gateway: its listeners, the model providers it can reach,
+the routes that map logical model names onto them, authentication, content
+screening, audit and journaling, and its resilience and timeout behavior. Attach
+access lists and MCP policy with [AIPolicy](./aipolicy.mdx).
+
+**API:** `ai-gateway.stacklok.dev/v1alpha1` · **Scope:** Namespaced · **Short
+names:** `aigw`
+
+## Example
+
+```yaml title="aigateway.yaml"
+apiVersion: ai-gateway.stacklok.dev/v1alpha1
+kind: AIGateway
+metadata:
+  name: my-aigateway
+  namespace: default
+spec:
+  auth: {}
+  gateway:
+    listeners:
+      - port: 0
+  providers:
+    - credentials:
+        type: APIKey
+      endpoint:
+        hostname: <string>
+      name: <string>
+      schema: OpenAI
+  routes:
+    - backendRefs:
+        - provider: <string>
+      name: <string>
+```
+
+## Schema
+
+<CRDReference kind='AIGateway' />
diff --git a/docs/platform/reference/crds-ai-gateway/aipolicy.mdx b/docs/platform/reference/crds-ai-gateway/aipolicy.mdx
@@ -0,0 +1,35 @@
+---
+title: AIPolicy
+description: >-
+  Schema reference for AIPolicy, which binds principal matchers and MCP policy
+  to a target AIGateway.
+toc_max_heading_level: 4
+---
+
+`AIPolicy` binds a set of principal matchers (the access list) and a
+forward-compatible MCP policy to a target [AIGateway](./aigateway.mdx). It is
+meant to be edited frequently, so its RBAC is scoped separately from `AIGateway`
+and the management API can change policy without touching gateway
+infrastructure.
+
+**API:** `ai-gateway.stacklok.dev/v1alpha1` · **Scope:** Namespaced · **Short
+names:** `aipol`
+
+## Example
+
+```yaml title="aipolicy.yaml"
+apiVersion: ai-gateway.stacklok.dev/v1alpha1
+kind: AIPolicy
+metadata:
+  name: my-aipolicy
+  namespace: default
+spec:
+  gatewayRef:
+    name: <string>
+  principalMatchers:
+    - claims: {}
+```
+
+## Schema
+
+<CRDReference kind='AIPolicy' />