feat(ai-gateway): AI Sanitizer support for sanitizing responses

app/_kong_plugins/ai-sanitizer/examples/anonymize-phone-numbers.yaml

@@ -1,6 +1,6 @@
-description: Configure the plugin to use your sanitizer service to anonymize phone numbers in requests before they reach the upstream service.
+description: Configure the AI Sanitizer plugin to use your sanitizer service to anonymize phone numbers in requests before they reach the upstream service.
 
-title: Anonymize phone numbers
+title: Anonymize phone numbers in requests
 
 weight: 900
 

app/_kong_plugins/ai-sanitizer/examples/anonymize-request-and-response-data.yaml

@@ -0,0 +1,35 @@
+description: Configure the AI Sanitizer plugin to use your sanitizer service to anonymize all sensitive data and credentials in both client requests and LLM responses.
+
+title: Anonymize sensitive data in requests and responses
+
+weight: 900
+
+requirements:
+  - You have enabled the AI Proxy or AI Proxy Advanced plugin
+
+variables:
+  host:
+    description: The sanitizer service's host
+    value: $SANITIZER_SERVICE_HOST
+  port:
+    description: The sanitizer service's port
+    value: $SANITIZER_SERVICE_PORT
+
+config: 
+  anonymize:
+      - all_and_credentials
+  sanitization_mode: BOTH
+  port: ${port}
+  host: ${host}
+  redact_type: placeholder
+  recover_redacted: false
+
+min_version:
+    gateway: '3.12'
+
+tools:
+  - deck
+  - admin-api
+  - konnect-api
+  - kic
+  - terraform

app/_kong_plugins/ai-sanitizer/examples/anonymize-response-data.yaml

@@ -0,0 +1,35 @@
+description: Configure the AI Sanitizer plugin to use your sanitizer service to anonymize all sensitive data and credentials in LLM responses before they reach the client.
+
+title: Anonymize sensitive data in responses
+
+weight: 900
+
+requirements:
+  - You have enabled the AI Proxy or AI Proxy Advanced plugin
+
+variables:
+  host:
+    description: The sanitizer service's host
+    value: $SANITIZER_SERVICE_HOST
+  port:
+    description: The sanitizer service's port
+    value: $SANITIZER_SERVICE_PORT
+
+config: 
+  anonymize:
+      - all_and_credentials
+  sanitization_mode: OUTPUT
+  port: ${port}
+  host: ${host}
+  redact_type: placeholder
+  recover_redacted: false
+
+min_version:
+    gateway: '3.12'
+
+tools:
+  - deck
+  - admin-api
+  - konnect-api
+  - kic
+  - terraform

app/_kong_plugins/ai-sanitizer/index.md

@@ -6,8 +6,7 @@ content_type: plugin
 
 tier: ai_gateway_enterprise
 publisher: kong-inc
-description: Protect sensitive information in client request bodies before they reach upstream services
-
+description: Protect sensitive information in client request or response bodies before they reach upstream services or clients
 
 products:
     - gateway
@@ -44,22 +43,55 @@ related_resources:
     url: /how-to/protect-sensitive-information-with-ai/
 ---
 
-The AI Sanitizer plugin for {{site.base_gateway}} helps protect sensitive information in client request bodies before they reach upstream services.
+The AI Sanitizer plugin for {{site.base_gateway}} helps protect sensitive information in client request bodies before they reach upstream services, or in LLM response bodies before they reach the client.
+
 By integrating with an external PII service, the plugin ensures compliance with data privacy regulations while preserving the usability of request data.
 It supports multiple sanitization modes, including replacing sensitive information with fixed placeholders or generating synthetic replacements that retain category-specific characteristics.
 
-Additionally, AI Sanitizer offers an optional restoration feature, allowing the original data to be reinstated in responses when needed.
+Additionally, AI Sanitizer offers an optional restoration feature, allowing the original request data to be reinstated in responses when needed.
 
 {% include plugins/ai-plugins-note.md %}
 
 The AI Sanitizer plugin uses the AI PII Anonymizer Service, which can run in a Docker container, to detect and sanitize sensitive data. See the [tutorial on configuring the AI Sanitizer plugin](/how-to/protect-sensitive-information-with-ai/) for more information on how to configure the plugin with the AI PII Anonymizer Service.
 
 ## How it works
 
+The AI Sanitizer plugin can be applied to input data (requests), output data (responses) {% new_in 3.12 %}, or both.
+Here's how it works if you apply it to both requests and responses:
+
 1. The plugin intercepts the request body and sends it to the external PII service.
 1. The PII service detects sensitive data and applies the chosen sanitization method (placeholders or synthetic replacements).
 1. The sanitized request is forwarded upstream with the AI Proxy or AI Proxy Advanced plugin.
-1. If restoration is enabled, the plugin restores original data in responses before returning them to the client.
+1. {% new_in 3.12 %} On the way back, the plugin intercepts the response body and sends it to the external PII service.
+1. The PII service detects sensitive data and applies the chosen sanitization method (placeholders or synthetic replacements).
+1. If restoration is enabled, the plugin restores the original request data in responses before returning them to the client.
+
+<!--vale off-->
+{% mermaid %}
+sequenceDiagram
+    autonumber
+    participant Client
+    participant Plugin as AI Sanitizer
+    participant PII as PII Service
+    participant Proxy as AI Proxy/Advanced
+    participant AI as Upstream AI Service
+
+    Client->>Plugin: Send request
+    Plugin->>PII: Intercept & send request body
+    PII->>PII: Detect sensitive data in request
+    PII->>Plugin: Return sanitized request<br/>(placeholders/synthetic data)
+    Plugin->>Proxy: Forward sanitized request
+    Proxy->>AI: Process sanitized request    
+    AI->>Proxy: Return AI response
+    Proxy->>Plugin: Forward response
+    Plugin->>PII: Intercept & send response body
+    PII->>PII: Detect sensitive data in response
+    PII->>Plugin: Return sanitized response<br/>(placeholders/synthetic data)
+    Plugin->>Client: Return sanitized response<br>(with optional restored request data)
+{% endmermaid %}
+<!--vale on-->
+
+> _Figure 1: Diagram showing the request and response flow with the AI Sanitizer plugin._
 
 ## AI PII Anonymizer service