diff --git a/app/_ai_gateway_entities/ai-agent.md b/app/_ai_gateway_entities/ai-agent.md
index d0a67777a6..c0042b77fb 100644
--- a/app/_ai_gateway_entities/ai-agent.md
+++ b/app/_ai_gateway_entities/ai-agent.md
@@ -39,7 +39,7 @@ faqs:
       Use `a2a` when the upstream speaks the A2A protocol and you want observability tied to A2A
       task and message semantics.
 
-  - q: Does the Agent entity modify request routing or aggregate responses?
+  - q: Does the AI Agent entity modify request routing or aggregate responses?
     a: |
       No. The runtime behind an Agent operates as a transparent proxy. It detects A2A requests,
       records telemetry, and rewrites agent-card URLs to the gateway address. It does not change
@@ -63,11 +63,6 @@ faqs:
     a: |
       Set the [`acls`](#schema-aigateway-agent-acls) field on the AI Agent with allow or deny lists. Each entry is a string that
       references an AI Consumer, AI Consumer Group, or Authenticated Group by name.
-
-  - q: Can the same plugin run on an AI Agent that I'd attach to a route or service?
-    a: |
-      Plugin configuration that applies to the AI Agent goes through the [AI Policy entity](/ai-gateway/entities/ai-policy/).
-      Attach AI Policies to the AI Agent through its [`policies`](#schema-aigateway-agent-policies) field.
 ---
 
 ## What is an AI Agent?
@@ -76,7 +71,7 @@ An AI Agent is a first-class {{site.ai_gateway}} entity that represents an upstr
 
 For `http` type AI Agents, requests are proxied without A2A-specific processing. For `a2a` type AI Agents, {{site.ai_gateway}} adds protocol-aware behavior on top of plain proxying: it detects A2A requests across both JSON-RPC and REST bindings, rewrites agent-card URLs so clients discover the gateway as the canonical endpoint, and emits structured A2A telemetry to {{site.konnect_short_name}} analytics and OpenTelemetry.
 
-AI Agents can be created and managed through the {{site.konnect_short_name}} UI, the {{site.ai_gateway}} API, or decK:
+AI Agents can be created and managed through the {{site.konnect_short_name}} UI and the {{site.ai_gateway}} API:
 
 {% table %}
 columns:
@@ -136,7 +131,7 @@ sequenceDiagram
         Gateway->>Client: Response (unchanged)
     end
 
-    Note over Gateway: Finish OTel span<br>Emit ai.a2a metrics to log plugins
+    Note over Gateway: Finish OTel span<br>Emit ai.a2a metrics to logs
 {% endmermaid %}
 <!-- vale on -->
 
@@ -243,9 +238,9 @@ When an upstream agent returns an agent card, the runtime rewrites the [`url`](#
 
 ## Logging and observability
 
-When Statistics logging is enabled, {{site.ai_gateway}} records structured A2A telemetry per request and exposes it in {{site.konnect_short_name}} analytics, attached log plugins, and OpenTelemetry when [{{site.base_gateway}} tracing](/gateway/tracing/) is configured. For the canonical metric and attribute list, see [A2A metrics](/ai-gateway/ai-otel-metrics/#a2a-metrics).
+When Statistics logging is enabled, {{site.ai_gateway}} records structured A2A telemetry per request and exposes it in {{site.konnect_short_name}} analytics and attached logging policies. For the canonical metric and attribute list, see [A2A metrics](/ai-gateway/ai-otel-metrics/#a2a-metrics).
 
-The runtime emits this data into the `ai.a2a` namespace consumed by {{site.konnect_short_name}} analytics and any attached logging plugins, and creates a `kong.a2a` child span when [{{site.base_gateway}} tracing](/gateway/tracing/) is configured.
+The runtime emits this data into the `ai.a2a` namespace consumed by {{site.konnect_short_name}} analytics and any attached logging Policies.
 
 {:.info}
 > When statistics logging is enabled, the runtime removes the `Accept-Encoding` request header
@@ -262,13 +257,13 @@ You can view A2A analytics in {{site.konnect_short_name}} Explorer and Dashboard
 
 ### Log output fields
 
-{% include /plugins/ai-a2a-proxy/log-output-fields.md %}
+{% include md/ai-gateway/v2/entities/log-output-fields.md %}
 
 ### OpenTelemetry span attributes
 
-When statistics logging is enabled and {{site.base_gateway}} tracing is configured, the runtime creates a `kong.a2a` child span with the following attributes:
+When statistics logging is enabled and {{site.ai}} tracing is configured, the runtime creates a `kong.a2a` child span with the following attributes:
 
-{% include /plugins/ai-a2a-proxy/otel-span-attributes.md %}
+{% include md/ai-gateway/v2/entities/otel-span-attributes.md %}
 
 ### Task states
 
@@ -284,11 +279,11 @@ For per-request authentication and identity, attach an authentication AI Policy
 
 Attach AI Policies through the AI Agent's [`policies`](#schema-aigateway-agent-policies) field. Each entry is a string that references an AI Policy by name or ID. Multiple AI Policies can attach to one AI Agent; each runs independently.
 
-For details, see the [Policy entity](/ai-gateway/entities/ai-policy/) reference.
+For details, see the [AI Policy entity](/ai-gateway/entities/ai-policy/) reference.
 
 ## Set up an Agent
 
-The following example creates an `a2a` Agent that proxies traffic to an upstream A2A agent at `https://booking-agent.internal.kongair.com`, with statistics logging enabled and access restricted to the `internal-teams` Consumer Group.
+The following example creates an `a2a` AI Agent that proxies traffic to an upstream A2A agent at `https://booking-agent.internal.kongair.com`, with statistics logging enabled and access restricted to the `internal-teams` AI Consumer Group.
 
 {% entity_example %}
 type: agent
diff --git a/app/_ai_gateway_entities/ai-consumer-credential.md b/app/_ai_gateway_entities/ai-consumer-credential.md
index 8250ca3e9b..02a551f510 100644
--- a/app/_ai_gateway_entities/ai-consumer-credential.md
+++ b/app/_ai_gateway_entities/ai-consumer-credential.md
@@ -29,19 +29,19 @@ related_resources:
   - text: AI Policy entity
     url: /ai-gateway/entities/ai-policy/
 faqs:
-  - q: Why are credentials a separate entity instead of a field on the Consumer?
+  - q: Why are credentials a separate entity instead of a field on the AI Consumer?
     a: |
       Each credential has its own lifecycle, identifier, and (for API keys) TTL. Modeling them as
-      a sub-entity of the Consumer lets you list, rotate, and revoke individual credentials
-      independently of the Consumer record.
+      a sub-entity of the AI Consumer lets you list, rotate, and revoke individual credentials
+      independently of the AI Consumer record.
 
   - q: What credential types are supported?
     a: |
-      Two types: `api-key` and `oauth`. The [`type`](#schema-aigateway-consumer-credential-type) of the Credential must match the Consumer's
+      Two types: `api-key` and `oauth`. The [`type`](#schema-aigateway-consumer-credential-type) of the Credential must match the AI Consumer's
       `type`. An `api-key` credential carries the [`api_key`](#schema-aigateway-consumer-credential-api-key) value (and an optional [`ttl`](#schema-aigateway-consumer-credential-ttl)). An
-      `oauth` credential is paired with a Consumer that maps to an OAuth identity through the Consumer's `custom_id` field.
+      `oauth` credential is paired with an AI Consumer that maps to an OAuth identity through the AI Consumer's `custom_id` field.
 
-  - q: Can a Consumer have multiple credentials?
+  - q: Can an AI Consumer have multiple credentials?
     a: |
       Yes. Issue one Credential per environment, client, or rotation cycle, and revoke individual
       Credentials without affecting the others.
@@ -52,16 +52,16 @@ faqs:
       ([`name`](#schema-aigateway-consumer-credential-name), [`display_name`](#schema-aigateway-consumer-credential-display-name), [`ttl`](#schema-aigateway-consumer-credential-ttl), timestamps) but not the secret. Distribute the key value at
       creation time, and rotate by issuing a new Credential and revoking the old one.
 
-  - q: What's the relationship between `ttl` and the Consumer's lifecycle?
+  - q: What's the relationship between `ttl` and the AI Consumer's lifecycle?
     a: |
       [`ttl`](#schema-aigateway-consumer-credential-ttl) controls how long the API key value remains valid in seconds. When it elapses, the
-      Credential stops authenticating but the Credential record (and the parent Consumer) remain.
-      Issue a new Credential to keep the Consumer authenticating.
+      Credential stops authenticating but the Credential record (and the parent AI Consumer) remain.
+      Issue a new Credential to keep the AI Consumer authenticating.
 ---
 
-## What is a Consumer Credential?
+## What is an AI Consumer Credential?
 
-A Consumer Credential is the {{site.ai_gateway}} entity that represents the secret material a [Consumer](/ai-gateway/entities/ai-consumer/) presents to authenticate to {{site.ai_gateway}}.
+An AI Consumer Credential is the {{site.ai_gateway}} entity that represents the secret material an [AI Consumer](/ai-gateway/entities/ai-consumer/) presents to authenticate to {{site.ai_gateway}}.
 
 Credentials are nested under their owning AI Consumer: each Credential belongs to exactly one AI Consumer, and removing the AI Consumer removes its Credentials.
 
@@ -83,7 +83,7 @@ rows:
 The [`type`](#schema-aigateway-consumer-credential-type) field on a Credential must match the parent Consumer's `type`:
 
 * **`api-key`**: the Credential carries an [`api_key`](#schema-aigateway-consumer-credential-api-key) value the client presents on each request. An optional [`ttl`](#schema-aigateway-consumer-credential-ttl) (seconds) bounds the validity period; once it elapses, the value no longer authenticates.
-* **`oauth`**: the Credential type for OAuth Consumers. The parent Consumer's `custom_id` field maps to an OAuth identity issued by an external provider. {{site.ai_gateway}} works with any standards-compliant OAuth 2.0 / OpenID Connect provider configured through the [OpenID Connect plugin](/plugins/openid-connect/), or, for MCP traffic, the [AI MCP OAuth2 plugin](/plugins/ai-mcp-oauth2/). The `custom_id` is typically the OIDC `sub` claim or the Client ID issued by the OAuth provider. The actual access token is issued and validated by the OAuth provider, not stored on the Credential.
+* **`oauth`**: the Credential type for OAuth Consumers. The parent Consumer's `custom_id` field maps to an OAuth identity issued by an external provider. {{site.ai_gateway}} works with any standards-compliant OAuth 2.0 / OpenID Connect provider configured through the [OpenID Connect AI Policy](/ai-gateway/policies/openid-connect/), or, for MCP traffic, the [AI MCP OAuth2 AI Policy](/ai-gateway/policies/ai-mcp-oauth2/). The `custom_id` is typically the OIDC `sub` claim or the Client ID issued by the OAuth provider. The actual access token is issued and validated by the OAuth provider, not stored on the Credential.
 
 The [`api_key`](#schema-aigateway-consumer-credential-api-key) field is write-only and cannot be retrieved after creation. Treat creation responses as the only opportunity to capture the key value.
 
diff --git a/app/_ai_gateway_entities/ai-consumer-group.md b/app/_ai_gateway_entities/ai-consumer-group.md
index 1f58d427f1..f774d19167 100644
--- a/app/_ai_gateway_entities/ai-consumer-group.md
+++ b/app/_ai_gateway_entities/ai-consumer-group.md
@@ -42,21 +42,21 @@ faqs:
       No. The generated Kong Consumer Group is protected from direct modification through the
       standard `/consumer-groups` Admin API. Update the AI Consumer Group instead.
 
-  - q: How do I assign a Consumer to a Consumer Group?
+  - q: How do I assign an AI Consumer to an AI Consumer Group?
     a: |
-      You add a Consumer to a Consumer Group through the Consumer Group entity.
-      See the [Consumer entity](/ai-gateway/entities/ai-consumer/) and
-      [Consumer Group entity](/ai-gateway/entities/ai-consumer-group/) references.
+      You add an AI Consumer to an AI Consumer Group through the AI Consumer Group entity.
+      See the [AI Consumer entity](/ai-gateway/entities/ai-consumer/) and
+      [AI Consumer Group entity](/ai-gateway/entities/ai-consumer-group/) references.
 
-  - q: Can a Consumer belong to multiple Consumer Groups?
+  - q: Can an AI Consumer belong to multiple AI Consumer Groups?
     a: |
-      Yes. The Consumer's `consumer_groups` array accepts one or more references.
+      Yes. The AI Consumer's `consumer_groups` array accepts one or more references.
 
-  - q: How do I attach Policies to a Consumer Group?
+  - q: How do I attach AI Policies to an AI Consumer Group?
     a: |
-      Add the Policy's `name` or `id` to the Consumer Group's [`policies`](#schema-aigateway-consumer-group-policies) array.
+      Add the AI Policy's `name` or `id` to the AI Consumer Group's [`policies`](#schema-aigateway-consumer-group-policies) array.
       The policy runs when a member of the group is identified during a request.
-      See the [Policy entity](/ai-gateway/entities/ai-policy/) reference.
+      See the [AI Policy entity](/ai-gateway/entities/ai-policy/) reference.
 
   - q: How do I gate access to an AI Model, AI Agent, or AI MCP Server with an AI Consumer Group?
     a: |
@@ -71,7 +71,7 @@ An AI Consumer Group is the {{site.ai_gateway}} entity that represents a collect
 
 Use AI Consumer Groups to scope group-wide behavior, such as rate limits, prompt guards, or content moderation, without configuring each AI Consumer individually. AI Consumer Groups can appear in the `acls` field of AI Model, AI Agent, and AI MCP Server entities, where they gate access to those parent entities.
 
-AI Consumer Groups can be created and managed through the {{site.konnect_short_name}} UI, the {{site.ai_gateway}} API, or decK:
+AI Consumer Groups can be created and managed through the {{site.konnect_short_name}} UI and the {{site.ai_gateway}} API:
 
 {% table %}
 columns:
diff --git a/app/_ai_gateway_entities/ai-consumer.md b/app/_ai_gateway_entities/ai-consumer.md
index 02ddba4486..3b72851d29 100644
--- a/app/_ai_gateway_entities/ai-consumer.md
+++ b/app/_ai_gateway_entities/ai-consumer.md
@@ -37,15 +37,15 @@ faqs:
     a: |
       The runtime entity is a regular Kong Consumer. The {{site.ai_gateway}} surface uses the
       {{site.ai_gateway}} entity convention ([`display_name`](#schema-aigateway-consumer-display-name), [`name`](#schema-aigateway-consumer-name), [`labels`](#schema-aigateway-consumer-labels)), requires an
-      authentication [`type`](#schema-aigateway-consumer-type) field, accepts inline Consumer Group assignment, and lets you
-      reference Policies. Credentials are managed as a separate sub-entity rather than embedded
+      authentication [`type`](#schema-aigateway-consumer-type) field, accepts inline AI Consumer Group assignment, and lets you
+      reference AI Policies. Credentials are managed as a separate sub-entity rather than embedded
       on the Consumer.
 
   - q: How do I add credentials to an AI Consumer?
     a: |
       Credentials are a separate sub-entity, not a field on the Consumer. Create them under the
       Consumer's nested credentials endpoint. See the
-      [Consumer Credential entity](/ai-gateway/entities/ai-consumer-credential/) reference.
+      [AI Consumer Credential entity](/ai-gateway/entities/ai-consumer-credential/) reference.
 
   - q: "What's the difference between `type: api-key` and `type: oauth`?"
     a: |
@@ -62,7 +62,7 @@ faqs:
   - q: How do I attach AI Policies to an AI Consumer?
     a: |
       Add the Policy's `name` or `id` to the Consumer's [`policies`](#schema-aigateway-consumer-policies) array.
-      See the [Policy entity](/ai-gateway/entities/ai-policy/) reference.
+      See the [AI Policy entity](/ai-gateway/entities/ai-policy/) reference.
 ---
 
 ## What is an AI Consumer?
@@ -71,7 +71,7 @@ An AI Consumer is the {{site.ai_gateway}} entity that represents a downstream cl
 
 You can use AI Consumers and AI Consumer Groups to authenticate clients, attach AI Policies, and gate access to AI Models, AI Agents, and AI MCP Servers through those parent entities' `acls` field.
 
-AI Consumers can be created and managed through the {{site.konnect_short_name}} UI, the {{site.ai_gateway}} API, or decK:
+AI Consumers can be created and managed through the {{site.konnect_short_name}} UI and the {{site.ai_gateway}} API:
 
 {% table %}
 columns:
@@ -89,13 +89,13 @@ rows:
 The [`type`](#schema-aigateway-consumer-type) field declares which credential family the Consumer authenticates with. Supported values are:
 
 * `api-key`: the Consumer authenticates with one or more API key Credentials.
-* `oauth`: the Consumer authenticates through an OAuth identity issued by an external OIDC provider. {{site.ai_gateway}} accepts any standards-compliant OAuth 2.0 / OpenID Connect provider configured through the [OpenID Connect plugin](/plugins/openid-connect/), or, for MCP traffic, through the [AI MCP OAuth2 plugin](/plugins/ai-mcp-oauth2/). The Consumer Credential carries a `custom_id` that maps to the OAuth provider's user identifier (for example, an OIDC Client ID or `sub` claim).
+* `oauth`: the Consumer authenticates through an OAuth identity issued by an external OIDC provider. {{site.ai_gateway}} accepts any standards-compliant OAuth 2.0 / OpenID Connect provider configured through the [OpenID Connect policy](/ai-gateway/policies/openid-connect/), or, for MCP traffic, through the [AI MCP OAuth2 policy](/ai-gateway/policies/ai-mcp-oauth2/). The AI Consumer Credential carries a `custom_id` that maps to the OAuth provider's user identifier (for example, an OIDC Client ID or `sub` claim).
 
-The `type` of every Credential issued to the Consumer must match the Consumer's `type`. See the [Consumer Credential entity](/ai-gateway/entities/ai-consumer-credential/) reference for credential management.
+The `type` of every Credential issued to the Consumer must match the Consumer's `type`. See the [AI Consumer Credential entity](/ai-gateway/entities/ai-consumer-credential/) reference for credential management.
 
-## Consumer Group membership
+## AI Consumer Group membership
 
-A Consumer can belong to multiple Consumer Groups. Consumer Group membership is managed through the Consumer Group entity. See the [Consumer Group entity](/ai-gateway/entities/ai-consumer-group/) reference for how to assign Consumers to groups.
+An AI Consumer can belong to multiple AI Consumer Groups. AI Consumer Group membership is managed through the AI Consumer Group entity. See the [AI Consumer Group entity](/ai-gateway/entities/ai-consumer-group/) reference for how to assign AI Consumers to groups.
 
 ## Attach Policies
 
@@ -103,11 +103,11 @@ Attach a Policy by adding its `name` or `id` to the Consumer's [`policies`](#sch
 
 You can attach multiple Policies to a single Consumer. Each Policy runs independently.
 
-For supported policy types and how Policies attach to other entities, see the [Policy entity](/ai-gateway/entities/ai-policy/) reference.
+For supported policy types and how Policies attach to other entities, see the [AI Policy entity](/ai-gateway/entities/ai-policy/) reference.
 
 ## Set up an AI Consumer
 
-The following example creates an AI Consumer assigned to a single AI Consumer Group. Credentials are issued separately through the [Consumer Credential entity](/ai-gateway/entities/ai-consumer-credential/).
+The following example creates an AI Consumer assigned to a single AI Consumer Group. Credentials are issued separately through the [AI Consumer Credential entity](/ai-gateway/entities/ai-consumer-credential/).
 
 {% entity_example %}
 type: consumer
diff --git a/app/_ai_gateway_entities/ai-data-plane-certificate.md b/app/_ai_gateway_entities/ai-data-plane-certificate.md
index 63766312cd..21c1822184 100644
--- a/app/_ai_gateway_entities/ai-data-plane-certificate.md
+++ b/app/_ai_gateway_entities/ai-data-plane-certificate.md
@@ -22,9 +22,9 @@ tools:
 related_resources:
   - text: "About {{site.ai_gateway}}"
     url: /ai-gateway/
-  - text: Provider entity
+  - text: AI Provider entity
     url: /ai-gateway/entities/ai-provider/
-  - text: Vault entity
+  - text: AI Vault entity
     url: /ai-gateway/entities/ai-vault/
 faqs:
   - q: Why is there no update operation?
@@ -118,6 +118,22 @@ To rotate a certificate without downtime:
 
 Deleting a Data Plane Certificate immediately invalidates the trust for any data plane still using it. Existing connections are dropped and reconnect attempts using the deleted certificate are rejected.
 
+## Set up a Data Plane Certificate
+
+The following example registers a public X.509 certificate as a trusted client identity for an {{site.ai_gateway}}.
+
+{% entity_example %}
+type: data_plane_certificate
+data:
+  title: My AI Gateway Data Plane Certificate
+  description: Certificate for data plane nodes in production
+  cert: |
+    -----BEGIN CERTIFICATE-----
+    MIIDXTCCAkWgAwIBAgIJAJC1/iNAZwqDMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNV
+    ...
+    -----END CERTIFICATE-----
+{% endentity_example %}
+
 ## Schema
 
 {% entity_schema %}
diff --git a/app/_ai_gateway_entities/ai-data-plane-node.md b/app/_ai_gateway_entities/ai-data-plane-node.md
index 4aa23ac152..ba59e77b99 100644
--- a/app/_ai_gateway_entities/ai-data-plane-node.md
+++ b/app/_ai_gateway_entities/ai-data-plane-node.md
@@ -24,12 +24,12 @@ related_resources:
     url: /ai-gateway/
   - text: "{{site.ai_gateway}} entity"
     url: /ai-gateway/entities/ai-gateway/
-  - text: Data Plane Certificate entity
+  - text: AI Data Plane Certificate entity
     url: /ai-gateway/entities/ai-data-plane-certificate/
 faqs:
-  - q: How do I register a new Data Plane node?
+  - q: How do I register a new AI Data Plane node?
     a: |
-      Data Plane nodes register themselves when they start and establish a connection to the 
+      AI Data Plane nodes register themselves when they start and establish a connection to the 
       {{site.ai_gateway}} using a client certificate. Once registered, the node appears in 
       the Konnect {{site.ai_gateway}} UI and is accessible via the API.
 
diff --git a/app/_ai_gateway_entities/ai-gateway.md b/app/_ai_gateway_entities/ai-gateway.md
index 062e4213fd..11cdc57034 100644
--- a/app/_ai_gateway_entities/ai-gateway.md
+++ b/app/_ai_gateway_entities/ai-gateway.md
@@ -12,24 +12,26 @@ breadcrumbs:
   - /ai-gateway/
   - /ai-gateway/entities/
 description: |
-  The top-level {{site.ai_gateway}} entity that owns Models, Providers, Policies, Agents, MCP Servers, and other AI-specific entities.
+  The top-level {{site.ai_gateway}} entity that owns AI Models, AI Providers, AI Policies, AI Agents, AI MCP Servers, and other AI-specific entities.
 schema:
   api: konnect/ai-gateway
   path: /schemas/AIGateway
 works_on:
   - konnect
+tools:
+  - konnect-api
 related_resources:
   - text: "About {{site.ai_gateway}}"
     url: /ai-gateway/
   - text: "{{site.ai_gateway}} entities"
     url: /ai-gateway/entities/
-  - text: Model entity
+  - text: AI Model entity
     url: /ai-gateway/entities/ai-model/
-  - text: Provider entity
+  - text: AI Provider entity
     url: /ai-gateway/entities/ai-provider/
-  - text: Policy entity
+  - text: AI Policy entity
     url: /ai-gateway/entities/ai-policy/
-  - text: Data Plane Certificate entity
+  - text: AI Data Plane Certificate entity
     url: /ai-gateway/entities/ai-data-plane-certificate/
 faqs:
   - q: How is an {{site.ai_gateway}} different from a {{site.konnect_short_name}} Gateway control plane?
@@ -69,14 +71,14 @@ faqs:
 
 An {{site.ai_gateway}} is the top-level {{site.ai_gateway}} entity. It represents a single {{site.ai_gateway}} deployment that can operate in two modes: a Control Plane mode (for configuration management and policy enforcement) and a Data Plane mode (for proxying LLM and agent traffic). These modes run within the same {{site.ai_gateway}} runtime, separated from {{site.konnect_short_name}}'s regular Gateway control plane. The {{site.ai_gateway}} entity owns all the child entities used to serve LLM and agent workloads:
 
-1. [AI Models](/ai-gateway/entities/ai-model/): AI model endpoints, capabilities, and load balancing.
-1. [AI Providers](/ai-gateway/entities/ai-provider/): upstream LLM service connections and credentials.
-1. [AI Policies](/ai-gateway/entities/ai-policy/): security, rate limiting, and guardrail behavior attached to other entities.
-1. [AI Agents](/ai-gateway/entities/ai-agent/): A2A and HTTP agent routing.
-1. [AI MCP Servers](/ai-gateway/entities/ai-mcp-server/): MCP tool exposure and session handling.
-1. [AI Vaults](/ai-gateway/entities/ai-vault/): secret storage referenced from other entities.
-1. [AI Consumers](/ai-gateway/entities/ai-consumer/), [AI Consumer Groups](/ai-gateway/entities/ai-consumer-group/), [AI Consumer Credentials](/ai-gateway/entities/ai-consumer-credential/): identities used in access control.
-1. [AI Data Plane Certificates](/ai-gateway/entities/ai-data-plane-certificate/): certificates that authorize data plane nodes to connect.
+- [AI Models](/ai-gateway/entities/ai-model/): AI model endpoints, capabilities, and load balancing.
+- [AI Providers](/ai-gateway/entities/ai-provider/): upstream LLM service connections and credentials.
+- [AI Policies](/ai-gateway/entities/ai-policy/): security, rate limiting, and guardrail behavior attached to other entities.
+- [AI Agents](/ai-gateway/entities/ai-agent/): A2A and HTTP agent routing.
+- [AI MCP Servers](/ai-gateway/entities/ai-mcp-server/): MCP tool exposure and session handling.
+- [AI Vaults](/ai-gateway/entities/ai-vault/): secret storage referenced from other entities.
+- [AI Consumers](/ai-gateway/entities/ai-consumer/), [AI Consumer Groups](/ai-gateway/entities/ai-consumer-group/), [AI Consumer Credentials](/ai-gateway/entities/ai-consumer-credential/): identities used in access control.
+- [AI Data Plane Certificates](/ai-gateway/entities/ai-data-plane-certificate/): certificates that authorize data plane nodes to connect.
 
 Every other {{site.ai_gateway}} entity is created under an {{site.ai_gateway}} and addressed through its ID:
 
@@ -97,10 +99,10 @@ rows:
 
 When an {{site.ai_gateway}} is created, {{site.ai_gateway}} provisions two endpoints that data planes connect to:
 
-1. **Configuration endpoint** (`endpoints.configuration`): the URL data plane nodes use to receive their configuration from the control plane.
-1. **Telemetry endpoint** (`endpoints.telemetry`): the URL data plane nodes use to ship analytics and runtime telemetry back to {{site.konnect_short_name}}.
+1. **Configuration endpoint** ([`endpoints.configuration`](#schema-aigateway-endpoints-configuration)): the URL data plane nodes use to receive their configuration from the control plane.
+1. **Telemetry endpoint** ([`endpoints.telemetry`](#schema-aigateway-endpoints-telemetry)): the URL data plane nodes use to ship analytics and runtime telemetry back to {{site.konnect_short_name}}.
 
-Both endpoints are read-only, assigned at creation time, and stable for the lifetime of the {{site.ai_gateway}}. Data plane nodes need both URLs, along with a [Data Plane Certificate](/ai-gateway/entities/ai-data-plane-certificate/), to register with the {{site.ai_gateway}}.
+Both endpoints are read-only, assigned at creation time, and stable for the lifetime of the {{site.ai_gateway}}. Data plane nodes need both URLs, along with an [AI Data Plane Certificate](/ai-gateway/entities/ai-data-plane-certificate/), to register with the {{site.ai_gateway}}.
 
 ## Control plane and data plane
 
@@ -120,7 +122,7 @@ Use `config_hash` to verify rollout: after a configuration change, watch the nod
 
 ## Lifecycle
 
-{{site.ai_gateway}}s can be created and managed through the {{site.konnect_short_name}} UI or the {{site.ai_gateway}} API. Once an {{site.ai_gateway}} exists, its child entities (AI Models, AI Providers, AI Policies, and so on) are managed through the {{site.ai_gateway}} API or decK as documented on each entity page.
+{{site.ai_gateway}}s can be created and managed through the {{site.konnect_short_name}} UI or the {{site.ai_gateway}} API. Once an {{site.ai_gateway}} exists, its child entities (AI Models, AI Providers, AI Policies, and so on) are managed through the {{site.ai_gateway}} API as documented on each entity page.
 
 Creating an {{site.ai_gateway}} provisions the configuration and telemetry endpoints and gives you the parent ID needed to create child entities. The {{site.ai_gateway}} has no runtime traffic of its own. Traffic flows once at least one AI Model, AI Agent, or AI MCP Server is configured under it and a data plane node is connected.
 
@@ -128,6 +130,19 @@ Updating an {{site.ai_gateway}} changes its `name`, `description`, or `labels`.
 
 Deleting an {{site.ai_gateway}} removes the entity. Its child entities are scoped to the {{site.ai_gateway}} and can't be addressed without it.
 
+## Set up an {{site.ai_gateway}} entity
+
+The following example creates an {{site.ai_gateway}} instance with labels for environment tracking.
+
+{% entity_example %}
+type: ai_gateway
+data:
+  display_name: My AI Gateway
+  description: An AI Gateway for my organization.
+  labels:
+    env: production
+{% endentity_example %}
+
 ## Schema
 
 {% entity_schema %}
diff --git a/app/_ai_gateway_entities/ai-mcp-server.md b/app/_ai_gateway_entities/ai-mcp-server.md
index 70d29dacd3..c41fab85a1 100644
--- a/app/_ai_gateway_entities/ai-mcp-server.md
+++ b/app/_ai_gateway_entities/ai-mcp-server.md
@@ -47,18 +47,18 @@ faqs:
       `conversion-only` MCP Servers into a single MCP endpoint. `upstream-server` registers a real
       MCP server into an aggregation pool, dynamically fetching its tools for a `listener` to aggregate.
 
-  - q: Can the same Consumer's identity gate access to specific tools?
+  - q: Can the same AI Consumer's identity gate access to specific tools?
     a: |
       Yes. Set [`default_tool_acls`](#schema-aigateway-mcpserver-default-tool-acls) on the AI MCP Server with `allow` and `deny` lists, and override per
       tool through [`tools[].acls`](#schema-aigateway-mcpserver-tools-acls). A per-tool ACL replaces the default for that tool, it doesn't
       merge.
 
-  - q: How do OAuth-based ACLs differ from Consumer-based ACLs?
+  - q: How do OAuth-based ACLs differ from AI Consumer-based ACLs?
     a: |
       Set [`acl_attribute_type`](#schema-aigateway-mcpserver-acl-attribute-type) to `oauth_access_token` and provide [`access_token_claim_field`](#schema-aigateway-mcpserver-access-token-claim-field) (a jq
       filter, for example `.user.email`). ACLs then evaluate against the claim value extracted from
       the OAuth access token instead of the resolved Consumer identity. The OAuth flow is supplied
-      by the [AI MCP OAuth2 Policy](/plugins/ai-mcp-oauth2/).
+      by the [AI MCP OAuth2 Policy](/ai-gateway/policies/ai-mcp-oauth2/).
 
   - q: What error code do denied requests return?
     a: |
@@ -66,10 +66,10 @@ faqs:
       `INVALID_PARAMS -32602`; from {{site.ai_gateway}} 3.14 onward, denials follow the
       [MCP 2025-11-25 authorization specification](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#error-handling).
 
-  - q: Can I attach the same authentication or rate-limiting plugin that I'd attach to a Route?
+  - q: Can I attach the same authentication or rate-limiting policy that I'd attach to a Route?
     a: |
-      Plugin configuration that applies to the AI MCP Server goes through the
-      [Policy entity](/ai-gateway/entities/ai-policy/). Attach Policies to the AI MCP Server through its
+      Policy configuration that applies to the AI MCP Server goes through the
+      [AI Policy entity](/ai-gateway/entities/ai-policy/). Attach Policies to the AI MCP Server through its
       [`policies`](#schema-aigateway-mcpserver-policies) field.
 ---
 
@@ -79,7 +79,7 @@ An AI MCP Server is a first-class {{site.ai_gateway}} entity that exposes tools
 
 Because the runtime executes inside {{site.ai_gateway}}, MCP endpoints are provisioned dynamically on demand. You don't host or scale them separately, and the same authentication, traffic control, and observability features available to traditional API traffic apply to MCP traffic at the same scale.
 
-AI MCP Servers can be created and managed through the {{site.konnect_short_name}} UI, the {{site.ai_gateway}} API, or decK:
+AI MCP Servers can be created and managed through the {{site.konnect_short_name}} UI and the {{site.ai_gateway}} API:
 
 {% table %}
 columns:
@@ -237,7 +237,7 @@ Two session strategies:
 1. **Client.** Session state is encrypted into the MCP session ID assigned to the client. Requires `secrets` which are encryption keys; the first entry is used for encryption, all entries are used for decryption to support key rotation.
 1. **Redis.** Session state is stored in Redis. Configure connection details and authentication in [`config.server.session.redis`](#schema-aigateway-mcpserver-config-server-session-redis).
 
-{% include_cached /plugins/redis/redis-cloud-auth.md tier='enterprise' %}
+{% include_cached /md/ai-gateway/v2/policies/redis-cloud-auth.md tier='enterprise' %}
 
 [`session_ttl`](#schema-aigateway-mcpserver-config-server-session-session-ttl) controls how long sessions live (default 24 hours). Set `managed: false` to disable managed sessions when the upstream maintains state externally.
 
@@ -275,7 +275,7 @@ rows:
 
 When exposing MCP servers through {{site.ai_gateway}}, you may need granular control over which authenticated API consumers can discover and invoke specific tools. The MCP Server's ACL feature lets you define access rules at both the default level (applying to all tools) and per-tool level (for fine-grained exceptions).
 
-This way, consumers only interact with tools appropriate to their role, while maintaining a complete audit trail of all access attempts. Authentication is handled by an authentication Policy attached to the MCP Server (such as [Key Auth](/plugins/key-auth/) or an OIDC flow), and the resulting Consumer identity is used for ACL checks.
+This way, consumers only interact with tools appropriate to their role, while maintaining a complete audit trail of all access attempts. Authentication is handled by an authentication Policy attached to the MCP Server (such as [Key Auth Policy](/ai-gateway/policies/key-auth/) or an OIDC flow), and the resulting Consumer identity is used for ACL checks.
 
 {:.info}
 > **ACL in `listener` mode**
@@ -285,7 +285,7 @@ This way, consumers only interact with tools appropriate to their role, while ma
 > To use ACLs with `listener` mode:
 > 1. Configure `conversion-listener` or `conversion-only` AI MCP Servers with ACL rules and tags.
 > 1. Configure `listener` mode to aggregate tools by matching tags.
-> 1. Set [`include_consumer_groups`](#schema-aigateway-mcpserver-include-consumer-groups): true on the listener. Without this setting, the listener cannot pass Consumer Group membership to the aggregated tools, and ACL rules will not evaluate correctly.
+> 1. Set [`include_consumer_groups`](#schema-aigateway-mcpserver-include-consumer-groups): true on the listener. Without this setting, the listener cannot pass AI Consumer Group membership to the aggregated tools, and ACL rules will not evaluate correctly.
 >
 > See [Enforce ACLs on aggregated MCP servers](/mcp/enforce-acls-on-aggregated-mcp-servers/) for a complete example.
 
@@ -294,7 +294,7 @@ This way, consumers only interact with tools appropriate to their role, while ma
 For modes that support ACL configuration (`conversion-listener`, `conversion-only`, `upstream-server`), two attribute types determine what the AI MCP Server evaluates ACL rules against:
 
 1. **`consumer`** (default). Evaluates against the resolved Consumer identity.
-1. **`oauth_access_token`**. Evaluates against a claim extracted from the OAuth access token. Set [`access_token_claim_field`](#schema-aigateway-mcpserver-access-token-claim-field) to a jq filter (for example, `.user.email` for a nested claim). The OAuth flow itself is supplied by the [AI MCP OAuth2 Policy](/plugins/ai-mcp-oauth2/).
+1. **`oauth_access_token`**. Evaluates against a claim extracted from the OAuth access token. Set [`access_token_claim_field`](#schema-aigateway-mcpserver-access-token-claim-field) to a jq filter (for example, `.user.email` for a nested claim). The OAuth flow itself is supplied by the [AI MCP OAuth2 Policy](/ai-gateway/policies/ai-mcp-oauth2/).
 
 ### Supported identifier types
 
@@ -303,7 +303,7 @@ When `acl_attribute_type` is `consumer`, ACL rules can reference [AI Consumers](
 * `username`: Consumer username
 * `id`: Consumer UUID
 * `custom_id`: Custom Consumer identifier
-* `consumer_groups.name`: Consumer Group name
+* `consumer_groups.name`: AI Consumer Group name
 
 The authenticated Consumer identity is matched against these identifiers. If the [AI Consumer](/ai-gateway/entities/ai-consumer/) or any of their [AI Consumer Groups](/ai-gateway/entities/ai-consumer-group/) match an ACL entry, the rule applies.
 
@@ -442,13 +442,13 @@ sequenceDiagram
 
 ## Attach Policies
 
-Authentication, rate limiting, request and response transformation, and OAuth gating (through [AI MCP OAuth2](/plugins/ai-mcp-oauth2/)) attach to the AI MCP Server through the [`policies`](#schema-aigateway-mcpserver-policies) field. Each entry is a string that references a Policy by name or ID. Multiple Policies can attach to one AI MCP Server; each runs independently.
+Authentication, rate limiting, request and response transformation, and OAuth gating (through [AI MCP OAuth2 Policy](/ai-gateway/policies/ai-mcp-oauth2/)) attach to the AI MCP Server through the [`policies`](#schema-aigateway-mcpserver-policies) field. Each entry is a string that references a Policy by name or ID. Multiple Policies can attach to one AI MCP Server; each runs independently.
 
-For details, see the [Policy entity](/ai-gateway/entities/ai-policy/) reference.
+For details, see the [AI Policy entity](/ai-gateway/entities/ai-policy/) reference.
 
 ## Scope of support
 
-The MCP Server runtime supports MCP operations and upstream interactions, while certain advanced features and non-HTTP protocols are not currently supported. The table below summarizes what is supported and what is outside the current scope.
+The AI MCP Server runtime supports MCP operations and upstream interactions, while certain advanced features and non-HTTP protocols are not currently supported. The table below summarizes what is supported and what is outside the current scope.
 
 <!-- vale off -->
 {% feature_table %}
diff --git a/app/_ai_gateway_entities/ai-model.md b/app/_ai_gateway_entities/ai-model.md
index 89cc12052f..dd4cad6362 100644
--- a/app/_ai_gateway_entities/ai-model.md
+++ b/app/_ai_gateway_entities/ai-model.md
@@ -26,13 +26,13 @@ related_resources:
     url: /ai-gateway/ai-providers/
   - text: Load balancing
     url: /ai-gateway/load-balancing/
-  - text: Provider entity
+  - text: AI Provider entity
     url: /ai-gateway/entities/ai-provider/
-  - text: Policy entity
+  - text: AI Policy entity
     url: /ai-gateway/entities/ai-policy/
   - text: "{{site.ai_gateway}} entities"
     url: /ai-gateway/entities/
-  - text: Consumer Group entity
+  - text: AI Consumer Group entity
     url: /ai-gateway/entities/ai-consumer-group/
 faqs:
   - q: What's the difference between an AI Model entity and the `model` field in an AI Policy configuration?
@@ -41,20 +41,12 @@ faqs:
       It defines routing, capabilities, and load balancing. An AI Policy is a reusable configuration that adds behavior (like caching or guardrails) to an AI Model.
       You declare both separately and attach AI Policies to AI Models.
 
-  - q: Can I edit the Service or Routes that {{site.ai_gateway}} generates from a Model?
-    a: |
-      No. Generated primitives are protected from direct modification through the standard Admin API.
-      Update the Model entity instead, and {{site.ai_gateway}} recreates the underlying primitives within a single transaction.
 
   - q: What happens when I update an AI Model?
     a: |
       {{site.ai_gateway}} deletes the AI Model's derived primitives and recreates them from the updated entity state, all within a single database transaction.
       On failure, the transaction rolls back and no partial state is written.
 
-  - q: What happens when I delete an AI Model?
-    a: |
-      The AI Model and all its derived primitives (Service, Routes) are deleted within a single transaction.
-
   - q: Can I apply the same configuration to multiple AI Models?
     a: |
       Yes, by attaching one AI Policy with that configuration to each AI Model.
@@ -96,7 +88,7 @@ An AI Model is a first-class {{site.ai_gateway}} entity that represents an AI mo
 
 An AI Model declares which capabilities it exposes (such as `chat`, `responses`, or `embeddings`), which upstream AI Provider models it routes to, and how requests are load-balanced and logged. {{site.ai_gateway}} translates an AI Model into the underlying primitives that the runtime uses to serve traffic, so you don't need to assemble Services or Routes by hand.
 
-AI Models can be created and managed through the {{site.konnect_short_name}} UI, the {{site.ai_gateway}} API:
+AI Models can be created and managed through the {{site.konnect_short_name}} UI and the {{site.ai_gateway}} API:
 
 {% table %}
 columns:
@@ -136,7 +128,7 @@ Generated primitives are protected. Direct PUT, PATCH, or DELETE calls against t
 {:.info}
 > **Why a transaction instead of an in-place update?**
 >
-> A Model's structure (which capabilities exist, which providers it routes to) determines how many Routes are needed. A delete-and-recreate cycle is the simplest way to keep the entity and its derived primitives consistent, especially when capabilities are added or removed.
+> An AI Model's structure (which capabilities exist, which providers it routes to) determines how many Routes are needed. A delete-and-recreate cycle is the simplest way to keep the entity and its derived primitives consistent, especially when capabilities are added or removed.
 
 ## Capabilities
 
@@ -244,7 +236,7 @@ When a native format is set, only the corresponding provider is supported with i
 
 ## Target models
 
-A Model is a virtual model: it exposes one route ([`config.route`](#schema-aigateway-model-config-route)) and one set of capabilities, and routes requests to one or more concrete upstream models declared in its [`target_models`](#schema-aigateway-model-target-models) array. Each entry represents a single upstream model instance with one URL.
+An AI Model is a virtual model: it exposes one route ([`config.route`](#schema-aigateway-model-config-route)) and one set of capabilities, and routes requests to one or more concrete upstream models declared in its [`target_models`](#schema-aigateway-model-target-models) array. Each entry represents a single upstream model instance with one URL.
 
 For each target, you provide the upstream model name (for example, `gpt-4o`) and reference the Provider to use by its `name`. Each target can also override settings such as [`temperature`](#schema-aigateway-model-target-models-config-temperature), [`max_tokens`](#schema-aigateway-model-target-models-config-max-tokens), [`input_cost`](#schema-aigateway-model-target-models-config-input-cost), and [`output_cost`](#schema-aigateway-model-target-models-config-output-cost).
 
@@ -252,9 +244,9 @@ There's no separate Target Model entity or endpoint. Target models are managed o
 
 ## Load balancing
 
-A Model routes to a single target by default. Add more than one target when you want redundancy, fallback between providers, or cost and latency optimization. When you have multiple targets, configure [`config.balancer`](#schema-aigateway-model-config-balancer) to distribute requests according to a load balancing algorithm.
+An AI Model routes to a single target by default. Add more than one target when you want redundancy, fallback between providers, or cost and latency optimization. When you have multiple targets, configure [`config.balancer`](#schema-aigateway-model-config-balancer) to distribute requests according to a load balancing algorithm.
 
-When a Model has more than one target, the [load balancer](#schema-aigateway-model-config-balancer) sits between the virtual model and its targets, distributing requests according to `config.balancer`. For algorithm details, selection guidance, and tuning, see [Load balancing](/ai-gateway/load-balancing/).
+When an AI Model has more than one target, the [load balancer](#schema-aigateway-model-config-balancer) sits between the virtual model and its targets, distributing requests according to `config.balancer`. For algorithm details, selection guidance, and tuning, see [Load balancing](/ai-gateway/load-balancing/).
 
 ### Algorithms
 
@@ -323,7 +315,7 @@ An embedding model converts request and response text into vector representation
 
 ## Templating
 
-The Model resolves runtime values from request data using placeholder substitution. This lets you select the target model dynamically per request, route to per-deployment Azure endpoints, or fan out to multiple providers from a single Model.
+The AI Model resolves runtime values from request data using placeholder substitution. This lets you select the target model dynamically per request, route to per-deployment Azure endpoints, or fan out to multiple providers from a single AI Model.
 
 Substitution applies to the [`name`](#schema-aigateway-model-target-models-name) of each target model and to any per-target [`config`](#schema-aigateway-model-target-models-config) option. Three placeholders are available:
 
@@ -351,15 +343,15 @@ Not every AI Policy type is valid as an AI Model attachment.
 
 AI Policies attached to an AI Model are not deleted when the AI Model is deleted; only the AI Model's reference is removed.
 
-For further information, see the [Policy entity](/ai-gateway/entities/ai-policy/) reference.
+For further information, see the [AI Policy entity](/ai-gateway/entities/ai-policy/) reference.
 
-### Plugin priority and Policy execution order
+### AI Policy execution order
 
-A Policy attached to a Model runs on the Service of the Model's derived primitives. That Policy runs at the [priority](/gateway/entities/plugin/#plugin-priority) determined by its type, which affects when it executes relative to other Policies on the request.
+An AI Policy attached to a Model runs on the Service of the Model's derived primitives. That AI Policy runs at the [priority](/gateway/entities/plugin/#plugin-priority) determined by its type, which affects when it executes relative to other AI Policies on the request.
 
-Model routing executes at a specific point in the request pipeline. Policies have different priorities that determine when they run.  Higher priority Policies types may run before the Model routing is resolved. Authentication Policies (such as OpenID Connect) fall into this category. They gate access correctly because routing to the Model's generated Service already occurred, but model-level identity details (provider and target model) are not available until after Model resolution.
+Model routing executes at a specific point in the request pipeline. AI Policies have different priorities that determine when they run.  Higher priority AI Policy types may run before the Model routing is resolved. Authentication AI Policies (such as OpenID Connect) fall into this category. They gate access correctly because routing to the Model's generated Service already occurred, but model-level identity details (provider and target model) are not available until after Model resolution.
 
-For Policies whose behavior depends on the resolved Model identity, use Policy types that run at or after Model resolution, or use [dynamic plugin ordering](/gateway/entities/plugin/#dynamic-plugin-ordering) to adjust execution order as needed.
+For AI Policies whose behavior depends on the resolved Model identity, use AI Policy types that run at or after Model resolution, or use [dynamic plugin ordering](/gateway/entities/plugin/#dynamic-plugin-ordering) to adjust execution order as needed.
 
 ## Upstream proxy configuration
 
diff --git a/app/_ai_gateway_entities/ai-policy.md b/app/_ai_gateway_entities/ai-policy.md
index e267fe4d68..7e12a18ba4 100644
--- a/app/_ai_gateway_entities/ai-policy.md
+++ b/app/_ai_gateway_entities/ai-policy.md
@@ -28,35 +28,27 @@ related_resources:
     url: /ai-gateway/entities/ai-agent/
   - text: AI MCP Server entity
     url: /ai-gateway/entities/ai-mcp-server/
-  - text: Plugin entity
-    url: /gateway/entities/plugin/
+
 faqs:
   - q: Are AI Policies shared across multiple entities?
     a: |
-      No. Each AI Policy is an independent instance. To apply the same plugin
+      No. Each AI Policy is an independent configuration. To apply the same
       configuration to two AI Models, create two AI Policies with matching `config`,
       one per AI Model.
 
   - q: How is an AI Policy different from a plugin?
     a: |
-      An AI Policy is a plugin instance configured through the {{site.ai_gateway}} entity surface
-      instead of the classic `/plugins` endpoint. The runtime effect is the same: a plugin attached
+      An AI Policy is a policy configuration created through the {{site.ai_gateway}} entity surface
+      instead of the classic `/plugins` endpoint. The runtime effect is the same: a policy attached
       at the appropriate scope. {{site.ai_gateway}} manages the AI Policy's lifecycle alongside the
       entity it's attached to.
 
   - q: Can an AI Policy be scoped to an AI Consumer or AI Consumer Group?
     a: |
       Yes. Add the AI Policy's `name` or `id` to the AI Consumer's or AI Consumer Group's `policies` array.
-      The plugin runs when the AI Consumer is identified during a request, or when a member of the
+      The Policy runs when the AI Consumer is identified during a request, or when a member of the
       AI Consumer Group is identified.
 
-  - q: What plugin types can an AI Policy use?
-    a: |
-      Set the plugin name in the AI Policy's `type` field and provide the plugin's configuration
-      in the `config` field. Examples include `ai-sanitizer`, `ai-prompt-guard`,
-      `ai-prompt-decorator`, `ai-rate-limiting-advanced`, and `openid-connect`. The supported set
-      isn't enumerated on this page, refer to the {{site.ai_gateway}} plugin reference for the full list.
-
   - q: What happens to an AI Policy when its parent entity is deleted?
     a: |
       Standalone AI Policies referenced from parent entities through a `policies` array are independent
@@ -65,13 +57,13 @@ faqs:
 
 ## What is an AI Policy?
 
-An AI Policy is an {{site.ai_gateway}} entity that represents an action, taken by a plugin, that can be attached to an {{site.ai_gateway}} entity.
+An AI Policy is a reusable configuration that can be attached to {{site.ai_gateway}} entities to enforce security, transformation, and traffic-control behavior.
 
-Each AI Policy declares a `type` (which is a plugin name, for example `ai-sanitizer` or `ai-rate-limiting-advanced`) and a `config` block whose contents follow that plugin's own schema. {{site.ai_gateway}} attaches the configured plugin at the scope you select: globally, or to a specific AI Model, AI Agent, or AI MCP Server.
+Each AI Policy includes a `type` field (such as `ai-sanitizer` or `ai-rate-limiting-advanced`) that sets the type of behavior, and a `config` block that specifies the requirments of the behavior. {{site.ai_gateway}} attaches the configured policy at the scope you select: globally, or to a specific AI Model, AI Agent, or AI MCP Server.
 
-For the set of plugin types you can use as an AI Policy `type`, see the [AI plugin reference](/plugins/?category=ai).
+For the complete set of behaviors available as an AI Policy `type`, see the [AI policies hub](/ai-gateway/policies/).
 
-**AI Policies are not shared.** Each AI Policy is an independent plugin instance tied to its parent entity's lifecycle. To apply identical configuration to two AI Models, create two separate AI Policies with matching `config`. This design ensures that deleting an AI Model deletes only its own AI Policies, not configurations used by other entities.
+**AI Policies are not shared.** Each AI Policy is an independent configuration tied to its parent entity's lifecycle. To apply identical configuration to two AI Models, create two separate AI Policies with matching `config`. This design ensures that deleting an AI Model deletes only its own AI Policies, not configurations used by other entities.
 
 AI Policies are managed through the {{site.ai_gateway}} entity surface:
 
@@ -88,32 +80,32 @@ rows:
 
 ## AI Policy scopes
 
-An AI Policy is scoped by where it's referenced from. Each AI Policy is an independent plugin instance attached at exactly one scope. To apply the same configuration in multiple places, create one AI Policy per place.
+An AI Policy's scope is determined by where it's referenced. Each AI Policy is an independent configuration that applies at exactly one scope: globally, or to a specific entity (AI Model, AI Agent, AI MCP Server, AI Consumer, or AI Consumer Group). To apply identical configuration in multiple places, create one AI Policy per location.
 
 The available scopes are:
 
-* **Global**: an AI Policy that no parent entity references runs for every {{site.ai_gateway}} route on the data plane. Non-AI traffic on the same data plane isn't affected.
-* **AI Model**: referenced from the `policies` array on an [AI Model entity](/ai-gateway/entities/ai-model/). The plugin runs at the Service of the AI Model's derived primitives.
-* **AI Agent**: referenced from the `policies` array on an [AI Agent entity](/ai-gateway/entities/ai-agent/). The plugin runs at the Service of the AI Agent's derived primitives.
-* **AI MCP Server**: referenced from the `policies` array on an [AI MCP Server entity](/ai-gateway/entities/ai-mcp-server/). The plugin runs at the Service of the AI MCP Server's derived primitives.
-* **AI Consumer**: referenced from the `policies` array on an [AI Consumer entity](/ai-gateway/entities/ai-consumer/). The plugin runs when the AI Consumer is identified during a request.
-* **AI Consumer Group**: referenced from the `policies` array on an [AI Consumer Group entity](/ai-gateway/entities/ai-consumer-group/). The plugin runs when a member of the AI Consumer Group is identified during a request.
+* **Global**: an AI Policy with no parent entity reference applies to all {{site.ai_gateway}} traffic on the data plane. Non-AI traffic on the same data plane isn't affected.
+* **AI Model**: referenced from the `policies` array on an [AI Model entity](/ai-gateway/entities/ai-model/). The Policy applies to that AI Model.
+* **AI Agent**: referenced from the `policies` array on an [AI Agent entity](/ai-gateway/entities/ai-agent/). The Policy applies to that AI Agent.
+* **AI MCP Server**: referenced from the `policies` array on an [AI MCP Server entity](/ai-gateway/entities/ai-mcp-server/). The Policy applies to that AI MCP Server.
+* **AI Consumer**: referenced from the `policies` array on an [AI Consumer entity](/ai-gateway/entities/ai-consumer/). The Policy applies when the AI Consumer is identified during a request.
+* **AI Consumer Group**: referenced from the `policies` array on an [AI Consumer Group entity](/ai-gateway/entities/ai-consumer-group/). The Policy applies when a member of the AI Consumer Group is identified during a request.
 
 ### Creating AI Policies
 
-All AI Policies are created through a single endpoint at `/v1/ai-gateways/{aiGatewayId}/policies`. Scope is set entirely through the reference-array mechanism above: add the AI Policy's `name` or `id` to the parent entity's `policies` array, or omit the reference for global scope.
+All AI Policies are created through a single endpoint at `/v1/ai-gateways/{aiGatewayId}/policies`. Scope is determined entirely by which entity references the AI Policy: add the AI Policy's `name` or `id` to the parent entity's `policies` array, or omit the reference for global scope.
 
 ## Lifecycle
 
-Creating an AI Policy creates exactly one plugin entry in the underlying runtime. Updating an AI Policy updates that plugin entry. Deleting an AI Policy deletes that plugin entry. All scopes support standard CRUD operations through the matching path.
+An AI Policy maps to exactly one Policy entry in the underlying runtime. Creating, updating, or deleting an AI Policy creates, updates, or deletes that Policy entry respectively. All scopes support standard CRUD operations through the AI Policy API endpoint.
 
-The `config` field is passed through to the plugin without translation.
+The `config` field is passed through to the policy without translation.
 
 {:.info}
-> **Plugin config schemas live with the plugin docs**
+> **Policy config schemas live with the policy docs**
 >
-> {{site.ai_gateway}} does not define plugin configuration schemas under the AI Policy entity.
-> For each plugin you intend to use as an AI Policy `type`, look up that plugin's reference page for its `config` shape.
+> {{site.ai_gateway}} does not define policy configuration schemas under the AI Policy entity.
+> For each policy you intend to use as an AI Policy `type`, look up that Policy's reference page for its `config` shape.
 
 ## Set up a global AI Policy
 
diff --git a/app/_ai_gateway_entities/ai-provider.md b/app/_ai_gateway_entities/ai-provider.md
index 4c8cea5d33..548300d673 100644
--- a/app/_ai_gateway_entities/ai-provider.md
+++ b/app/_ai_gateway_entities/ai-provider.md
@@ -29,10 +29,10 @@ related_resources:
   - text: AI Policy entity
     url: /ai-gateway/entities/ai-policy/
 faqs:
-  - q: What happens when I update a Provider's credentials?
+  - q: What happens when I update an AI Provider's credentials?
     a: |
-      {{site.ai_gateway}} propagates the credential change to every Model that references the
-      Provider (by `name` or `id`). The next request through any of those Models uses the updated
+      {{site.ai_gateway}} propagates the credential change to every AI Model that references the
+      AI Provider (by `name` or `id`). The next request through any of those AI Models uses the updated
       credentials.
 
   - q: How does an AI Model reference an AI Provider?
@@ -44,12 +44,6 @@ faqs:
       No. An AI Provider entity is a write-time template. Credentials and configuration only enter
       the runtime when an AI Model references the AI Provider; at that point, the AI Provider's values are
       materialized into the underlying primitives generated for the AI Model.
-
-  # - q: How do I configure providers in on-prem deployments?
-  #   a: |
-  #     {{site.ai_gateway}} entities are available only in {{site.konnect_short_name}}.
-  #     For on-prem deployments, configure provider credentials and endpoints using {{site.base_gateway}} plugins directly (for example, the AI Proxy plugin).
-  #     See the [{{site.base_gateway}} plugin catalog](/gateway/plugins/) for available AI-related plugins.
 ---
 
 ## What is an AI Provider?
@@ -64,7 +58,7 @@ An AI Provider stores how to reach and authenticate to an upstream LLM service.
 
 AI Providers don't expose model endpoints on their own. They become routable only through an AI Model that references them.
 
-AI Providers can be created and managed through the {{site.konnect_short_name}} UI, the {{site.ai_gateway}} API, or decK:
+AI Providers can be created and managed through the {{site.konnect_short_name}} UI and the {{site.ai_gateway}} API:
 
 {% table %}
 columns:
@@ -79,7 +73,7 @@ rows:
 
 ## Supported providers
 
-{{site.ai_gateway}} supports the following upstream providers. The Provider's [`type`](#schema-aigateway-provider-type) field selects one of these connections. Per-provider pages document supported capabilities, configuration requirements, and provider-specific limitations.
+{{site.ai_gateway}} supports the following upstream providers. The AI Provider's [`type`](#schema-aigateway-provider-type) field selects one of these connections. Per-provider pages document supported capabilities, configuration requirements, and provider-specific limitations.
 
 {% html_tag type="div" css_classes="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-3" %}
 {% icon_card icon="openai.svg" title="OpenAI" cta_url="/ai-gateway/ai-providers/openai/" %}
@@ -103,7 +97,7 @@ rows:
 
 ## Authentication
 
-The [`config.auth`](#schema-aigateway-provider-config-auth) object declares how {{site.ai_gateway}} authenticates to the upstream provider. The shape of `auth` depends on the Provider's [`type`](#schema-aigateway-provider-type):
+The [`config.auth`](#schema-aigateway-provider-config-auth) object declares how {{site.ai_gateway}} authenticates to the upstream provider. The shape of `auth` depends on the AI Provider's [`type`](#schema-aigateway-provider-type):
 
 * **`basic`**: header- or query-parameter-based auth. Used by most provider types.
 * **`aws`**: IAM access-key and assume-role auth. Used by [Bedrock](/ai-gateway/ai-providers/bedrock/).
@@ -131,9 +125,9 @@ The [Gemini](/ai-gateway/ai-providers/gemini/) and [Vertex AI](/ai-gateway/ai-pr
 
 ## Provider references
 
-[AI Models](/ai-gateway/entities/ai-model/) reference a Provider through the [`target_models[].provider`](/ai-gateway/entities/ai-model/#schema-aigateway-model-target-models-provider) field. The same reference shape is used elsewhere in the schema (such as the embeddings model under a Model's load balancer config). Provider references in {{site.ai_gateway}} entities accept either the Provider [`name`](#schema-aigateway-provider-name) or `id`.
+[AI Models](/ai-gateway/entities/ai-model/) reference an AI Provider through the [`target_models[].provider`](/ai-gateway/entities/ai-model/#schema-aigateway-model-target-models-provider) field. The same reference shape is used elsewhere in the schema (such as the embeddings model under an AI Model's load balancer config). AI Provider references in {{site.ai_gateway}} entities accept either the AI Provider [`name`](#schema-aigateway-provider-name) or `id`.
 
-If references use [`name`](#schema-aigateway-provider-name), the `name` field acts as a stable human-readable handle. Renaming a Provider (changing `name`) breaks any Model references that point at the old name.
+If references use [`name`](#schema-aigateway-provider-name), the `name` field acts as a stable human-readable handle. Renaming an AI Provider (changing `name`) breaks any AI Model references that point at the old name.
 
 ## Lifecycle
 
diff --git a/app/_ai_gateway_entities/ai-vault.md b/app/_ai_gateway_entities/ai-vault.md
index 3b67f755a5..dd576998d0 100644
--- a/app/_ai_gateway_entities/ai-vault.md
+++ b/app/_ai_gateway_entities/ai-vault.md
@@ -22,9 +22,9 @@ tools:
 related_resources:
   - text: "About {{site.ai_gateway}}"
     url: /ai-gateway/
-  - text: Provider entity
+  - text: AI Provider entity
     url: /ai-gateway/entities/ai-provider/
-  - text: Model entity
+  - text: AI Model entity
     url: /ai-gateway/entities/ai-model/
   - text: "{{site.base_gateway}} Vault entity"
     url: /gateway/entities/vault/
@@ -61,7 +61,7 @@ An AI Vault is a first-class {{site.ai_gateway}} entity that registers a secret-
 
 An AI Vault entity stores the connection configuration and credentials needed to reach the backend. {{site.ai_gateway}} resolves vault references against the registered AI Vaults at request time.
 
-AI Vaults can be created and managed through the {{site.konnect_short_name}} UI, the {{site.ai_gateway}} API, or decK:
+AI Vaults can be created and managed through the {{site.konnect_short_name}} UI and the {{site.ai_gateway}} API:
 
 {% table %}
 columns:
diff --git a/app/_data/entity_examples/config.yml b/app/_data/entity_examples/config.yml
index d7cc0f518a..c88c965dc1 100644
--- a/app/_data/entity_examples/config.yml
+++ b/app/_data/entity_examples/config.yml
@@ -213,6 +213,8 @@ formats:
       - ai-policy
       - ai-consumer
       - ai-consumer-group
+      - ai-gateway
+      - ai-data-plane-certificate
       - admin
       - ca_certificate
       - certificate
diff --git a/app/_includes/components/entity_example/format/ui_ai.md b/app/_includes/components/entity_example/format/ui_ai.md
index ab70cb72fc..a3db59a847 100644
--- a/app/_includes/components/entity_example/format/ui_ai.md
+++ b/app/_includes/components/entity_example/format/ui_ai.md
@@ -77,6 +77,26 @@ The following creates a new AI MCP Server. Suggested values are shown in backtic
 1. Enter a **Display Name** (for example: `{{ include.presenter.data['display_name'] }}`) and **Name** (for example: `{{ include.presenter.data['name'] }}`).
 1. Configure endpoint/auth settings and optional policies.
 1. Click **Create**.
+{% when 'ai_gateway' %}
+The following creates a new {{site.ai_gateway}}. Suggested values are shown in backticks:
+
+1. In {{site.konnect_short_name}}, navigate to [{{site.ai_gateway_name}}](https://cloud.konghq.com/ai-gateway/) in the sidebar.
+1. Click **New {{site.ai_gateway}}**.
+1. Enter a **Display Name** (for example: `{{ include.presenter.data['display_name'] }}`) and **Name** (for example: `{{ include.presenter.data['name'] }}`).
+1. Optionally add a description (for example: `{{ include.presenter.data['description'] }}`).
+1. Optionally add labels for organization and tracking (for example: `{{ include.presenter.data['labels'] }}`).
+1. Click **Create**.
+{% when 'data_plane_certificate' %}
+The following adds a new data plane certificate. Suggested values are shown in backticks:
+
+1. In {{site.konnect_short_name}}, navigate to [{{site.ai_gateway_name}}](https://cloud.konghq.com/ai-gateway/) in the sidebar.
+1. Select an {{site.ai_gateway}}.
+1. Navigate to **Settings**.
+1. Select the **Certificates** tab.
+1. Click **New Certificate**.
+1. Enter a **Display Name** (for example: `{{ include.presenter.data['display_name'] }}`) and **Name** (for example: `{{ include.presenter.data['name'] }}`).
+1. Upload or paste the certificate and private key.
+1. Click **Create**.
 {% else %}
 UI instructions are not yet available for this {{site.ai_gateway}} entity type.
 {% endcase %}
diff --git a/app/_includes/md/ai-gateway/v2/entities/log-output-fields.md b/app/_includes/md/ai-gateway/v2/entities/log-output-fields.md
new file mode 100644
index 0000000000..2ef99b2668
--- /dev/null
+++ b/app/_includes/md/ai-gateway/v2/entities/log-output-fields.md
@@ -0,0 +1,55 @@
+When [`config.logging.statistics`](#schema-aigateway-agent-config-logging-statistics) is enabled, the AI Agent entity writes the following fields to the
+`ai.a2a.rpc[]` array:
+
+{% table %}
+columns:
+  - title: Field
+    key: field
+  - title: Type
+    key: type
+  - title: Description
+    key: description
+rows:
+  - field: "`ai.a2a.rpc[].method`"
+    type: string
+    description: A2A operation name
+  - field: "`ai.a2a.rpc[].binding`"
+    type: string
+    description: "Protocol binding: `jsonrpc` or `rest`"
+  - field: "`ai.a2a.rpc[].latency`"
+    type: number
+    description: End-to-end proxy latency in milliseconds
+  - field: "`ai.a2a.rpc[].id`"
+    type: string
+    description: Request ID (JSON-RPC) or task ID (REST)
+  - field: "`ai.a2a.rpc[].task_id`"
+    type: string
+    description: Task ID extracted from the response
+  - field: "`ai.a2a.rpc[].task_state`"
+    type: string
+    description: "Normalized task state (see [task states](ai-gateway/policies/ai-a2a-proxy/#task-states))"
+  - field: "`ai.a2a.rpc[].context_id`"
+    type: string
+    description: A2A context ID extracted from the response
+  - field: "`ai.a2a.rpc[].error`"
+    type: string
+    description: Error type string when the upstream returned an error
+  - field: "`ai.a2a.rpc[].response_body_size`"
+    type: number
+    description: Response body size in bytes
+  - field: "`ai.a2a.rpc[].streaming`"
+    type: boolean
+    description: "`true` for SSE streaming responses"
+  - field: "`ai.a2a.rpc[].ttfb_latency`"
+    type: number
+    description: Time to first byte in milliseconds (streaming only)
+  - field: "`ai.a2a.rpc[].sse_events_count`"
+    type: number
+    description: "Count of SSE `data:` events received (streaming only)"
+  - field: "`ai.a2a.rpc[].payload.request`"
+    type: string
+    description: "Request body (only when `log_payloads` is enabled)"
+  - field: "`ai.a2a.rpc[].payload.response`"
+    type: string
+    description: "Response body (only when `log_payloads` is enabled)"
+{% endtable %}
diff --git a/app/_includes/md/ai-gateway/v2/entities/otel-span-attributes.md b/app/_includes/md/ai-gateway/v2/entities/otel-span-attributes.md
new file mode 100644
index 0000000000..30e5b0723e
--- /dev/null
+++ b/app/_includes/md/ai-gateway/v2/entities/otel-span-attributes.md
@@ -0,0 +1,45 @@
+<!-- vale off -->
+{% table %}
+columns:
+  - title: Attribute
+    key: key
+  - title: Value Type
+    key: type
+  - title: Description
+    key: desc
+rows:
+  - key: "`kong.a2a.operation`"
+    type: string
+    desc: A2A operation name
+  - key: "`kong.a2a.protocol.version`"
+    type: string
+    desc: "Value of the `A2A-Version` request header, or `unknown`"
+  - key: "`kong.a2a.task.id`"
+    type: string
+    desc: Task ID from the response
+  - key: "`kong.a2a.task.state`"
+    type: string
+    desc: Normalized task state
+  - key: "`kong.a2a.context.id`"
+    type: string
+    desc: A2A context ID
+  - key: "`kong.a2a.error`"
+    type: string
+    desc: Error type string when present
+  - key: "`kong.a2a.streaming`"
+    type: boolean
+    desc: "`true` for SSE streaming responses"
+  - key: "`kong.a2a.ttfb_latency`"
+    type: int
+    desc: Time to first byte in milliseconds (streaming only)
+  - key: "`kong.a2a.sse_events_count`"
+    type: int
+    desc: Count of SSE events (streaming only)
+  - key: "`rpc.system`"
+    type: string
+    desc: "`jsonrpc` (JSON-RPC binding only)"
+  - key: "`rpc.method`"
+    type: string
+    desc: A2A operation name (JSON-RPC binding only)
+{% endtable %}
+<!-- vale on -->
diff --git a/app/_includes/md/ai-gateway/v2/policies/redis-cloud-auth.md b/app/_includes/md/ai-gateway/v2/policies/redis-cloud-auth.md
new file mode 100644
index 0000000000..b1083f8301
--- /dev/null
+++ b/app/_includes/md/ai-gateway/v2/policies/redis-cloud-auth.md
@@ -0,0 +1,9 @@
+If your Policy uses a Redis datastore, you can authenticate to it with a cloud Redis provider.
+This allows you to seamlessly rotate credentials without relying on static passwords.
+
+The following providers are supported:
+* AWS ElastiCache
+* Azure Managed Redis
+* {{ site.google_cloud }} Memorystore (with or without Valkey)
+
+Each provider also supports an instance and cluster configuration.
diff --git a/app/_landing_pages/ai-gateway/entities.yaml b/app/_landing_pages/ai-gateway/entities.yaml
index 313199bbb6..296f57b79a 100644
--- a/app/_landing_pages/ai-gateway/entities.yaml
+++ b/app/_landing_pages/ai-gateway/entities.yaml
@@ -7,8 +7,9 @@ metadata:
   products:
     - ai-gateway
   works_on:
-    - on-prem
     - konnect
+  min_version:
+    ai-gateway: '2.0'
 
 rows:
   - header:
@@ -25,14 +26,14 @@ rows:
           - type: card
             config:
               title: "{{site.ai_gateway}}"
-              description: The top-level entity that owns Models, Providers, Policies, Agents, MCP Servers, and other AI-specific entities.
+              description: The top-level entity that owns AI Models, AI Providers, AI Policies, AI Agents, AI MCP Servers, and other AI-specific entities.
               cta:
                 text: "{{site.ai_gateway}} entity"
                 url: /ai-gateway/entities/ai-gateway/
       - blocks:
           - type: card
             config:
-              title: "{{site.ai_gateway}} Provider"
+              title: "AI Provider"
               description: Stores upstream provider credentials and connection configuration. Providers are reusable and are not model endpoints.
               cta:
                 text: AI Provider entity
@@ -40,10 +41,10 @@ rows:
       - blocks:
           - type: card
             config:
-              title: Model
+              title: AI Model
               description: Defines a model endpoint and capability configuration used for model selection and policy targeting.
               cta:
-                text: Model entity
+                text: AI Model entity
                 url: /ai-gateway/entities/ai-model/
       - blocks:
           - type: card
@@ -65,7 +66,7 @@ rows:
           - type: card
             config:
               title: AI Policy
-              description: An AI Gateway plugin instance scoped globally or to a specific AI entity. Policy instances are independent.
+              description: A reusable policy configuration scoped globally or to a specific AI entity. Policy instances are independent.
               cta:
                 text: AI Policy entity
                 url: /ai-gateway/entities/ai-policy/
@@ -95,7 +96,7 @@ rows:
           - type: card
             config:
               title: AI Vault
-              description: Store and reference secrets used by AI Gateway entities and plugins.
+              description: Store and reference secrets used by AI Gateway entities.
               cta:
                 text: AI Vault entity
                 url: /ai-gateway/entities/ai-vault/