feat(gateway/m&b): Entitlement enforcement plugin docs

[lena-larionova]

Description

Fixes #6789

Docs for the Entitlement Enforcement plugin with examples.

To test, set the KONG_LICENSE_DATA env variable with the license surrounded in single quotes, then run the quickstart on-prem with:

curl -Ls https://get.konghq.com/quickstart | bash -s -- -e KONG_LICENSE_DATA -i kong-gateway-dev -a kong-316 -t 3.16.0.0-rc.2

‼️ This will only test that the schema applies. The plugin is Konnect-only, so you won't be able to test functionality this way.

Relates to #6691.

Preview Links

https://deploy-preview-7015--kongdeveloper.netlify.app/plugins/entitlement-enforcement/
https://deploy-preview-7015--kongdeveloper.netlify.app/plugins/entitlement-enforcement/examples/enforce-entitlements-for-a-feature/
https://deploy-preview-7015--kongdeveloper.netlify.app/plugins/entitlement-enforcement/examples/enforce-by-header-with-custom-response/
https://deploy-preview-7015--kongdeveloper.netlify.app/gateway/otel-metrics/#kong-entitlement-enforcement-total

[netlify]

✅ Deploy Preview for kongdeveloper ready!

Name	Link
🔨 Latest commit	49e9e84
🔍 Latest deploy log	https://app.netlify.com/projects/kongdeveloper/deploys/6aa0455a8cae2d000884daa4
😎 Deploy Preview	https://deploy-preview-7015--kongdeveloper.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[lena-larionova]

link checker is failing because the linked pages are in a different PR.

[juliamrch]

Commenting because I approved too fast

[gergely-kurucz-konghq]

Thanks for this — the plugin page fills the gap our two how-tos were linking around, and I've now pointed both of them at it (see #6691).

One thing worth qualifying before this ships: credit-backed entitlements aren't implemented in Metering & Billing yet, but the page documents them as working behavior. I verified this in the OpenMeter service rather than inferring it:

• openmeter/entitlementaccess/entitlementaccess.go declares ReasonCodeNoCreditAvailable (no_credit_available), but nothing in openmeter/entitlementaccess/service/ ever assigns it. The only reason codes the service actually produces are usage_limit_reached, feature_unavailable, and feature_not_found.
• QueryInput.IncludeCredits is annotated "Not yet implemented", so the include_credits request field currently has no effect.

The affected spots on the plugin page:

Line	Text
8	description: "Checks feature access, usage limits, and credit balance against Metering & Billing before routing traffic"
65	"Has no available credit balance for a prepaid feature" in the list of when the plugin blocks
80-81	"usage or credit balance is within their entitlement" / "or credit is depleted, blocks the request"
104-107	NO_CREDIT_AVAILABLE / 402 row, "when it happens" describing depleted prepaid credit as a live case
174	"protects business logic, such as credit balances and plan limits"

The 402 default is genuinely in the plugin schema, so documenting the response code is correct — it's the framing as a reason a request will actually be denied today that overstates things. The description matters most, since it also feeds the plugin index and search.

Suggestion: keep the response-code table as is and add a short callout near it, or a "(Coming soon)" marker on the NO_CREDIT_AVAILABLE row. For reference, this is what we put in both how-tos after their response_codes bullet:

Credit-backed entitlements aren't supported by {{site.metering_and_billing}} yet, so the
NO_CREDIT_AVAILABLE reason and its 402 default don't occur in practice today. The other
reasons are enforced as described.

If the credit wording in the description is deliberate product positioning rather than a description of current behavior, ignore this — but then it's worth making the distinction explicit in the body text.

Second point: landing page card

The new card on app/_landing_pages/metering-and-billing.yaml points at the plugin page, which means a reader on /metering-and-billing/ reaches the how-tos in two hops. Could the CTA (or a second link in the description) point at
Get started with Entitlement Enforcement? The sibling cards on that page link guides directly, and /metering-and-billing/get-started/ is already linked from there, so the enforcement get-started guide is its natural peer.

Same card, minor: the description leads with "credit balance", which is the part that isn't implemented yet — "usage limit or feature access" would describe what the plugin enforces today.