Cloudflare Identity-Aware AI Gateway: Every AI Request Now Tied to a Real Employee

This replaces blind, shared API keys that made it impossible to attribute requests to specific people or systems . IT teams now know exactly who prompted which model, at what time, and from which device.

Visibility and cost control

Once identities are attached, the gateway unlocks granular cost management:

• Per-user spend limits — IT teams can set spending caps at the individual or team level, not just account-wide .
• User Insights — A companion feature that learns normal AI usage patterns per user or automated system, then alerts when activity or spending deviates from that baseline .
• Log and analytics filtering by user — Requests can be filtered, audited, and analyzed by authenticated identity in logs and analytics dashboards .
• Real-time flagging — The system can detect when employees use expensive models for simple tasks that cheaper alternatives could handle .
• Cost-saving features — Repeat requests can be cached to cut redundant costs; rate limits stop runaway usage before it hits the invoice .

Companion security and governance features

Identity alone isn't enough — enterprises also need guardrails:

• Data Loss Prevention (DLP) — Automatic filters strip employee names, passwords, and other sensitive data out of requests before they reach external AI providers .
• Guardrails — Content filtering and policy enforcement at the gateway layer for both input prompts and model responses .
• Rate limiting — Per-user or per-gateway request throttling to prevent abuse .
• Dynamic routing — A beta feature that allows requests to be routed to different models based on policy .

Future and related capabilities

Cloudflare is extending identity-aware controls to autonomous agents:

• Cloudflare Wallets & cloudflare.pay — Announced August 4, 2026, these give AI agents a stable identity and the ability to make purchases within limits set by their human creators .
• Code Mode — Launched during Agents Week (July 2026), designed to slash token costs for coding agents .
• Shadow MCP detection — Cloudflare Gateway rules to detect unauthorized Model Context Protocol servers .

The service is available now in open beta. As Dane Knecht, Cloudflare's CTO, summarized: "Teams get the freedom to work with any AI model they choose. IT gets the real-time visibility, guardrails, and budget controls they actually need" .