Cloudflare Identity-Aware AI Gateway enters open beta with user-level controls

Cloudflare on Aug. 5 put its Cloudflare Identity-Aware AI Gateway integration into open beta, connecting its AI request gateway to Cloudflare Access so companies can attribute routed model requests to authenticated users. The practical change is user-level logs, access policies and spending controls for AI traffic that passes through a configured gateway, rather than attribution based on a shared API credential.

The feature requires an AI Gateway endpoint to sit behind an Access-protected custom domain. When a request arrives through that setup, AI Gateway writes the verified Access user ID into request metadata as cf.user_id, according to Cloudflare’s Aug. 5 changelog.

That configuration lets administrators filter logs and analytics by authenticated user, restrict who may call a gateway endpoint and apply spend limits by user without having a client application supply its own user ID. Cloudflare says a user who reaches a spend limit can have subsequent requests blocked or sent to a lower-cost model.

What does Cloudflare Identity-Aware AI Gateway cover?

It covers requests that organizations deliberately route through an AI Gateway endpoint configured with Cloudflare Access. It does not establish visibility into AI traffic that bypasses that gateway, so it should not be read as a system for identifying every employee interaction with external AI services or for discovering unsanctioned AI use across a company.

AI Gateway was already Cloudflare’s central layer for sending application requests to model providers. Cloudflare says the existing product supports request logging, caching, routing, rate limiting, safety controls and spending management across providers. Its product documentation says request logs can include prompts, responses, provider details, token use, cost and duration. The Access link adds verified requester identity to that existing operational data.

Cloudflare also made its User Insights feature generally available to AI Gateway customers at no additional cost. User Insights uses traffic already passing through the gateway to form behavior baselines for individual people and automated accounts, Cloudflare said. The company positions the feature as a way to distinguish routine high usage from sessions that merit investigation.

Its published anomaly logic evaluates sessions against an account’s own history rather than using one universal threshold. Cloudflare says an alert is triggered when a session exceeds both twice the user’s 30-day p95 session-cost baseline and an account-level p99 ceiling. That is a vendor-defined detection method, not an independent measure of misuse or compromise.

Cloudflare said identity-provider group controls, including group-based model access and budgets, are planned for the near future. Those capabilities are not part of the current open-beta Access integration. For security and platform teams, the immediate decision is architectural: whether enough model traffic runs through an Access-protected gateway to make user-level attribution and enforcement useful.

This story draws on original reporting from SiliconANGLE.