AI gateway

Typical features include logging, redaction of sensitive data, blocking of unapproved models, rate limiting, and prompt injection filtering. The category is also marketed as an LLM firewall or AI security gateway.

The reason the category exists is that AI traffic otherwise leaves no useful trace. A prompt is an HTTPS request to a vendor API, indistinguishable at the network layer from any other SaaS call, so without a chokepoint you cannot answer basic questions: which teams are using which models, what data is going out, what it costs, and whether anything sensitive has already left. A gateway creates the chokepoint, which is why the first value most organizations get from one is visibility rather than blocking.

It also gives policy somewhere to run. An acceptable use policy that says “do not paste customer data into unapproved tools” is a request until something enforces it. Redaction at the gateway, model allowlisting, and per-team quotas turn the same rules into controls, and they do it without asking every application team to implement them separately.

The limits are worth stating plainly, because vendors rarely do. A gateway only sees traffic routed through it, so it does nothing about shadow AI in a browser tab or an AI feature switched on inside a sanctioned SaaS product, which is where most unsanctioned usage actually lives. Injection filtering is pattern matching against an open-ended attack class and will miss things. Treat it as the control point for traffic you can route, paired with discovery for the traffic you cannot.