Executive Summary
As enterprises navigate the rapid proliferation of AI tools — from employees using consumer-facing LLMs to development teams deploying internal AI-powered applications — two distinct security and governance challenges have emerged:
Challenge 1: Access Control
Controlling which AI services employees can access from corporate devices and networks — the shadow AI problem.
Solved by: Cloudflare Gateway (SWG)
Challenge 2: Usage Governance
Controlling how AI services are consumed by the applications your organization builds — the API governance problem.
Solved by: Cloudflare AI Gateway
Understanding the differences, the overlaps, and the integration story between these two products is essential for any enterprise architecting a defensible, auditable AI adoption posture. This whitepaper provides a technical comparison of both products and guidance on deploying them as complementary layers of defense.
Key Takeaways
- SWG controls access; AI Gateway controls usage. Both are necessary for a complete enterprise AI governance posture.
- DLP is the shared thread. The same detection profiles govern both employee uploads to AI web interfaces and AI API calls — with shared maintenance overhead.
- AI Gateway's semantic logging is categorically different from network logs. It captures the full content of AI interactions — essential for compliance audit evidence.
- Guardrails fills a gap SWG cannot fill. Network-layer inspection cannot evaluate whether an AI model's response contains harmful content.
- Dynamic Routing moves model governance from code to configuration, putting budget caps and fallback logic in the security control plane — not in application code.
The AI Governance Problem
The enterprise AI threat surface has expanded on two simultaneous fronts — and most organizations are only equipped to address one of them.
Shadow AI at the Network Edge
Employees are accessing consumer AI tools — ChatGPT, Claude, Gemini — from corporate devices, often pasting sensitive internal data into prompts with no oversight. Traditional firewalls can block domains, but they cannot distinguish between safe and unsafe use of a permitted AI service, and they have no visibility into what data is being submitted.
Uncontrolled AI API Consumption
Development teams are integrating LLM APIs directly into internal applications, often without enterprise-grade logging, DLP, or spend controls. A runaway AI agent loop can generate thousands of dollars in API charges in minutes. A single misconfigured system prompt can expose sensitive customer data through model responses.
The core problem: A firewall can tell you that HTTPS traffic was allowed to api.openai.com. What it cannot tell you is that a member of the Finance team submitted a prompt containing a Social Security Number at 2:47 PM and received a response containing a draft regulatory filing. That distinction is the difference between access logging and audit evidence.
Cloudflare Gateway — Secure Web Gateway
Cloudflare Gateway is Cloudflare's enterprise Secure Web Gateway, delivered as part of the Cloudflare One SASE platform. It sits between users and the internet, inspecting and filtering all outbound traffic — regardless of where the user is physically located. In the context of AI safety, Gateway answers the question: Should this employee or device be allowed to reach this AI service at all?
Architecture and Traffic Layers
Gateway enforces policy at three distinct network layers, each providing progressively deeper inspection:
| Policy Layer | OSI Layer | What It Inspects | AI Safety Relevance |
|---|---|---|---|
| DNS DNS Policies | L3–4 | Domain name resolution | Block entire AI service domains at resolution time — zero data exchanged |
| NET Network Policies | L4 | IP addresses, ports, SNI headers | Block non-HTTP AI services, restrict by destination IP range |
| HTTP HTTP Policies | L7 | Full URLs, headers, request/response bodies | Granular application-level control, DLP scanning on uploads/downloads |
On-Ramp Methods
Traffic reaches Gateway through four deployment options, commonly combined:
Cloudflare One Client
Device-installed agent (WARP). Enables all three policy layers. Best for roaming employees on managed laptops and phones.
DNS Resolver
Lightweight DNS-only option requiring no agent. Ideal for network-wide or BYOD deployments with minimal friction.
Proxy Endpoint (PAC)
Browser-level HTTP filtering without a device agent. Suitable for managed browser environments.
Network Tunnel (Magic WAN)
Routes all site traffic via IPsec/GRE tunnel. Covers entire branch offices or data centers.
Core Capabilities for AI Governance
Application-Level AI Service Control
Gateway's HTTP policy engine includes a curated Application Library with major AI services as named applications — ChatGPT, Google Gemini, Microsoft Copilot, and more — continuously updated by Cloudflare. Security teams write policies targeting specific applications without enumerating URLs or IP ranges.
Application Granular Controls extend this to sub-application actions:
- Allow users to read ChatGPT responses but block file uploads
- Block only the Upload operation in specific AI applications
- Allow corporate Microsoft Copilot while blocking personal/consumer AI accounts
Shadow IT Discovery
Gateway's Shadow IT Discovery surfaces AI applications employees are using that IT has not reviewed or sanctioned. Administrators review discovered applications and mark them Approved, Blocked, or Under Review. HTTP policies can then filter by Application Approval Status — blocking all unapproved applications with a single rule.
Identity and Device Context in Every Policy
Every Gateway policy — at any layer — can incorporate identity and device posture signals:
- Email address
- Group membership
- SAML attributes
- OS version
- Disk encryption status
- EDR (CrowdStrike) check
- Managed device serial number
Allow access to the internal AI coding assistant ONLY IF the user is in the Engineering group AND the device has disk encryption enabled AND passes a CrowdStrike posture check.
MCP Traffic Detection (Beta)
An emerging capability: the Is MCP selector detects traffic matching the Model Context Protocol (MCP) pattern — the emerging standard for AI agent-to-tool communication. Organizations can write explicit policies around agentic AI traffic:
Block MCP traffic that does NOT arrive via an approved MCP portal
Advanced Security Actions
Browser Isolation
Risky AI websites rendered in Cloudflare's cloud. User sees the page; nothing executes locally.
File Sandboxing
Suspicious file downloads quarantined and submitted to sandbox for behavioral analysis.
AV Scanning
Inspects downloads and uploads for malicious code with per-file-type granularity.
Egress Control
Assign fixed org-owned IPs to outbound traffic; partner AI APIs can reliably allowlist corporate traffic.
Data Loss Prevention in the SWG Context
Cloudflare One DLP integrates directly with Gateway HTTP policies, operating on traffic in transit through the SWG proxy.
DLP scans HTTP request and response bodies — file uploads, form submissions, chat message payloads, and API calls. Matched payloads can be encrypted and retained for audit, or exported via Logpush to a SIEM. Supported file scanning includes text, CSV, Microsoft Office 2007+, PDF, ZIP archives (up to 10 levels deep), with OCR available for image content within documents.
[Application = ChatGPT] AND [Upload Mime Type = *] AND [DLP Profile = "PCI-DSS Financial Data"] → Block + Log Payload
Cloudflare AI Gateway
Cloudflare AI Gateway is a purpose-built AI API proxy and observability platform. Where SWG controls whether users can reach AI services, AI Gateway controls how your organization's applications use AI services. It answers the question: How do we observe, control, and protect the AI API calls our applications make?
Architecture
AI Gateway acts as a reverse proxy between your application code and AI model provider APIs. Integration requires changing a single line of code — the base URL of your AI provider SDK — to route through an AI Gateway endpoint.
Supported Providers (24+)
// Before: direct provider API
const client = new OpenAI({
baseURL: "https://api.openai.com/v1"
});
// After: routed through AI Gateway
const client = new OpenAI({
baseURL: "https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_name}/openai"
});Core Capabilities
Semantic Prompt & Response Logging
AI Gateway captures the full semantic content of every AI interaction — not just metadata. This is categorically different from SWG logs:
Rate Limiting and Budget Controls
AI Gateway supports two rate limiting techniques to prevent runaway agent loops and uncontrolled spending:
Fixed Window
Maximum N requests in a fixed calendar window (e.g., 100 requests per 10-minute block from 12:00–12:10)
Sliding Window
Maximum N requests in any rolling time window (e.g., no more than 100 requests in the last 10 minutes at any point)
When limits are exceeded, AI Gateway returns HTTP 429. This prevents individual users or services from monopolizing shared AI budget.
Dynamic Routing — Intelligent Model Orchestration
Dynamic Routing enables organizations to define complex AI request routing flows through a visual node-based editor — without modifying application code.
Branch by metadata
Call provider/model
Enforce cost cap
Return response
user_plan metadataResponse Caching
AI Gateway caches model responses for identical requests, served from Cloudflare's global cache. Cache TTL is configurable from 60 seconds to 1 month. Custom cache keys allow grouping of semantically equivalent requests.
Bring Your Own Keys (BYOK)
Store provider API keys centrally in Cloudflare's infrastructure. Applications use gateway tokens — not raw provider credentials. This centralizes credential management, eliminates secret sprawl, and enables credential rotation without application redeployment.
Guardrails and AI-Native DLP
DLP — AI-Native Data Detection
AI Gateway can scan prompts and responses against Cloudflare One DLP detection profiles — natively, without TLS decryption. All plans include two predefined profiles (Financial Information and Social/National Identifier Numbers) at no extra cost. The full profile set — including all predefined profiles, custom profiles, integration profiles, DLP datasets, and OCR — requires a Zero Trust DLP subscription.
- Scans both incoming user prompts and outgoing model responses
- Actions: FLAG (log, allow) or BLOCK (reject with HTTP 400)
- Scans tool call arguments and results in JSON payloads
- DLP on streaming responses buffers the complete response before scanning
Guardrails — AI Content Safety
A separate safety layer that evaluates prompts and responses using llama-guard-3-8b on Workers AI. Available on all plans — billed as standard Workers AI token inference, so cost scales with the length of prompts and responses being evaluated.
- Intercepts user prompts before they reach the model
- Intercepts model responses before they reach the user
- Evaluates against predefined safety categories (violence, hate speech, sexual content)
- Configurable per category: Flag or Block
- Works consistently across all 24+ supported providers
Side-by-Side Technical Comparison
Use this table to map security requirements to the appropriate product — or identify where both are needed.
| Dimension |
SWG
Cloudflare Gateway
|
AI GW
AI Gateway
|
|---|---|---|
| Positioning | ||
| Primary Purpose | Control user access to AI services at the network layer | Observe and govern application API calls to AI providers |
| Primary Operator | IT Security / Network Operations | Application Developers / Platform Engineering / ML Teams |
| Key Question Answered | "Can this employee reach this AI service?" | "How is our app using AI — and what data is crossing the boundary?" |
| Deployment | ||
| Deployment Method | Agent (WARP), DNS resolver, PAC file, or network tunnel | One-line SDK URL change — no agent, no certificate |
| TLS Decryption Required | Required for HTTP policies/DLP | Not required — natively in API path |
| Pricing Tier | Zero Trust plans (DLP, sandboxing, isolation are Enterprise add-ons) |
All plans including Free — core features free Workers Free: 100K logs total; Workers Paid: 10M logs/gateway Guardrails: available on all plans, billed as Workers AI inference DLP: 2 predefined profiles free; full profiles require Zero Trust DLP subscription Logpush: Workers Paid only (10M req/month, +$0.05/million) |
| Traffic Coverage | ||
| Traffic Type | All user internet traffic (DNS, TCP/UDP, HTTP/HTTPS) | API traffic from your applications to LLM providers |
| AI Specificity | General-purpose SWG with named AI app controls + MCP detection (beta) | Purpose-built for LLM API traffic governance |
| Multi-Provider Support | Agnostic (blocks/allows by domain or application name) | Native integration with 24+ named AI providers |
| Data Loss Prevention | ||
| DLP Capability | Enterprise add-on; scans HTTP traffic in transit | 2 predefined profiles free on all plans; full profile set requires Zero Trust DLP subscription; scans AI prompt and response text natively |
| DLP Detection Profiles | Shared Cloudflare One DLP profiles | Same shared Cloudflare One DLP profiles |
| DLP Actions | Block, Allow, Log payload | FLAG (log, allow) or BLOCK (HTTP 400) |
| Security Controls | ||
| Identity Context | Rich: IdP groups, SAML attributes, email, device posture | Custom metadata per request (userId, orgId, plan) + gateway auth tokens |
| Content Safety (Guardrails) | Not available — network layer only | Harmful content category detection on prompts AND responses |
| MCP / Agentic AI | Is MCP selector (beta) for network-level policy |
Dynamic Routing covers multi-step agentic flows |
| Observability | ||
| Logging Depth | Network metadata: URL, IP, user, device, category, DLP match indicator | Semantic payload: full prompt text, response text, tokens, cost, model, DLP fields |
| Analytics | Traffic volume, blocked counts, top domains/categories | Request volume, token consumption, cost tracking, error rates, cache hit rates |
| Log Export | Logpush to SIEM/data lake | Logpush on Workers Paid only (10M req/month, +$0.05/million); GraphQL API on all plans |
| Operational Controls | ||
| Rate Limiting | Via network/HTTP policies | Fixed or sliding window, per gateway; HTTP 429 on limit |
| Model Routing / Fallback | Not available | Dynamic Routing: conditional, A/B, budget, failover |
| Response Caching | Not applicable | LLM response caching with configurable TTL and custom cache keys |
| Credential Management | N/A | BYOK: store provider keys centrally; apps use gateway tokens |
Use Case Mapping
Layered Defense Architecture
The most robust enterprise AI governance posture deploys both products as complementary layers — not as either/or alternatives.
The shared DLP thread: Create a profile for HIPAA PHI, GDPR personal data, or internal trade secrets — and it enforces consistently whether a user is pasting data into a web-based AI interface (caught by SWG) or an internal application is submitting it via API (caught by AI Gateway). Define once, enforce everywhere.
Deployment Guidance
Deployment complexity is intentionally asymmetric — reflecting different operational ownership and organizational readiness stages.
Start with AI Gateway
Day 1 — Free (with add-on options)Development teams can route AI API calls through an AI Gateway endpoint with a single line change. Core features — analytics, caching, and rate limiting — are free on all plans. Log storage limits and DLP profile access vary by plan.
- Create an AI Gateway in the Cloudflare dashboard (free on all plans)
- Change the base URL in your AI SDK to the gateway endpoint
- Review logs: prompts, responses, token usage, costs (Workers Free: 100K logs total; Workers Paid: 10M logs per gateway)
- Add DLP profiles for PII/PHI/financial data — flag mode first (2 profiles free; full set requires Zero Trust DLP subscription)
- Enable Guardrails on content categories — flag → block as confidence grows (billed as Workers AI inference)
- Configure rate limits to prevent runaway loops
Add Gateway (SWG)
Weeks 2–4 — Zero TrustExtend control to the network perimeter. Deploy Cloudflare One Client on managed endpoints and configure DNS and HTTP policies to govern employee AI tool access.
- Deploy Cloudflare One Client (WARP) to managed devices
- Install Cloudflare root certificate for TLS inspection
- Enable Shadow IT Discovery — audit 30 days of AI app usage
- Set Application Approval Status for discovered AI tools
- Deploy initial HTTP policy: Allow approved apps, block unapproved
- Add DLP profile scanning on uploads (same profiles as AI Gateway)
- Add identity + device posture conditions to AI access policies
Harden and Integrate
OngoingConnect both products to your existing security stack for unified visibility and response.
- Configure Logpush from both Gateway and AI Gateway to your SIEM
- Create correlation rules: SWG block + AI Gateway DLP match on same user
- Enable Browser Isolation for high-risk AI tools
- Configure Dynamic Routing for model fallback and budget enforcement
- Evaluate MCP traffic policies as agentic AI adoption increases
- Review DLP profile coverage against regulatory obligations (HIPAA, PCI, GDPR)
Conclusion
"SWG controls access. AI Gateway controls usage. Both are necessary for a complete enterprise AI governance posture."
Enterprises face two distinct AI threat surfaces that require two distinct — but complementary — security controls.
Cloudflare Gateway extends your existing Zero Trust network security posture to the AI threat surface. It treats AI services as a new category of web application requiring the same controls — user identity, device health, DLP, content filtering — you apply to SaaS and cloud infrastructure today. It is the organizational access boundary.
Cloudflare AI Gateway addresses a capability gap that traditional network security tools cannot fill: the semantic content of AI API interactions. The full audit trail of what was asked, what model answered, and what data crossed the boundary. It is the organizational usage boundary.
Together, they share a DLP control plane, a unified logging pipeline, and a common management dashboard — reducing the operational burden of maintaining two parallel security rule sets and enabling correlated detection across both access and usage events.
Ready to build your AI governance program?
Cloudflare's team of security architects can help you assess your AI adoption posture, map your use cases to the right products, and design a phased deployment plan.