AI-generated: This article was created and published automatically by LinkLoot and was not substantively reviewed by a human editor.

Cloudflare adds identity-aware controls to AI Gateway for enterprise AI spend

Cloudflare launched Identity-Aware AI Gateway on August 5, 2026, adding verified user attribution to AI requests that pass through Cloudflare Access. The same release makes User Insights generally available to AI Gateway customers at no additional cost, turning existing gateway traffic into per-user spend and anomaly signals.

The change matters because shared AI API keys make cost control and incident response messy. Cloudflare is positioning AI Gateway as a control point for traffic from employees, internal agents, coding tools, and model providers including OpenAI, Anthropic, Google, and Workers AI.

Key takeaways

• Identity-Aware AI Gateway is now in open beta through a Cloudflare Access integration.
• AI Gateway can attach a verified Access user ID to request metadata as cf.user_id.
• User Insights is generally available to every AI Gateway customer at no additional cost.
• Admins can review user-level spend, model and provider use, cache behavior, and anomalous sessions.
• The feature does not remove the need to inspect policy design, logging choices, and sensitive-data handling before enforcement.

Cloudflare ties AI traffic to verified identity

Cloudflare says the Access integration lets teams put a custom domain in front of AI Gateway and protect it with the same identity policies they use for other internal applications. Once traffic reaches the gateway through that path, requests carry the authenticated Access identity instead of relying only on a shared key or a caller-supplied metadata field.

That changes the operating model for teams trying to let developers use multiple AI providers without losing oversight. Logs, analytics, routing, and spend controls can be filtered by the verified identity behind the request. Cloudflare says the approach can cover human users and automated systems, which is important as internal agents start making high-volume calls on behalf of teams.

User Insights watches cost spikes and agent behavior

User Insights adds a dashboard focused on usage patterns. Cloudflare’s changelog says it tracks organization-wide totals for cost, requests, tokens, and adoption, then lets admins drill into individual users to see spend, top models and providers, cache hit rate, and related signals.

The security angle is anomaly detection. Cloudflare says User Insights compares a session against the user’s own 30-day history, including a p95 session-cost baseline, and flags sessions that exceed both the individual baseline and an organization-level threshold. That can help distinguish a normal heavy user from a compromised credential, a runaway agent, or a workflow that suddenly sends far more context than usual.

The feature does not decide intent or automatically prove abuse. It surfaces accounts that deserve review, leaving teams to inspect logs, talk to the user, tune policies, or enforce spend limits.

Why this affects AI operations

Most AI cost tooling starts at the provider bill or the application layer. Cloudflare is pushing the control point closer to network and access infrastructure: one gateway, many providers, and identity-aware policy on top. That is useful for teams that have already standardized on Cloudflare Access or are trying to avoid every app inventing its own AI authentication layer.

The release also connects cost governance and security. Per-user budgets can reduce surprise invoices, while identity-backed logs make it easier to investigate accidental data leakage or abnormal model usage. SiliconANGLE’s coverage frames the launch as a way for IT and security teams to see which employee or automated system sent a prompt and to set individual or team limits.

Limits teams should check first

The strongest caveat is rollout state. Identity-Aware AI Gateway is in open beta, while User Insights is generally available. Teams should test logging behavior, Access policy coverage, custom-domain setup, provider routing, and data-retention settings before treating it as a production control plane.

Cloudflare also says future work includes task-based smart routing and prompt classification. Those are not the current shipped baseline. For now, the practical decision is whether AI Gateway should sit in front of model traffic and whether verified identity improves enough workflows to justify the migration.

Source check

• Cloudflare blog confirms Identity-Aware AI Gateway open beta, User Insights general availability, Access identity metadata, anomaly detection, and setup guidance.
• Cloudflare changelog confirms the August 5 User Insights entry, no-additional-cost availability, user-level metrics, and anomaly signal.
• Cloudflare press release summarizes the enterprise launch and named capabilities.
• SiliconANGLE independently corroborates the launch and enterprise security framing.