This site does not allow itself to be embedded. You can still read it on the original site — the toolbar below keeps your place in the directory.
Cloudflare AI Gateway now attaches a verified user identity to every request and learns a behavioral baseline per account, flagging 2x-p95 session spikes against an org-wide p99 ceiling. Here is how the anomaly math works and why per-account baselines beat global thresholds.
On August 5, Cloudflare shipped the missing attribution layer for AI traffic: [identity-aware AI Gateway with Cloudflare Access](https://blog.cloudflare.com/identity-aware-ai-gateway/), now in open beta, plus **User Insights**, a behavioral anomaly detection view that is generally available to every AI Gateway customer at no extra cost. The two combine to answer a question most AI cost and security tooling still cannot: which account spent this, and is that account behaving normally?
## What shipped, concretely
**Identity-aware AI Gateway.** Put a custom domain in front of your gateway and protect it with Cloudflare Access, and every request carries the authenticated user's identity. Concretely:
- Authenticate with any SAML-compatible identity provider (Okta, Entra, and similar), which removes the need to generate and hand out Cloudflare API keys.
- Every request gets the verified Access user ID attached as `cf.user_id`, so logs, analytics, and spend can be filtered by the actual person who made the call.
- Per-user spend limits become possible: each user gets their own budget bucket, and the gateway can block further requests or fall back to a cheaper model when a user's bucket empties.
- Group-based policy is next: map IdP groups to model access and spend caps, so a machine learning team gets frontier models while a support team gets a capped set.
**User Insights (GA).** The new tab reads traffic already flowing through the gateway, learns a behavioral baseline for every account, and surfaces the accounts that broke their own pattern. The methodology matters because it is per-account, not global:
- Sessions are scored against the account's own 30-day rolling baseline, using its p95 session cost.
- A session above 2x the account's p95 is a candidate for anomalous behavior, but only if it also clears an org-wide absolute ceiling set at the account p99, plus a dollar floor so a micro-user's few-cent blip never fires an alert.
- The baseline moves as habits change, and the reference numbers Cloudflare published from its own internal traffic: typical sessions cost under $10, the org p95 sits at $20, and the account p99 is $200.
The output is a "rogue behavior feed": the handful of accounts that departed from their own history, with normal activity filtered out. User Insights does not block anyone and does not judge intent. It puts anomalies in front of an admin, who decides whether it is a compromised credential, an agent off the rails, or a developer who pastes the whole codebase into every prompt.
## Why this matters to developers
The core problem this solves is attribution under shared keys, and the visibility gap it feeds is measured: Cloudflare cites the [Stanford AI Index Report 2026](https://hai.stanford.edu/assets/files/ai%5Findex%5Freport%5F2026.pdf) finding that 59% of organizations said knowledge gaps were their biggest obstacle to responsible AI governance. Cloudflare's own early adopter, Flexport, said it directly: shared API keys make it almost impossible to tell who is using an AI service or to apply the employee access rules the company already has. When every call carries a verified identity, the gateway stops being a routing box and becomes a control plane that can apply the same policy your SSO already does.
The second half is the detection insight: rogue behavior is rarely a new tool or a blocked action. It is a trusted account doing more of what it is already allowed to do, which means rule-based policy misses it by construction. A service account that suddenly runs expensive sessions, or an employee whose usage jumps 10x for days, trips no policy. A behavioral baseline is the only signal that catches the departure.
The per-account scoring is the right call and the reason the numbers are published: a $50 session is noise for a heavy user and a 10x spike for an agent that always spends $5. Absolute thresholds fail on both ends, which is why the design combines a personalized 2x-p95 trigger with an org-wide p99 ceiling and a dollar floor. That is a genuinely defensible anomaly design, and it is refreshing that Cloudflare published the math instead of a marketing claim.
Two honest limits: anomaly detection works on spend patterns today, not on what the traffic is doing (prompt classification is on the roadmap, along with task-based smart routing to cheaper models), and the identity layer is open beta. The spend and anomaly views work without Access, but without identity they are anonymous account IDs again.
## Where it fits the stack
This is the same move Vercel made with [team and project spend budgets](/blog/vercel-ai-gateway-spend-budgets-2026): the gateway platform is becoming the enforcement and attribution boundary for AI usage. Vercel's budgets AND-compose so the tightest cap wins; Cloudflare's per-user budgets attach the cap to a real identity. On a [self-hosted gateway](/blog/self-hosted-vs-managed-ai-gateway-decision-guide), you would be building the identity layer, the baselining, and the alerting yourself, which is a real project. For teams already running [spend guardrails](/blog/claude-spend-guardrails-playbook-ai-native-teams), identity-aware budgets are the mechanical stop under the organizational policy.
It also reinforces the argument that [agent identity is the missing security layer for AI workflows](/blog/agent-identity-security-layer-ai-workflows): here it is implemented at the gateway instead of in the agent, which has the advantage of covering every harness that routes through it, Claude Code, Codex, and Copilot included. And the announced task-based smart routing points at the same [model routing economics](/blog/model-routing-recipes-cut-ai-spend) we have covered before: once the gateway knows who is calling and why, routing every request to the cheapest sufficient model becomes an org-level lever rather than a per-app optimization.
## Continue Reading
- [Agent Identity Is the Missing Security Layer for AI Workflows](/blog/agent-identity-security-layer-ai-workflows) - why verified identity on every AI call is the foundation this feature sits on
- [Vercel AI Gateway Adds Team and Project Spend Budgets](/blog/vercel-ai-gateway-spend-budgets-2026) - the budget-composition math on the competing managed gateway
- [Claude Spend Guardrails: A Playbook for AI-Native Teams](/blog/claude-spend-guardrails-playbook-ai-native-teams) - the organizational layer above gateway enforcement
- [Self-Hosted vs Managed AI Gateways: A Decision Guide](/blog/self-hosted-vs-managed-ai-gateway-decision-guide) - what you rebuild yourself when you skip the managed layer
- [Model Routing Recipes to Cut AI Spend](/blog/model-routing-recipes-cut-ai-spend) - the routing patterns Cloudflare's smart routing is converging on
- [Microsoft MXC Developer Guide 2026: Sandbox Your AI Agents at the OS Level](/blog/microsoft-mxc-developer-guide-2026)
## Sources
- [Cloudflare Blog: Catching rogue AI behavior with identity-aware analytics](https://blog.cloudflare.com/identity-aware-ai-gateway/) (published August 5, 2026)
- [Cloudflare Docs: AI Gateway](https://developers.cloudflare.com/ai-gateway/)
- [Cloudflare Docs: AI Gateway Cloudflare Access integration](https://developers.cloudflare.com/ai-gateway/configuration/cloudflare-access/)
- [Cloudflare Docs: AI Gateway spend limits](https://developers.cloudflare.com/ai-gateway/features/spend-limits/)
- [Stanford AI Index Report 2026](https://hai.stanford.edu/assets/files/ai%5Findex%5Freport%5F2026.pdf) (cited by Cloudflare for the 59% knowledge-gap figure)Read on developersdigest.tech ↗
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.