AI gateway and AI security gateway: why not merge two commitments along the same chain road into one component

Let's get this article clear. These two types of products are almost identical on the PPT: they are inserted between applications and models, they are painted in the same position, and they all claim to be "unified access". So the most common mistake was not the wrong product.Consider the two commitments as one, thinking that there would be two.

They do run along the same chain. But the promise is completely different: a promise.Request for efficient arrival.A promise.Content and action can be judged, blocked and tracedI don't know. The first one is "slow, expensive, wrong" and the second one is "one shouldn't be let go" – and the second one, your surveillance usually doesn't call the police.

Not by functional list, pressThree structural conflictsCome on. I didn't make it up. I wrote it in the official files of two manufacturers.

One or four words, separate first.

The term "noun" in this line is already inflation to the point where it cannot be used directly. The API gateway, the LLM gateway, the AI gateway, and the AI security gateway often appear in the same program, and the author of the program does not always distinguish between himself.

Name	Targets of governance	Typical capabilities	It "sees" what?
API Gateway	Press Peer	Rights, restricted flow, TLS termination, load balance, forwarding	/ordersI don't know./users
LLM Gateway	By supplier and model	Model route, key hosting, token metrology, current format conversion	model Fields and messages Array
AI Gateway	By Session and Action	All above +agent workflow, MCP, tool call, cost aggregation	Who lets who do what?
AI security gateway	As determined	Injection of detection, content classification, movement authorization, forensic marks.	Should we let go?

The most critical column in this table is the last one.The first three lines read "What's the request look like" and the fourth line read "should it be allowed."The former is a question of transmission and the latter is a question of judgement. Retransmittances can be 99.99% available, not judged -- because the judgement itself is subject to error.

There's a line in that comparison: the real difference isn't who's right, but...They were designed to understand what flow.I don't know. Traditional API flows are end-line, LLM flows are model and token, and agentic flows are "one user request to trigger multiple model calls, MCP tool calls, internal API calls, retrieval and business actions". The lower the hierarchy, the more things you can see, the greater the responsibility.

II. CONFLICT I: Cache will bypass judgement

It's the one I think is most worth writing about because it's...StructureIt's not the realization of the flaws.

The AI Gateway DLP document for Cloudflare contains an original phrase, short:

Cache hits skip DLP scanning.

And there's one more thing that matters:If you update the DLP strategy after responding to the cache, the cache will not be reassessed.It'll continue to be sent out until TTL expires.

Why? Because it's not hard to understand:The whole value of the cache is "no more count."If the decision is to run again each time, the cache will be stored without acceleration. So on the project, "Cache = passed" is a necessary default assumption.

This assumption is fully valid in performance terms, with a hole in security terms:The strategy will change.You added a rule today, and yesterday's response to the cache was unaffected. The security team called this "tactical change didn't take effect" and the gateway team called it "cacheline normal work".Both are true, depending on who you're asking.

Claudflare's treatment is relatively honest: the Flag's response goes down the cache and the Block's response goes down. But at the same time, it acknowledges the re-evaluation gap of the renewed strategy. To close this gap, only to shorten TTL, which directly weakens the value of the cache.It's a natural contradiction. There's no two configurations.

III. CONFLICT II: Flow style and determination cannot be satisfied at the same time

The second conflict is more intuitive and is directly reflected in perceived delays.

The DLP document of Cloudflare is clearly written: a side scan of the response was opened, and when the SSE flow request was met, the SSE was sent to the SSE.The gateway will buffer, sweep and release the entire response to the client again., the time-to-first-tokeen will grow longer.

This is the price of the buffer.If you are to decide on an entire paragraph, you must first have it.And the whole point of the flow is not to wait a whole paragraph. The two conflict physically.

The document gives us two ways out. I think the second is the truth:

1. Only requests.(Check set as Request), no buffer scan on the side of the response - no buffer on the side of the request, no impact on the delay.
2. Disable two gateways: Delay one sensitive flow and one traffic subject to review.

Article 2 recognizes one thing:"Quick" and "Courtable" are supposed to be part of the structure.Plugging into the same component must ultimately be a concession from one side — either the user waits or the review skips.

By the way, there's a detail that a lot of people haven't noticed.Gateway Level, without a per-request switch you can choose a different DLP profile and cannot bypass a single request. The document suggests multiple gateways by use. This is a further illustration of the problem with the "one gateway handles everything" model itself.

IV. CONFLICT THREE: Which side to fall when it fails

The third conflict is the easiest and least discussed:When the component is hung, the default is release or rejection.

The engineering tradition of the gateway is fail open. The reason for this is true: the gateway is a jump in the middle of the chain, and it's out of business, and most of the time it's "cut off" more than "check one layer less." The traditional safety product, in turn, was fail closed: if you can't check, leave it out.

The two traditions collided, and the result was usually whose code was in the chain.

The OWASP LLM Top 10 (2026) map is one of the most honest things I've ever seen: It singles out each default and states that "almost every control is closed before your configuration".

OWASP Item	Default Status
LLM01 Tip Injection	Off.
LLM02 Sensitive Information Disclosure	Off, except for Key Hash.
LLM03 Excess Agent	Open until(No list defined = can reach all MCP server)
LLM04 Supply Chain	On
LLM06 Unlimited Consumption	Off
LLM08 Hide Context Exposure	Off
LLM10 output not properly processed	Off

There's a line in this table that I have to carry alone because its consequences are more serious than the default level:

"MCP will return to the global list and key submitted its own server, and A2A will return unlimited access when access to the database fails.

Turn it over:The security component is dead and should have been rejected.In 2026, three risk items were moved forward. The document does not hide this, and is accompanied by the PR number to be processed - this transparency is positive, but it also indicates that it is now.

This is a direct message to the structure:If the safety determination and flow transfer are the same process and the same area of failure, then the availability requirement for the transfer would contaminate the severity of the determination.The cleanest way to figure out not to follow forward is to keep it in another field of failure.

V. The root causes of conflict: two SLAs that cannot be met simultaneously

By looking at the three above together, they are not three isolated bugs, but three appearances of the same contradiction.

Dimensions	AI Gateway	AI security gateway
Optimization of objectives	Spam, delay, cost	Determination accuracy rate, traceability
Acceptable delay	As soon as possible, p. 99 is the core indicator.	A single determination of tens of milliseconds is acceptable.
Failed direction	Predispension (feasibility)	Predisposition to refuse (correction)
Change of strategy	After configuration, it's ready for gradual implementation.	Immediate, global entry into force
Cache	Core competencies	It'll bypass the verdict.
Fluid	Must support	Conflict with entire paragraph
Acceptance	Pressure, hit rate, bill.	Go through tests, kill rates, forensic integrity.

Watch out for the "change of strategy" line. This is where I think it is best to distinguish between two types of products:The gateway's strategy is configuration, and the safety gateway's strategy is commitment.The configuration is wrong to roll back, and the commitment lapses. So the former can accept "effective in a few minutes" and the latter cannot.

When one requires both "as soon as possible" and "not once" it is not a requirement that a component can meet simultaneously.

VI. HOW TO DISTRIBUTE THE BUSINESS: THOUGHT TO "BORDERS WRONG"

I do not recommend a division of labour along functional lists, which always overlap. To be clear by one question:Did this control fail, did it slow down, or did it leave out the wrong one?

The former stays in the AI gateway, the latter takes out and does it alone. Other Organiser

Control Item	Stay at AI Gateway	Should be removed to the safety gateway.
Model route / downgrade	Zip.	I don't know.
Response Cache	Zip.	Need to support strategic proactive failure
Token Metric/ Budget	Zip.	I don't know.
Multi-tenant strategy isolation	I don't know.	I can't do that.
Injection / Breakout Decision	Hang up. Don't be the main line.	• Independent adjudication level
Tools and MCP Authorizations	I don't know.	✓ Default full-scale changes
PII De-sensitization and Reduction	One-way cover.	Reversible + auditable
Evidence and traceability	The log is enough.	✓ Prejudication + content-free storage

Three places worth developing.

• The multi-tenant strategy is isolated.Claudflare’s DLP strategy is gateway level, with only multiple gateways to separate tenants. If your business is multi-tenant SaaS, this will determine the shape of the structure directly.
• Reversibility.The traditional DLP is "detection-blocking" and the AI scenario often requires "detect-de-sensitization-restoration": erase the PII from the station and restore the user's own data when the response comes back. It can't be one-way cover.
• No evidence.The storage of the original prompt for the purpose of evidence is tantamount to creating a compliance mined area. Metadata + Hashi, who is examined, meets the audit without creating new data assets — a watershed in the security gateway and the ordinary gateway log, I think.

If only one thing

The status of many of the teams is: the AI gateway is on, and the security gateway is in the budget. The risk in this state is not "no safety net," but...I thought I did.I don't know.

So if there's only one thing to do, I suggest this:Turn all defaults first.

The reason is straightforward: those Offs up there, they're not wrong.Out of the factory is Off.I don't know. Your gateway runs through production, and the flow is real, but most controls have never been opened. This matter does not require procurement, no new budget, no structured review, only half a day and a list.

1. Lists all guardrail/ policy items on your gateway and their current switch status.
2. The article-by-article impact of the "Default Level" will be opened at least three times: LLM01 (injection), LLM03 (tool authorization), LLM02 (dissensitization).
3. Check failed orientation: Simulate a permission query failed to see whether it was released or rejected. This article is the most easily ignored and deadly.
4. Confirm the relationship between the cache and the strategy change: the strategy changed, and how long the old cache failed. Write that figure into the change process.
5. Confirms the response side-scanning treatment of currents: if it is open, what is the user perceived TTF; if it is off, the output side determination is abandoned.

After these five, you'll get a more accurate conclusion than any comparative table:What you have now is a gateway or a safety gateway.

Final: Why can't the two commitments be merged

Go back to the one in the title — two undertakings on the same chain.

I don't want to stress "they're different," but..."They're different, and they're not structural. They don't disappear as the product matures."I don't know.

Cache necessarily bypasses determination, since the definition of Cache is no longer calculated. Fluids necessarily conflict with the entire determination, which presupposes full content. Forwarding necessarily tends to be liberal, as its function is to preserve usability.None of these three are questions of project level, all of which are differences in target functions.

So the right thing to do is not to find a product that's good for both.Recognize that this is two layers and then place them in different areas of failure, each optimizing their respective objectives.It is connected by a clear interface: the gateway is "for delivery" and the security gateway is "forbidden".

And that's why I don't really believe in "integrated AI safety gateways." An integrated product does exist and it does work, but when it both claims to be high-intensity and zero-failure, it usually meansOne of them was created under certain conditions.- And that condition is not always written in the comparative table.

It's two things. Put them in the same component, and sooner or later there's a concession.