PATTERN Cited by 1 source

Identity-propagating AI gateway¶

Pattern¶

Place enterprise authentication immediately in front of a central AI gateway, then attach the authenticated principal as verified gateway-controlled metadata to every upstream inference request. The gateway becomes the shared join point for authorization, model-access policy, spend attribution, rate limits, logs, behavioral analytics, and later incident investigation. Clients do not carry shared upstream API keys or self-assert the user identity used for governance.

Structure¶

user or agent
  → enterprise identity provider
  → access proxy authenticates and authorizes
  → AI gateway adds verified subject metadata
  → provider routing, metering, logging, budgets, analytics

The identity that authorizes the client and the identity that appears in telemetry must be the same verified subject or a documented, auditable mapping. Otherwise a gateway may centralize traffic but still attribute a runaway action only to a shared API key.

Cloudflare realization¶

Cloudflare places Cloudflare Access in front of a custom AI Gateway hostname. Access authenticates with a SAML-supported identity provider; the gateway adds the verified Access user ID as cf.user_id metadata. That metadata supports per-user spend limits, request filtering, cost attribution, and User Insights behavioral baselines. (Source: sources/2026-08-05-cloudflare-catching-rogue-ai-behavior-with-identity-aware-analytics)

When to apply¶

Multiple humans, agents, or coding tools otherwise share provider credentials.
Model access and spend limits must follow a person or workload across tools and providers.
Operational analytics need to distinguish a compromised account or looping agent from high-volume but legitimate work.
An organisation wants a single governance boundary without distributing upstream secrets to every client.

Guardrails and trade-offs¶

Trust the identity only if the gateway receives it from the authenticated access layer; accepting caller-supplied user_id metadata makes attribution spoofable.
Pseudonymous internal IDs reduce exposure in downstream logs but require a controlled lookup path during investigations.
Identity propagation enables policy; it does not define the policy. Pair it with scope checks, budget rules, retention controls, and a response process.
The proxy becomes a critical dependency and privacy boundary. It must be reliable enough for the traffic it gates and protect the expanded identity-bearing telemetry.

Seen in¶

sources/2026-08-05-cloudflare-catching-rogue-ai-behavior-with-identity-aware-analytics — Cloudflare Access → AI Gateway cf.user_id propagation for per-user policy, spend, logs, and anomaly analysis.