Identity-aware AI Gateway: meter AI spend per person

Ask a small company what it spends on AI and you'll get a number. Ask who spent it and the room goes quiet, because everything runs through one shared API key. On August 5, Cloudflare shipped an identity-aware AI Gateway that attaches a verified user to every request leaving your network — and a companion feature that learns what each person's normal AI spend looks like and shouts when it isn't.

What actually happened

Per Cloudflare's announcement, the gateway now integrates with Cloudflare Access, so requests authenticate through your SAML identity provider — Okta, Entra, whatever you already run. Every request carries a verified cf.user_id. That kills the shared-key pattern and makes per-user spend limits and access policy possible in the first place. It's in open beta.

The second piece, User Insights, is generally available at no additional cost to every AI Gateway customer. It turns gateway traffic into a behavioral baseline per person and per agent, then flags sessions that break it. The threshold is specific and worth reading: a session gets flagged when it exceeds 2× that user's 95th-percentile spend over a rolling 30 days and breaches the account-wide 99th percentile. Two conditions, not one — so a heavy user having a heavy day doesn't page anyone. In Cloudflare's internal testing, only 1% of sessions ran past $200.

Spend limits are per-user budget buckets with a fallback to cheaper models rather than a hard stop. Cloudflare says task-based smart routing and prompt classification are in development; neither has shipped.

Why per-user AI spend attribution matters for your business

Most teams reach for a spend cap first. Wrong order. A cap on an unattributed key tells you the bill hit a ceiling; it doesn't tell you whether a developer ran a legitimate 400-file refactor or an agent got stuck in a retry loop at 3am. Those need opposite responses and look identical on an invoice.

Identity first, then budgets, then anomaly detection. That sequence is the actual product here, and you can build it on any gateway — LiteLLM, Portkey, your own proxy — as long as you refuse the shared key. The two-condition threshold is the detail to copy: single-signal alerting on AI spend produces noise until people mute it, which is worse than no alerting.

The caution is scope. This only sees traffic that goes through the gateway. Someone's personal ChatGPT tab, a vendor SaaS with AI bolted on, an agent calling a provider directly from a laptop — all invisible. Routing everything through one egress point is the work; the dashboard is the easy part. And "open beta" on the identity piece means don't make it the only thing standing between an agent and your model budget this quarter.

Sources: Cloudflare Blog, SiliconANGLE.