Safe AI Adoption

A practical security blueprint for moving from experimentation to governed scale
Customer overview  ·  September 2026

Artificial intelligence is becoming a new interface to enterprise data, applications, and actions. Employees are adopting public AI tools, developers are embedding models into products, and agents are beginning to call business systems on a user's behalf. The opportunity is significant, but the security model must evolve with it.

Safe adoption does not mean blocking AI. It means giving people and teams an approved path to use it while preserving control over sensitive data, identities, models, and connected tools.

This paper focuses on three Cloudflare capabilities that together address the full lifecycle of AI risk: AI Gateway for governing and inspecting model traffic, MCP server portals for controlling agent tool access, and Secure Web Gateway for governing how employees interact with external AI services.

The goal: accelerate useful AI adoption while making access explicit, data use observable, and risk manageable.

Executive summary

AI introduces familiar security concerns in unfamiliar forms. Sensitive data can leave through a prompt. A model endpoint can be abused at machine speed. An agent can reach tools and data with more authority than intended. At the same time, blunt restrictions often push users toward unmanaged alternatives.

A durable AI security program should answer four questions:

  1. What AI is in use? Discover sanctioned and unsanctioned applications, model endpoints, and agent connections.
  2. Who can use it, and how? Apply identity, device, application, and least-privilege policies.
  3. What data can move through it? Inspect prompts and responses for sensitive content, risky intent, and credential exposure.
  4. How is it protected and operated? Detect AI-specific threats, control token usage and cost, and retain the telemetry needed to improve policy over time.
Risk area Example exposure Cloudflare control
Model traffic governance Uncontrolled provider access, token abuse, credential leakage in prompts or responses AI Gateway — guardrails, DLP, rate limiting, BYOK, spend limits
AI agent tool access Excessive agent authority, unmanaged MCP connections, no audit trail MCP server portals — identity policy, approved tool catalogs, request logging
Workforce AI use Shadow AI adoption, sensitive data submitted to public models Secure Web Gateway — application visibility, DLP, action-level controls

Why AI changes the control model

Traditional applications expose predefined inputs and deterministic workflows. AI systems accept natural language, interpret intent probabilistically, and increasingly decide which tools to call. This expands the attack surface in three ways.

Data becomes conversational. A user can disclose source code, credentials, customer records, or financial information in a prompt as easily as attaching a file. Responses can also contain sensitive or inappropriate content generated by the model itself.

Tokens are a shared resource that can be abused. Unlike traditional API calls, LLM requests consume tokens at variable rates. Without controls, a single application, automated pipeline, or malicious actor can exhaust provider quotas, drive significant unexpected cost, or degrade availability for legitimate users. Prompt stuffing — submitting unusually large inputs — can also be used as a vector to force model behavior or extract system prompt content.

Access can become action. Agents connect models to APIs, repositories, SaaS platforms, and internal systems via the Model Context Protocol (MCP). A compromised prompt or overprivileged tool can turn an incorrect model output into an unauthorized action against a real system.

The right response is defense in depth: inspect traffic at the model layer, enforce identity and least privilege at the tool layer, and apply policy at the workforce access layer — with shared telemetry across all three.

AI Gateway

AI Gateway is a proxy that sits between your applications and AI model providers. By routing model traffic through AI Gateway, organizations gain a consistent control point for observability, data protection, content moderation, access control, and cost management — across every provider and model in use.

Guardrails

Guardrails provide real-time content moderation on both the prompts your application sends to a model and the responses the model returns. Evaluation runs on Cloudflare's network using two purpose-built models: Llama Guard 3 8B for hazard category classification and Prompt Guard 2 86M for prompt injection detection.

Each of the following categories can be configured independently for prompts and responses, with actions of Block (prevent), Flag (log and allow), or Ignore (skip evaluation):

CodeCategoryRelevance to AI risk
S1Violent crimesHarmful content generation
S2Non-violent crimesFraud, theft facilitation
S3Sex-related crimesHarmful content generation
S4Child sexual exploitationRegulatory and legal exposure
S5DefamationLegal and reputational risk
S6Specialized adviceMedical, legal, financial liability
S7PrivacyPII and sensitive data in responses
S8Intellectual propertyUnlicensed content reproduction
S9Indiscriminate weaponsHarmful content generation
S10HatePolicy and reputational risk
S11Suicide and self-harmDuty of care obligations
S12Sexual contentInappropriate outputs
S13ElectionsMisinformation risk
P1Prompt injectionAttempts to override model instructions or extract hidden context

Best practices: Guardrails

Data Loss Prevention (DLP)

AI Gateway DLP scans prompts and model responses for sensitive data using Cloudflare DLP profiles. Because evaluation occurs at the gateway layer, it does not require TLS decryption or changes to the application beyond routing traffic through the gateway.

Each DLP policy specifies one or more profiles to match against, an action (Flag or Block), and whether to check requests (prompts), responses, or both. The following predefined profiles are available:

ProfileWhat it detects
Financial InformationCredit card numbers (Visa, Mastercard, Amex, Diners, UnionPay), IBAN, US ABA routing numbers — validated with Luhn's algorithm or arithmetic checksum
Personally Identifiable Information (PII)Full names, email addresses, US phone numbers, mailing addresses, SSNs, driver's license numbers, passport numbers — matches only when three or more unique identifiers appear in close proximity
Government IdentifiersInternational national ID numbers including US SSN, UK NIN, Singapore NRIC, Australia TFN, Canada SIN, and others — most validated algorithmically
Healthcare InformationFDA drug names, active ingredients, ICD-10 and ICD-11 diagnostic codes
Custom profilesUser-defined patterns, datasets, and document fingerprints via the Zero Trust DLP dashboard

Best practices: DLP policies

Token leakage and credential protection

Token leakage in AI contexts covers two related risks: the leakage of AI provider API keys and credentials, and the abuse of LLM tokens (the unit of model consumption) through excessive or malicious usage. AI Gateway addresses both.

Protecting API keys and provider credentials

Controlling token consumption and abuse

Observability and audit

AI Gateway logs every request and response, including prompts, model outputs, token counts, cost estimates, DLP action results, and guardrail evaluation outcomes. Logs can be filtered by DLP action, provider, model, and time range from the dashboard.

For long-term retention and SIEM integration, use Workers Logpush to export encrypted logs to external storage. This creates an auditable record of all AI interactions for incident investigation, compliance review, and policy tuning.

MCP server portals

Model Context Protocol (MCP) is the emerging standard for connecting AI agents to external tools and data sources. Without governance, agents can accumulate broad access to APIs, repositories, and internal systems. MCP server portals provide a controlled, identity-aware surface for exposing agent tools.

The agent access problem

An agent operating through MCP can call file systems, databases, SaaS platforms, and internal APIs. If tool access is unmanaged, a single compromised prompt or overprivileged agent session can reach systems far beyond the intended scope. The risk is compounded by the fact that agent actions are often difficult to observe after the fact if request-level logging is not in place.

How MCP server portals work

An MCP server portal aggregates selected MCP servers behind a single, identity-aware access point protected by Cloudflare Access. When an agent or user connects to the portal, they authenticate through your existing identity provider. The portal then presents only the tools, servers, and prompts that the authenticated identity is authorized to use.

Every tool request made through the portal is logged, creating an auditable record of what the agent called, when, and under which identity.

Best practices: MCP server portals

Secure Web Gateway

Cloudflare's Secure Web Gateway (Gateway) sits between employees and the internet, inspecting outbound traffic and applying policy. For AI, it provides the primary control point for governing how the workforce accesses external AI services — including sanctioned tools, shadow AI, and AI-adjacent risk like unsanitized file uploads.

Visibility into AI application use

Gateway classifies traffic to AI applications and surfaces usage patterns through the AI Security Report. Security teams can see which services employees are accessing, the volume of activity, and which users or groups are responsible — without needing to inspect content. This visibility is the prerequisite for any meaningful policy.

Application and action controls

Gateway supports granular controls beyond simple allow or block decisions. For many AI services, teams can govern specific in-app actions — for example, allowing employees to use a generative AI chat interface while blocking file uploads, document analysis, or the ability to share conversation history. This enables organizations to approve the productivity value of a tool while containing the data risk of its more sensitive features.

Best practices: Gateway AI policy

Connecting Gateway to AI Gateway

Gateway governs employee access to external AI services. AI Gateway governs the model calls that internal applications make. These are complementary — organizations typically need both. Gateway covers the human-initiated surface; AI Gateway covers the application-initiated surface. Telemetry from both flows into Cloudflare's unified analytics, making it possible to correlate workforce behavior with application-layer model traffic in a single investigation workflow.

Design principles for durable AI governance

  1. Enable a safe path first. Users adopt sanctioned tools when approved options are useful and accessible. Governance that starts with a block list without an approved alternative drives shadow adoption.
  2. Observe before enforcing. Flag-mode DLP and Guardrails policies reveal what is actually happening before enforcement disrupts legitimate work. Every control should spend time in observation before moving to block.
  3. Protect both directions. Inspect what users and applications send to models and what models return. Data loss happens in prompts; harmful or policy-violating content can also appear in responses.
  4. Keep agent authority narrower than capability. An agent should receive only the tools and permissions required for its current task. Treat MCP tool access as you would privileged API access — require justification, scope tightly, and log everything.
  5. Store credentials at the gateway, not in code. Provider API keys embedded in application code or environment variables are a persistent leak risk. Use AI Gateway's key storage to remove credentials from the application layer entirely.
  6. Unify telemetry. Investigation is faster when workforce, application, model, and agent activity can be correlated. Route logs from Gateway, AI Gateway, and Access to a common destination.
  7. Assume the environment will change. New AI services, model providers, agent tools, and jailbreak techniques emerge continuously. Review providers, models, tools, policies, and exceptions on a defined cadence — at minimum quarterly.

Conclusion

The central challenge of AI adoption is not choosing between innovation and control. It is designing a path where both reinforce each other.

AI Gateway, MCP server portals, and Secure Web Gateway each address a distinct layer of AI risk — model traffic, agent tools, and workforce access — and are more effective used together than in isolation. A unified telemetry stream across all three makes incidents faster to investigate and policy easier to improve.

Organizations can begin with discovery, establish approved paths, enforce controls according to risk, and improve continuously. The result is not simply safer AI. It is an operating model that allows AI to move from isolated experiments to trusted, enterprise-scale use.

Recommended next step

Run a focused AI security workshop to map one workforce use case, one AI-powered application, and one agent workflow. For each, document: data paths, identities involved, tools or providers called, current controls in place, and gaps. Use this as the input to a policy plan. This creates a practical starting point while establishing a repeatable pattern that can scale across the organization.

Further reading

Cloudflare AI Gateway AI Gateway Guardrails AI Gateway Data Loss Prevention Cloudflare DLP Cloudflare MCP server portals Secure MCP servers with Cloudflare Access Secure Web Gateway policies