Resources / Visual Guides
AI Gateway visual guides.
Ten short, swipeable explainers on governing AI traffic at the gateway — token budgets, guardrails, PII masking in streaming, multi-LLM routing, and agent governance. Each one is a five-slide read you can open in the browser and share with your team.
All guides
10 guides- 01Security5 slides
Where is your AI's boundary defined?
Telling your AI "only talk about banking" is a wish, not security. How the gateway enforces topic boundaries on every turn — with keyword pre-screens, semantic similarity, and model verification for the gray zone.
View guide - 02FinOps5 slides
Learning AI cost from the invoice is too late.
A budget is a gate, not a report. Pre-flight token reservation, four budget tiers from credential to project, and overflow actions that stop the overrun before it happens.
View guide - 03Architecture5 slides
AI isn't a separate product. It's a proxy type.
Why buying AI governance as a second platform means a second console, deploy, and on-call. AI as a first-class proxy type on the same gateway — same identity, same analytics, same runtime.
View guide - 04Routing5 slides
17 providers, one endpoint.
The client sees one endpoint; the gateway decides the model. Cost-, latency-, and header-based routing, circuit-breaker failover, and self-hosted vLLM/Ollama in the same pool.
View guide - 05Security5 slides
An AI guardrail isn't one filter: five signals.
Prompt injection, fabricated context, secret leakage, retry storms, and topic drift each need a different control. Five orthogonal signals, each with inline, async, and shadow modes.
View guide - 06Privacy5 slides
The silent trap of masking in AI streaming.
When an ID splits across two streaming chunks, naive masking passes both halves. Sliding-window masking keeps even a half token safe — without buffering the response.
View guide - 07Zero-Trust5 slides
Your apps should never see the provider key.
Real provider keys stay encrypted in the gateway; apps get virtual identities mapped per user, role, and project. Key rotation becomes a config change, not a deploy.
View guide - 08Security5 slides
A misconfigured AI semantic cache bypasses masking.
Semantic cache pays twice — zero tokens and sub-millisecond hits — but cache the pre-mask body and DLP never runs on a hit. Store the safe form, isolate the key, fail closed.
View guide - 09Observability5 slides
Can you replay an AI call as a DAG?
An AI request is a chain of failovers, tool calls, and streaming chunks — not one call. TTFT and TPOT broken out, plus spend-anomaly detection that catches runaway agent loops before the invoice.
View guide - 10Agent Governance5 slides
AI agents on both sides. Who governs the result?
MCP tools, A2A discovery, and bounded tool_use loops are half the story — every tool result re-enters the full policy chain too. PII masking, DLP, SSRF guards, and per-tool RBAC on what agents read, not just what they send.
View guide
Ready to govern every AI request?
See the AI Gateway on your own cluster.
Book a 30-minute session and we'll walk your team through token budgets, guardrails, routing, and agent governance — live.