Why enterprise AI control starts at the gateway

Ask a security team which AI tools are in use across the company and the honest answer is usually a shrug. ChatGPT in the browser, Claude in a few teams, Copilot in the IDE, a vendor's "AI assistant" that nobody evaluated, and a handful of internal prototypes calling provider APIs with personal keys. None of this is malicious. All of it is invisible.

The instinct is to respond with a policy document. Policies matter, but a document cannot mask a card number or refuse a prompt. The control has to live somewhere on the data path, and the most practical place is a gateway that every managed AI request passes through.

What a gateway can actually enforce

Once requests go through one endpoint, a few things become possible that are impossible otherwise:

• Identity. Every request is tied to a user, a group, an application or an agent, not to a shared API key.
• Classification. The request is scanned for PII, payment data, credentials, source code and your own patterns before it leaves the perimeter.
• Deterministic decisions. A rule such as Data = CREDENTIALS → BLOCK fires the same way every time. No model is asked whether the request "seems fine".
• Routing. Confidential material can be sent to an internal model while public questions go to an external provider, without the user changing tools.
• Audit and cost. Who used which model, under which policy, for how many tokens, is written down before the response is returned.

None of this requires replacing the tools people already like. Claude Code, Cursor and internal apps keep working; they just point at a corporate endpoint instead of a vendor's.

What a gateway cannot see

A gateway controls managed traffic. It does not magically observe a personal ChatGPT account on a home laptop. Anyone who promises "100% visibility" from a proxy is overselling.

That gap is exactly why the gateway should integrate with the security stack you already run. Endpoint, browser, DLP and SASE tools are good at discovering AI usage outside the perimeter. The gateway is good at enforcing policy inside it. Put both signals into one registry and you get a realistic picture: what is managed, what is observed, and what is still unknown.

Where to start

Start with visibility, not enforcement. Route one team's traffic through the gateway, turn on classification in audit-only mode, and look at the report after a week. The data classes you see in real prompts will tell you which policies to write first. Enforcement can be switched on rule by rule once the team trusts the numbers.