Guide
What is an AI gateway?
An AI gateway is the layer placed between users, applications and AI agents on one side and large language models (LLMs) such as ChatGPT, Claude or Gemini on the other, inspecting the traffic between them. It is where you decide which data reaches a model, which model is used, and which requests coming back from a model or agent are allowed to run on your systems.
Why do you need an AI gateway?
AI tools became part of everyday work within months; data protection habits have not kept up. When you paste a contract, a customer spreadsheet, a medical report or source code into a chat window, that data leaves your control and usually goes to a service in another country. Agents add a new dimension: the model no longer just reads, it changes files, runs commands and can deploy to production. An AI gateway makes both directions visible and controllable at a single point.
What does an AI gateway do?
- Limits context: It isolates the information a task needs; instead of a whole document, database or code repository, only the necessary part reaches the model.
- Filters sensitive data: It can mask or stop content such as personal data, customer information or trade secrets before it reaches the model.
- Checks agent actions: It compares the read, write or deploy action an agent requests against the scope of the task; it rejects what is out of scope and leaves risky actions to human approval.
- Keeps records: It makes it traceable which data went to which model and which action was applied with whose approval.
- Manages models from one place: It centralizes access, quotas and costs across models from different providers.
AI gateway vs. API gateway vs. DLP
| API gateway | DLP | AI gateway | |
|---|---|---|---|
| What does it control? | API calls between services | Files and data leaving the company | Context going to models and actions coming from agents |
| Core question | Is this request authorized and within limits? | May this data leave? | What should the model see for this task, and what may the agent do? |
| Does it understand content? | No, it routes the request | Recognizes it by patterns | Evaluates it at the level of task and context |
| Direction | Both ways, content-agnostic | Mostly outbound | Both ways: context out, actions in |
In short, an API gateway manages traffic and DLP tries to catch leaks; an AI gateway oversees the relationship AI itself builds with your company’s data and systems.
Agents and MCP: the gateway’s second direction
Standards such as the Model Context Protocol (MCP) make it easier for AI agents to connect to company tools and data. That convenience magnifies the permission problem: every tool given to an agent is an action the agent can take. A good AI gateway checks not only the data going out but also the actions coming in. For example, an agent investigating a payment bug may read payment records, but changing the session management code is outside its task, and deploying to production requires human approval.
Questions to ask when choosing an AI gateway
- Can it limit the data sent to a model at the level of the task, or does it only look for keywords?
- Can it distinguish between allow, deny and human approval for agent actions?
- Does it work with more than one model provider?
- Does it record which data went where, for auditing?
- Does it support data minimization and reduce transfers abroad under laws such as the GDPR or KVKK?
Where does Derbent AI fit?
Derbent AI is being designed as a two-way AI gateway for individuals, teams and companies: only the minimum necessary context goes from you to the models, and only verified actions come from agents to you. The platform is not yet publicly available; you can see how it works in the examples on the homepage.