An AI gateway only controls the model traffic that passes through it, with the keys it knows about, under policies someone keeps current, and few teams measure any of those three things after go-live. This health check is a recurring review of an AI gateway (also called an LLM gateway or model proxy) that is already in production. It gives thirteen metrics with formulas and thresholds covering coverage, caller credentials, spend attribution, guardrails, logging and the security of the gateway itself. It is for AI platform owners, security architects and the teams who sign off AI risk.
This page measures; it does not repeat the design guidance. For architecture, the credential model, routing and policy design, use the AI Gateway and LLM Gateway Guide, and for the rollout sequence the AI gateway rollout playbook. The metrics are vendor-neutral and apply to self-hosted, managed and cloud-native gateways alike.
What this health check covers
The review covers the gateway service, its admin plane, the caller credentials it issues, the upstream model provider credentials it holds, the guardrail and routing policies it enforces and the logs it produces. It also covers the network evidence needed to show whether traffic bypasses the gateway, since a gateway that can be bypassed is a recommendation, not a control.
- Who runs it: the AI platform owner collects the data; the security team validates the bypass and credential metrics; the head of AI governance or CISO signs off.
- What it is not: a red team exercise or a model evaluation. Guardrail effectiveness here is measured from production samples, not from an attack test suite. Use the AI Red Teaming Guide for adversarial testing.
- Typical questions it answers: "how do we audit our LLM gateway", "what KPIs show AI gateway coverage" and "how do we know no one is calling model APIs directly".
Key takeaways
- Coverage comes first. Measure the share of model API traffic that reaches providers through the gateway, using egress evidence the gateway cannot see on its own.
- Every caller key needs four attributes. Owner, expiry, budget and a model allow list; measure the share that has all four and the share that is shared or dormant.
- Upstream provider keys are the crown jewels. Count provider keys held anywhere other than the gateway's secret store.
- Measure guardrails both ways. Coverage of production routes and the false positive rate on sampled blocks; an unmeasured guardrail gets switched off.
- Test revocation. Time to revoke a caller key end to end is the single best indicator of incident readiness.
How to use this template
Copy the metrics table and the findings log into your own tracker, then run this AI gateway health check at the cadence set out below. Collect each figure from the data sources described, score it against the green, amber and red thresholds, and record every amber or red result as a finding with an owner and a due date. Keep each completed review so you can compare results quarter on quarter: the trend matters as much as any single score.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Spend and anomaly review per caller key | Weekly | AI platform team | AI platform owner | Spend by key report, anomalies and actions |
| Caller key hygiene (dormant, shared, expired) | Monthly | AI platform team | Security engineering lead | Key inventory export with attributes and last-use date |
| Full metrics review (this page) | Quarterly | AI platform owner | CISO and head of AI governance | Metrics table, extracts, findings log |
| Revocation drill | Quarterly | Security operations | AI platform owner | Drill timeline, time to effect, gaps found |
| Guardrail policy and model allow list review | Quarterly, and when a new model is approved | AI governance team | Head of AI governance | Policy versions, approved model register, change log |
Metrics
NHI Mgmt Group recommended thresholds; adjust to your risk appetite. "Caller key" means any credential the gateway issues to an application, team, user or agent; "provider key" means a credential the gateway uses to call an upstream model provider.
| ID | Metric | Formula | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| AIG-01 | Gateway coverage of model traffic | Requests to known model provider endpoints that originate from the gateway ÷ all requests to those endpoints | Egress proxy, firewall or DNS logs | At least 98% | 90% to below 98% | Below 90% |
| AIG-02 | Provider keys outside the gateway | Provider keys found in code, CI variables or secret stores other than the gateway's ÷ total provider keys on provider accounts | Provider account key lists, secrets scanning results | 0 | Documented exceptions with expiry | Any undocumented |
| AIG-03 | Fully governed caller keys | Active caller keys with owner, expiry, budget and model allow list all set ÷ active caller keys | Gateway key inventory export | At least 95% | 80% to below 95% | Below 80% |
| AIG-04 | Shared caller keys | Caller keys used from more than one workload identity or source network in the period ÷ active caller keys | Gateway request logs joined to workload inventory | 0% | Above 0% to 5% | Above 5% |
| AIG-05 | Dormant caller keys | Valid caller keys with no request in 30 days ÷ active caller keys | Gateway key inventory with last-use date | Below 5% | 5% to 15% | Above 15% |
| AIG-06 | Attributed spend | Spend attributed to a named application, team or agent ÷ total model spend on provider invoices | Gateway usage records, provider billing exports | At least 95% | 85% to below 95% | Below 85% |
| AIG-07 | Unapproved model use | Requests routed to models not on the approved model register ÷ total requests | Gateway request logs, approved model register | 0% | Above 0% to below 1%, with tickets | 1% or more |
| AIG-08 | Guardrail route coverage | Production routes with both input and output policies enabled ÷ production routes | Gateway route and policy configuration export | 100% | 90% to below 100% | Below 90% |
| AIG-09 | Guardrail false positive rate | Sampled blocks judged wrong on review ÷ blocks sampled (minimum 50 per quarter) | Guardrail verdict logs, reviewer worksheet | Below 5% | 5% to 15% | Above 15%, or not measured |
| AIG-10 | Sensitive data in retained logs | Sampled stored prompt and response records containing unredacted secrets or personal data ÷ records sampled | Gateway log store, redaction test sample | 0% | Above 0% to below 1% | 1% or more |
| AIG-11 | Admin plane access control | Gateway admin accounts authenticated through SSO with MFA and reachable only from the management network ÷ total admin accounts and admin interfaces | Gateway admin user list, network exposure scan | 100% | Local break-glass account only, vaulted | Any admin interface reachable from the internet |
| AIG-12 | Caller key revocation time | Median minutes from revocation request to first rejected request, across drills in the period | Drill records, gateway request logs | Under 15 minutes | 15 to 60 minutes | Over 60 minutes or no drill |
| AIG-13 | Gateway software currency | Days since the newest security release of the gateway software was available and not yet deployed | Deployment records, project or supplier release notes | Under 14 days | 14 to 30 days | Over 30 days |
How to collect the data
- Build the endpoint list. List the model provider hostnames your organisation uses or could use. AIG-01 depends on it: requests to an endpoint you did not list are invisible to the metric.
- Measure bypass from the network side. From egress proxy, firewall or DNS logs, count requests to those hostnames by source. Requests from the gateway's egress addresses are covered; everything else is bypass. The AI Usage Monitoring Guide covers the sources.
- Reconcile provider keys. Export the key list from each provider account and match each key to the gateway's secret store. Run secrets scanning across code and CI for provider key patterns. See How to find LLM API keys in code and CI.
- Export the caller key inventory with owner, team, expiry, budget, model allow list, rate limits, creation date and last-use date. AIG-03 and AIG-05 come straight from it.
- Join request logs to identities. For AIG-04, group requests per caller key by source workload identity or network. More than one source for a key meant for one application is sharing.
- Reconcile spend. Compare gateway usage totals with provider invoices for the same period. A gap means traffic the gateway did not see or did not attribute.
- Sample guardrail verdicts and logs. Pull a random sample of blocks and a random sample of stored records each quarter. Two reviewers judge the blocks; a pattern scan plus manual review checks the stored records for secrets and personal data.
- Check the admin plane from the gateway's admin user list and an external exposure scan of the admin and metrics interfaces.
- Run the revocation drill: revoke a test caller key and time how long until requests with it are rejected at every gateway replica and region.
Red flags that need action now
- A provider key with no owner, or one that appears in a code repository or CI log.
- The gateway admin interface or admin API is reachable from the internet.
- Model provider traffic from production workloads that does not pass through the gateway.
- A caller key with no budget and no expiry used by an agent that runs unattended.
- Spend on a provider invoice that the gateway cannot attribute, rising month on month.
- A guardrail policy disabled on a production route with no change record.
- Stored prompts or responses containing credentials or unredacted personal data.
- No revocation drill has ever been run.
Spend spikes and unknown callers can mean stolen keys rather than misconfiguration. Treat them as possible LLMjacking and follow the LLMjacking Guide before cleaning up.
Findings log
| ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-AIG-01 | [Description, population and figure] | AIG-01 | [Critical / High / Medium / Low] | [Role] | [Date] | [Open / In progress / Closed / Risk accepted] |
| HC-AIG-02 | [Description] | AIG-02 | [Severity] | [Role] | [Date] | [Status] |
| HC-AIG-03 | [Description] | [Metric ID] | [Severity] | [Role] | [Date] | [Status] |
Suggested due dates: red flags within 7 days, red metrics within 30 days, amber metrics within 90 days. Risk acceptance needs the AI platform owner's signature and an expiry date.
Remediation map
| Finding type | Where to fix it |
|---|---|
| Bypass and low coverage (AIG-01) | AI Gateway and LLM Gateway Guide (egress control and shadow AI section) and Agent Egress Control and Network Isolation Guide |
| Provider and caller key hygiene (AIG-02 to AIG-05) | AI Gateway and LLM Gateway Guide (identity section) and LLMjacking Guide |
| Spend attribution and budgets (AIG-06) | How to set spend limits on LLM API keys and OWASP LLM Top 10 LLM10 Unbounded Consumption Guide |
| Unapproved models and guardrail gaps (AIG-07 to AIG-09) | AI Guardrails and AI Firewalls Guide |
| Sensitive data in logs (AIG-10) | Generative AI Data Loss Prevention Guide |
| Admin plane, revocation and patching (AIG-11 to AIG-13) | AI gateway rollout playbook |
Related guides
- AI Gateway and LLM Gateway Guide: the design and operating guidance this review measures.
- AI Gateway Buyer's Guide: evaluation criteria if findings point to a platform change.
- AI Security Maturity Model: where the gateway sits in a wider AI security programme.
- API gateway health check and Agent platform health check: neighbouring reviews that share data sources.
References
- OWASP: Top 10 for LLM Applications 2025 (LLM02 Sensitive Information Disclosure, LLM07 System Prompt Leakage, LLM10 Unbounded Consumption)
- NIST: AI Risk Management Framework (AI RMF 1.0 and the Generative AI Profile, NIST AI 600-1)
- NIST: SP 800-53 Rev. 5 (AC-4 Information Flow Enforcement, SC-7 Boundary Protection, IA-5 Authenticator Management, IA-9 Service Identification and Authentication, AU-12 Audit Record Generation, SI-4 System Monitoring)
- NIST: Cybersecurity Framework 2.0 (PR.AA-05 access permissions, DE.CM-09 monitoring of computing software and runtime environments)
- CIS: Critical Security Controls v8.1 (Control 3 Data Protection, Control 6 Access Control Management, Control 8 Audit Log Management)
Related NHI Mgmt Group resources: AI Gateway and LLM Gateway Guide, AI Usage Monitoring Guide, MCP Gateway and MCP Server Governance Guide, AI Platforms Guide.