Notifications
Clear all
Topic starter
06/07/2026 9:40 am
TL;DR: TrueFoundry and TrojAI pair gateway control with runtime enforcement to give enterprises centralized AI traffic governance, observability, and inline protection against prompt injection, data leakage, and unsafe outputs, according to TROJ.AI. The key issue is that AI deployments now need both access control and request-level security, because visibility without enforcement leaves policy gaps.
NHIMG editorial — what this means for NHI practitioners
Questions worth separating out
Q: How should security teams govern AI model access in production?
A: Security teams should govern AI model access through a centralized control layer that enforces authentication, quotas, logging, and routing policy consistently across applications.
Q: Why do AI gateways need runtime enforcement as well as observability?
A: Observability tells you what the AI system did, but it does not prevent prompt injection, leakage, or unsafe output in the moment.
Q: What do teams get wrong about protecting AI traffic at scale?
A: The common mistake is assuming a routing layer alone can provide security.
Practitioner guidance
- Map AI gateway policies to identity controls Document which teams can access which models, what authentication is required, and how quotas and logging are enforced across environments.
- Require inline enforcement for sensitive AI traffic Use a control that can block, redact, or pass requests in real time when prompt injection, system prompt leakage, or data exfiltration is detected.
- Separate routing policy from security policy Define which layer selects the model or failover path and which layer decides whether the content is acceptable.
What's in the full announcement
TROJ.AI's full blog post covers the operational detail this post intentionally leaves for the source:
- How the integration is configured in practice, including policy creation and connector setup in the platform
- The request and response handling flow for prompts, redaction, blocking, and pass-through decisions
- The specific logging, metrics, and trace data exposed by the gateway for production review
- Deployment details for using the firewall as a proxy layer or API monitoring layer
👉 Read TROJ.AI's analysis of the TrueFoundry and TrojAI AI gateway integration →
AI gateway plus runtime defense: what changes for AI teams?
Explore further
06/07/2026 9:55 am
AI gateway governance is becoming a control plane problem, not an application feature. Once enterprises route multiple models and AI agents through a shared path, access control, logging, and policy decisions must move out of scattered application code and into a governable layer. That shifts AI security into the same discipline family as IAM and NHI oversight, where policy consistency matters more than one-off guardrails. The practitioner takeaway is to manage AI traffic as a privileged access channel.
A few things that frame the scale:
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, which shows how quickly identity weakness compounds across environments.
A question worth separating out:
Q: Should organisations treat AI agents as part of NHI governance?
A: Yes. AI agents consume credentials, access models through APIs, and move sensitive context across services, which makes them part of the broader non-human identity control surface. Governance should therefore cover their service accounts, tokens, quota limits, offboarding, and logging just as it would for other high-value machine identities.
👉 Read our full editorial: TrueFoundry and TrojAI define a secure AI gateway stack
