One is about the AI feature you are building. The other is about what your organization types into somebody else's model. The products that answer them are not substitutes, and most comparisons mix them up. Here is the split — every cell verified against the vendor's own public source, listed at the bottom.
Both categories inspect prompts, redact PII and block prompt injection. Reading a feature list will not tell them apart. What separates them is where the control point sits — and therefore what it is structurally unable to see.
| "Is the AI feature I ship safe?" | "What is my organization sending to AI?" | |
|---|---|---|
| Control point | your application's request path | the network the people are on |
| Coverage comes from | integration — an SDK or a changed base URL | routing — DNS, PAC or L3 |
| Who deploys it | the team building the feature | security and network |
| Typical products | LiteLLM, Portkey, Cloudflare AI Gateway, Amazon Bedrock Guardrails, Occludra Gateway | Prompt Security, Arceris |
| Structurally cannot see | anything not routed through it: an employee's ChatGPT tab, a coding agent calling the provider directly | traffic that is never routed to it — see section 05 |
These are good products and several of them ship serious controls. We are listing them because they are frequently proposed as an answer to workforce AI risk, and they cannot be one — not for lack of features, but because that traffic never reaches them.
| Product | What it is | Controls it ships | Where it runs | Sees a browser AI session |
|---|---|---|---|---|
| LiteLLM | Open-source LLM gateway | Built-in content filter, plus guardrail integrations: Presidio, Lakera, Bedrock, Azure Content Safety, OpenAI Moderation, Guardrails AI, Aporia, Pillar, Cato | Self-hosted, open source | No |
| Portkey | AI gateway and observability | 20+ deterministic checks (regex, JSON schema, code detection) plus LLM-based prompt-injection detection | SaaS gateway | No |
| Cloudflare AI Gateway | "Observe and control your AI applications" | Guardrails: NER-based PII detection, harmful-content categories, flag or block, on prompt and/or response | Cloudflare edge (SaaS) | No |
| Amazon Bedrock Guardrails | Safeguards for generative AI applications | Content filters, denied topics, word filters, sensitive-information filters, contextual grounding, automated reasoning | AWS; also callable on models outside Bedrock via the ApplyGuardrail API | No |
| Occludra Gateway | Apache-2.0 self-hosted AI security proxy, OpenAI-compatible endpoint | PII redaction, secret detection, prompt-injection blocking, fail-closed | Self-hosted Docker | No |
The last column is not a criticism. None of these products is built to intercept a browser session, and saying so is not a knock on them. It is the boundary of the category — and the reason a feature-by-feature table between an application gateway and a workforce gateway is a category error.
Inside the workforce category there is a genuine technical disagreement, and a buyer should hear both halves of it rather than one vendor's half.
Prompt Security argues that browser extensions are the only scalable way to govern AI use, and that network inspection is not enough. Their objections, stated as they state them: a network tool needs a parser per AI platform and can realistically cover "dozens, at most"; providers change their backends without notice; and a tool can only detect what it already has a parser for.
"Every protocol change breaks your visibility. Every new AI feature requires a new parser."
Protocol drift is real, and we have been on the wrong end of it. A coding agent changed the wire format it uses to run its own tool calls; our network-side parsing of those calls went blind to it, and the fix was not a better parser — it was moving enforcement into the client, as a hook that runs before the tool call executes. Any vendor who tells you protocol drift is not a real maintenance cost is not being straight with you.
An extension covers the browser it is installed in. It does not cover a terminal, and that is where a growing share of the highest-value data now goes:
And an extension is itself a per-platform parser — of the page's DOM rather than of a protocol. DOM changes at least as often as an API does.
Arceris is not "network instead of client". The network control point is the base, because routing covers surfaces no install can reach; on top of it, developer tools enrol a local agent that enforces the same policy at the tool call. Unrecognized AI hosts are refused rather than quietly forwarded, and shadow-AI detection surfaces services that are not on the list yet — the design assumes the list is incomplete, because it always is.
Four ingress points, one policy set, on your own infrastructure.
| Surface | How it is covered | Examples |
|---|---|---|
| Browser | Transparent HTTPS inspection — nothing installed on the client | ChatGPT, Claude, Gemini web sessions |
| Terminal and IDE | The arceris-dev agent with zero-touch Kerberos enrolment, PAC routing and pre-tool-use hooks | Claude Code, Cursor, Codex, Gemini CLI, MCP servers |
| API | A unified gateway endpoint, one key per user across providers | Applications, scripts, CI |
| Self-hosted models | The same policy path as every other surface | llama.cpp, vLLM, Ollama |
Stated plainly, so it is not inferred incorrectly — and so this page is worth reading.
If the question behind your comparison is a regulatory one rather than a product one, the companion page is the nine questions KVKK asks about employee AI use — with article references, and no compliance claim.
The difference is where the control point sits. An AI gateway (LiteLLM, Portkey, Cloudflare AI Gateway) sits in your application's request path: its coverage comes from the integration that routes traffic to it. An AI security gateway in the enterprise sense sits on the network: its coverage comes from routing, not integration. The first answers "is the AI feature I am shipping safe"; the second answers "what is my organization sending to AI".
No. LiteLLM, Portkey, Cloudflare AI Gateway, Amazon Bedrock Guardrails and Occludra Gateway all require that traffic be sent to them. An employee's browser talks to chatgpt.com directly, and that session passes through none of them. This is not a shortcoming — it is the boundary of the category. None of them is built for it.
In most organizations, yes, and they are not substitutes. If you ship your own AI feature you want a guardrail layer in that request path. If 500 employees are simultaneously using AI in a browser and a terminal, no application gateway sees that traffic. Two problems, two control points.
Both have real blind spots and the choice should be made with them in view. An extension sees the browser it is installed in; it does not see a terminal, an SDK, a CI job, an MCP server or an unmanaged device. A gateway sees the traffic routed to it; routing is network engineering work, and provider protocol changes are a real maintenance cost. Arceris is built on the network control point and adds a client-side agent for developer tools — both run the same policy.
Yes. Detection models, the OCR worker, the moderation sidecar and the DLP integration all run inside the perimeter. There is no Arceris server in the request path, and no prompt leaves the organization.
Every claim about another vendor on this page comes from that vendor's own public documentation, linked below and checked on 29 August 2026. Where we could not verify something, we left it out rather than guess.