What Fastly announced
Fastly announced AI Runtime Control (ARC) on September 21. ARC places one managed endpoint between applications or agents and public or self-hosted model endpoints. Applications authenticate with Fastly-issued virtual keys rather than raw provider credentials, while customers keep their provider accounts and keys. Each virtual key can identify an application, environment, team, or developer and carry routing and usage limits.
Fastly says ARC records model requests, responses, token counts, provider, model, key, and optional session identifiers. It supports request- and token-rate limits, monthly dollar budgets with alert or block behavior, and ordered provider failover. AI Firewall is a separately purchased add-on that can inspect prompts and responses for prompt injection. These capabilities are operational controls, but placing them behind one endpoint also creates a new authority and availability boundary.
A virtual key identifies a caller; it does not authorize an action
Per-application keys are a material improvement over shared provider secrets: they make revocation, attribution, limits, and credential rotation more precise. They do not prove that a particular user allowed a tool call, that the requested operation is inside an agent mandate, or that the model output satisfies a financial or business policy. Treating gateway authentication as action authorization would collapse two different control planes.
Production agents should bind every consequential tool call to an authenticated principal, a narrowly scoped capability, the approved intent, and the policy version that evaluated it. The ARC key should identify the workload that may request inference; downstream services should independently decide whether that workload may read data, initiate a payment, change configuration, or trigger another irreversible effect. Key rotation must also be tested independently from user sessions and tool credentials.
Model failover is a behavioral change, not only a retry
ARC can send a request to the next provider in an ordered list when the preferred provider cannot serve it, and later return traffic to the preferred target. This can improve availability, but two targets rarely have identical tool-call formats, context limits, refusal behavior, latency, token accounting, or safety characteristics. A technically successful fallback can therefore produce a semantically incompatible result.
Teams should approve fallback pairs per workflow, pin model versions where possible, and run the same contract and safety evaluations against every target. The request record should preserve both the intended target and the provider that actually served it. High-impact workflows need an explicit decision between degraded operation, read-only operation, queued execution, and fail-closed behavior; automatic substitution should not silently expand an agent’s effective authority.
Inspection modes and streaming define real coverage boundaries
Fastly documents log and block modes for AI Firewall. It inspects input before forwarding, adds boundary tokens intended to distinguish untrusted data from instructions, and inspects completed responses for evidence of injection. The documentation also states that streaming requests are proxied without response inspection and that the added structural-isolation tokens are billed by the model provider.
Those details belong in the threat model. Log mode is detection, not prevention; block mode needs false-positive handling and a safe user-visible failure path. Streaming creates a different enforcement profile from buffered responses. Prompt-injection detection also cannot replace output schemas, tool allowlists, argument validation, least-privilege credentials, transaction simulation, or human approval for high-impact actions. Teams should test bypasses and failure behavior rather than infer a security guarantee from the word firewall.
Centralized logs become a sensitive data system
Full prompt and completion logging can make incident response, cost attribution, and audits substantially easier. It can also collect customer data, source code, credentials mistakenly placed in prompts, retrieved documents, and model-generated sensitive content. A gateway that improves visibility may simultaneously enlarge the privacy and breach impact of the AI stack.
Before routing production traffic, teams should define data classification, regional routing, retention, redaction, access review, export, and deletion requirements. Session identifiers must not become uncontrolled personal identifiers. Operators also need evidence for configuration changes to keys, budgets, provider order, and inspection mode, because a request log alone cannot explain which policy should have applied at execution time.
Ineeza’s view
Fastly ARC is timely because production AI systems increasingly need the same disciplined controls as payment and API infrastructure: scoped credentials, measurable consumption, deterministic failure policy, and reviewable evidence. The important architectural move is not merely replacing several provider URLs with one URL. It is treating the gateway as a governed production dependency while keeping action authorization, model compatibility, data governance, and downstream reconciliation independent. Centralization creates leverage only when teams also design for the control plane to be wrong, unavailable, or incomplete.