AI Gateway User Insights Flags Spend Anomalies—It Does Not Stop Them

Cloudflare’s AI Gateway User Insights can flag an unusually expensive session for a person or agent. It does not decide whether that activity is malicious, identify the root cause, or stop another request.

The alert fires only when a session clears two cost thresholds at once: it costs more than twice that user’s rolling 30-day p95 session cost and sits above the organization’s p99 session cost. In plain English, the session must be unusual for that identity and unusually expensive across the organization. An operator still has to verify who the identity represents, inspect the surrounding requests, decide whether the activity is legitimate, and choose a containment action.

That separation is the useful part of the release. User Insights is a triage view, not an autonomous incident-response system.

The two thresholds filter different kinds of noise

Cloudflare made User Insights generally available on August 5, 2026 and says it is available to every AI Gateway customer at no additional cost. The companion Cloudflare Access integration, which can put a verified identity on a gateway request, launched in open beta.

The anomaly rule works on sessions rather than individual requests. For each user, Cloudflare calculates the 95th percentile, or p95, of session cost over the previous 30 days. A p95 of USD 12 roughly means 95% of that user’s observed sessions cost USD 12 or less. The relative threshold would therefore be anything greater than USD 24. Because the baseline rolls forward, a lasting change in normal work can also move the threshold.

That personal test is not sufficient. The same session must cost more than the organization’s p99, the level that only the most expensive 1% of sessions exceed. Cloudflare’s current User Insights documentation says both comparisons must pass.

Compared with personal 30-day p95	Compared with organization p99	User Insights result	What the operator knows
At or below 2×	At or below	Not flagged	Neither cost gate passed. This says nothing about non-cost risks.
Greater than 2×	At or below	Not flagged	Unusual for this identity, but below the organization-wide high-cost floor.
At or below 2×	Above	Not flagged	Expensive across the organization, but routine for this identity’s recent history.
Greater than 2×	Above	Flagged	The session crossed both cost gates. Intent and cause remain unknown.

Consider three fictional sessions in an organization whose p99 is USD 180. A USD 40 session from a user with a USD 12 p95 is more than twice their baseline, but it remains below USD 180 and is not flagged. A USD 220 session from a user with a USD 150 p95 is organization-wide expensive, but it is not more than twice that user’s baseline. A USD 220 session from an agent with a USD 30 p95 clears both gates and is flagged.

The examples explain the rule; they are not Cloudflare measurements or recommended budgets. The threshold is tuned to reduce noisy alerts, which means it can also miss meaningful low-cost abuse, a gradual increase absorbed into the rolling baseline, or an expensive session that is normal for a heavy user.

Identity coverage determines how much the alert can tell you

The dashboard can show active users, requests, tokens, median spend, high-activity concentration, users to review, and identity coverage. Its user view adds spend, request and token totals, cached and errored requests, approximate sessions, top model and provider, last-seen time, active days, and per-user identity coverage.

Those fields become person- or agent-specific only when requests carry useful identity metadata. Without an identity, Cloudflare groups usage under one anonymous identifier and cannot distinguish individuals.

There are two materially different identity paths:

An Access-protected custom domain can add cf.user_id, the verified subject from a valid Cloudflare Access JSON Web Token. Cloudflare’s Access documentation says service-token requests do not receive this field because they do not represent an individual Access user.
A client can attach its own user or agent identifier through custom metadata. That can improve attribution, but the application—not Cloudflare Access—defines and supplies the value. Treat it as trustworthy only to the extent that the sending system prevents spoofing or omission.

An alert tied to 42% identity coverage is not a finding about 100% of traffic. The missing 58% could hide other activity or blend multiple callers into the anonymous bucket. Record coverage before drawing a conclusion.

Independent Shogoworks coverage describes the practical shift as moving analysis from an API key toward a person. It also notes the governance consequence: identity-linked usage can reveal patterns about an employee’s work. That makes purpose limitation and access control part of the observability design, not paperwork to add later.

What a User Insights alert proves—and what it does not

If the dashboard and underlying logs are complete, an alert supports a narrow statement: AI Gateway attributed a session to an identity, estimated its cost, and found that cost above both current thresholds.

It does not by itself prove any of the following:

a credential was stolen;
an agent entered a retry loop;
the user violated policy;
sensitive data reached a model provider;
Cloudflare blocked the session or later requests;
the provider invoice will exactly match the gateway estimate; or
the selected identity owns every request in the session.

Cloudflare is unusually direct about this boundary: User Insights does not decide intent and does not block anyone. The company’s documentation for the separate spend-limits feature also labels cost tracking a best-effort estimate and tells customers to use the provider dashboard for exact billing.

The alert should therefore open an investigation, not close one. Its cost shape can distinguish a few very long requests from thousands of short failures, and a model or provider change can explain higher spend without any volume increase. Identity coverage then determines whether those observations belong to a verified person, application-supplied metadata, or an anonymous bucket.

Cloudflare’s AI Gateway logging documentation says stored logs can include prompts, model responses, provider, timestamp, status, token use, cost, duration, and user agent. That evidence can clarify the event, but it can also expose sensitive content; metadata may be enough to explain many anomalies without opening prompts or completions.

Containment remains a separate product surface. A spend limit can return HTTP 429 after a budget is reached, while a gateway-wide rate limit caps request volume. Spend limits are eventually consistent and can be exceeded briefly by concurrent traffic, while a gateway-wide rate limit can interrupt healthy callers. User Insights makes expensive deviations easier to find; it does not decide which of those consequences is justified.

The two thresholds filter different kinds of noise

Identity coverage determines how much the alert can tell you

What a User Insights alert proves—and what it does not

Sources

Follow new AI News articles

Keep reading

HarnessRisk Shows Why One Prompt-Injection Demo Cannot Measure Agent Safety

Anthropic's Model Hardware Standard Is an Interface, Not a Safety Certification

Cloudflare Optional OAuth Scopes Make Consent Narrower, Not Automatically Safe