F5 AI Gateway is the request-routing and policy-enforcement layer inside F5 Workforce AI Security. It sits between AI agents, developer tools, and both public and private AI models. It inspects inference and tool-call traffic, so admin-defined policy applies before a request reaches its destination.

You configure F5 AI Gateway once, centrally. That configuration then covers every model connection, every coding agent, and every Model Context Protocol (MCP) tool call that passes through it.

This document covers five areas:

F5 AI Gateway connects to models an organization hosts privately. Requests then skip the public API. You create a connector to a cloud AI provider, then register a private model against that connector. F5 AI Gateway supports these cloud AI providers:

Once a private model is active, F5 AI Gateway can route eligible traffic to it. That traffic skips the public internet, so inference stays inside infrastructure the organization already controls. See Adding Private Model Connectors.

Two policy types drive every access decision in F5 AI Gateway. A Default Policy applies to every user in the organization. Group Policies grant additional, narrower access on top of it. Both follow a least-privilege model: a Group Policy can only add access, or loosen a restriction the Default Policy already sets. It can never remove one.

Each policy carries a Service Access Control List and a Service Block List. Together, the two lists determine which public AI services a user can reach. A blocked service always takes precedence over an allowed one, and block and allow lists from every applicable policy are combined.

The policy also drives Content Controls and personally identifiable information (PII) detection. You can use these to monitor, mask, or block sensitive data before it reaches a model. See Understanding policies.

F5 AI Gateway extends the same governance model to AI coding agents through a dedicated harness integration. For Claude Code, you install the Claude Code Helper on each developer machine. It replaces Claude Code's default static Anthropic API key with a token-based flow.

On first use, the helper authenticates the developer through the identity service, using the OAuth 2.0 Device Authorization Grant (RFC 8628). The developer completes a one-time browser login. The helper then caches and refreshes access and refresh tokens, in the operating system's native credential store:

Every later Claude Code session then authenticates through F5 AI Gateway, with no repeated login. See Deploy the Claude Code Helper and Agentic development and agentic harnesses.

Once Claude Code traffic reaches F5 AI Gateway through the helper, you can also turn on the Claude Code Model Router. It works at the policy level, on the Default Policy or a Group Policy. The router maps each Claude model family to a private model in a compatible family. The four families are Haiku, Sonnet, Opus, and Fable.

Some organizations already run Claude models on AWS Bedrock, Google Vertex AI, or Azure AI Foundry. These organizations can use the router to redirect Claude Code's traffic to those deployments, instead of the public Anthropic API. The same governance that applies to every other AI service then covers agent traffic too. See Configure the Claude Code Model Router.

F5 AI Gateway governs which Model Context Protocol (MCP) tools an agentic harness can call. It works the same way it governs which AI services a user can reach. Every known MCP server and tool is listed in the MCP Servers catalog, and each one is classified as Read or Write. You can evaluate a tool before deciding whether to allow it.

Policy applies these controls to MCP tool calls:

A blocked tool is stripped from the request, so the backend service never receives it. See Configure tool policy for agentic harnesses.

F5 AI Gateway generates two independent telemetry streams. Together, they give you standing visibility into agent and model traffic:

You can export both streams, plus supplementary conversation-level data, to a telemetry destination. Each destination can turn on or off each stream on its own. See Configuring telemetry destinations for the supported destination types.

The Insights dashboard also surfaces this data for reporting, including a dedicated view of private-model usage. See Telemetry schema and format.

A platform engineering team wants to give its developers access to Claude Code. They don't want to send code or prompts to the public Anthropic API. The team creates a private model connector to their existing AWS Bedrock deployment of Claude models. They register the private model in F5 AI Gateway.

In the Default Policy, the team turns on the Claude Code Model Router. They map each Claude model family to its Bedrock equivalent. They roll out the Claude Code Helper to every developer machine, through their device management tool. Each developer completes a one-time device-authorization login the first time they open Claude Code, and every later session authenticates on its own.

In the same policy, the team turns on Allow Read-only for MCP tools. They add two file-system-access tools to the MCP Tool Block List. From that point on, every Claude Code session in the organization routes through F5 AI Gateway. Each session is enforced against the same tool policy as every other agent. Each session also appears in User Activity and the Insights dashboard.

For more information, see: