Use this reference to look up what a Proxy connector is and what its settings do. A Proxy connector provides a proxy auto-configuration (PAC) file URL that steers generative AI (GenAI) traffic to F5 Workforce AI Security. The settings control how Workforce AI Security identifies the user behind each request. They also control which traffic the connector matches.

For what users see with each integration method, see User experience by network integration method.

A Proxy connector sends only GenAI traffic to Workforce AI Security. All other traffic follows its typical route. A PAC file is a JavaScript function that a browser or application runs to choose a proxy for each request.

The connector needs no endpoint agent. It needs only the PAC support that browsers, native desktop applications, and operating systems already provide.

Secure access service edge (SASE) is the preferred integration method. The SASE vendor labels all traffic with the user identity, so users never need to log in. Organizations without a SASE solution use a Proxy connector. They push its PAC file URL to devices with mobile device management (MDM) platforms.

Workforce AI Security applies your policies to the traffic that reaches it. It records each governed session in User Activity.

After setup, each browser or application retrieves the PAC file. The file holds a curated list of GenAI service domains. For each request, the PAC file checks the destination. A request to a listed domain goes to the Workforce AI Security proxy. Any other request goes straight to its destination. Workforce AI Security then identifies the user or the connector, applies policy, and records the session in User Activity.

Endpoints must trust the Workforce AI Security root certificate authority (CA). For ports, hosts, and the full traffic path, see Traffic flows.

In CONFIGURE, go to Connectors, then select a Proxy connector to see its settings. Name and Type are required.

A PAC file URL can carry a GUID in the id= parameter. It can also carry an email address in the email= parameter. To add these parameters with an MDM platform, see Use the Proxy connector deployment files.

A GUID is user authentication. The user logs in every 5 days. The login covers all browsers and native apps on the system. A GUID doesn't require a specific Authentication Type. Under Connector, nobody logs in and User Activity shows the Connector user.

An email address needs an Authentication Type of Connector or User with Connector Fallback. When Allow Email Identification in PAC File URL is Enabled, the email address identifies the user and nobody logs in. When the setting is Disabled, Workforce AI Security treats the email like a GUID.

Without an identifier, user authentication works only inside a web browser. Each browser keeps its own login, and native apps can't use it.

The Authentication Type setting controls whether Workforce AI Security prompts users to log in. It also controls what User Activity shows for each request. The result depends on the kind of client:

Every value works in a browser.

These rows assume the PAC file URL has no GUID and no email address.

With a GUID in the PAC file URL, the GUID login also covers native apps under User and User with Connector Fallback. Under User with Connector Fallback, native app traffic before the first GUID login goes to the Connector user.

When you create a Proxy connector, Workforce AI Security also creates a Connector user. Workforce AI Security attributes traffic that it can't tie to a person to the Connector user. Policy still applies to that traffic.

In User Activity, these events show the Connector user in place of a person. Under Connector, nobody is prompted to log in. User Activity shows the Connector user for all traffic except requests identified by email. Under User with Connector Fallback, it shows the Connector user only for traffic that skips the login prompt.

A PAC file returns two proxy addresses. The primary address is a proxy that uses Transport Layer Security (TLS). The second is an HTTP fallback proxy for clients that don't support TLS proxy connections. Safari on macOS is one such client.

The TLS proxy uses a user-specific hostname to identify each user. Workforce AI Security can't identify the user from HTTP fallback traffic, so it always uses user authentication. Connector authentication, the Connector user, and the id= and email= parameters don't apply to this traffic.

The following table shows how each Authentication Type value behaves.

Some clients don't use the Proxy connector the same way a browser does. The following table lists the known cases and what each one means for User Activity.

The PAC file content depends on the client that retrieves it. If an unsupported component retrieves the file, every client that uses that copy also gets DIRECT;. Overview of PAC files describes this behavior and the ignoreUnsupported parameter.

These articles have more information: