--- header: Fastly AI Firewall lang: en last_updated: '2026-09-15' url: https://docs.fastly.com/products/fastly-ai-firewall --- Fastly AI Firewall is a security module for [Fastly AI Runtime Control](https://www.fastly.com/documentation/guides/platform/ai-runtime-control/how-ai-runtime-control-works/) (ARC) that inspects large language model (LLM) requests and responses flowing through your ARC gateway. It identifies prompt injection attempts against your AI-powered applications. You enable it on individual ARC virtual keys with no code changes and no separate deployment. ## How it works AI Firewall is designed to prevent prompt injection, an attack class described in the OWASP Top 10 for Large Language Model Applications. It detects known injection patterns and can block them before they reach your LLM provider. Prompt injection attacks embed instructions inside user input to override the system instructions you gave the model. Because a model receives your instructions and untrusted user input as a single stream of text, it has no inherent way to tell them apart. AI Firewall inspects each request before it reaches your LLM provider and each response before it returns to your application. Specifically, AI Firewall does the following: - **Detects known injection and jailbreak patterns.** AI Firewall identifies inputs matching known prompt injection and jailbreak signatures, such as attempts to override your system instructions or change the model's persona, and tags them in your ARC request records. - **Logs or blocks detected requests.** AI Firewall either logs the detection and forwards the request, or rejects it before it reaches your LLM provider, depending on how you configure it. - **Isolates untrusted user input.** AI Firewall separates untrusted user input from your instructions and directs the model to treat that content as data, not as instructions. - **Inspects responses.** After the model responds, AI Firewall inspects the response to determine whether applied mitigations were successful. It evaluates two primary signals: checking for the expected refusal indicators to confirm an attack was contained, and scanning for potential system prompt leakage. For every inspected request, [AI Firewall logs](https://docs.fastly.com/products/fastly-ai-runtime-control) the threat classification, whether the detection occurred on the input or the output, and the action taken. These appear alongside the request details ARC already records in [ARC's summary and logging views](https://www.fastly.com/documentation/guides/platform/ai-runtime-control/monitoring-ai-usage-with-arc/). AI Firewall's pattern detection and structural isolation work with any LLM provider supported by ARC. ## Prerequisites To use AI Firewall, you must purchase [Fastly AI Runtime Control](https://docs.fastly.com/products/fastly-ai-runtime-control) (ARC) and your AI traffic must be routed through your ARC gateway for AI Firewall to inspect it. Security inspection may only be configured by a superuser, and on each individual ARC virtual key, via the [Fastly control panel](https://manage.fastly.com/). ## Limitations and considerations The following limitations apply to AI Firewall: - **AI Firewall inspects text only.** AI Firewall does not inspect images, video, or other non-text content in requests or responses. - **LLM models may not honor the instructions AI Firewall adds.** AI Firewall adds instructions directing the model to treat wrapped content as data rather than as instructions. LLM providers are under no obligation to honor those instructions, and model behavior may change between model versions. System prompt detection is designed to identify exposed instructions whether or not the model honors structural boundaries. - **Response inspection works only with models ARC supports.** Detection accuracy may vary between providers and model versions. - **Streaming responses are not inspected.** Response inspection operates on complete (non-streaming) responses. Streaming responses are proxied without response inspection, and ARC's logging view displays a status of `N/A` for streaming requests. Keep in mind the following considerations when using AI Firewall: - **Structural isolation adds tokens to each request.** These tokens are billed to you by your LLM provider as part of your normal token usage. - **Records do not include the instructions AI Firewall adds.** Request records include the original prompt as your application sent it, along with a flag indicating that AI Firewall applied structural isolation. - **Provider keys pass through ARC but are not stored.** Your LLM provider authorization headers transit the ARC gateway via TLS and are forwarded to your LLM provider. Keys are never persisted to disk, included in request records, or accessible in Fastly debug tooling. No security product, including those security services offered by Fastly, will detect or prevent all possible attacks or threats. As a subscriber, you should maintain appropriate security controls on all web applications and origins. The use of Fastly's security products does not relieve you of this obligation. As a subscriber, you should test and validate the effectiveness of Fastly's security services to the extent possible prior to deploying these services in production, continuously monitor their performance, and adjust these services as appropriate to address changes in your web applications, origin services, and configurations of the other aspects of your Fastly services. ## Billing > **NOTE:** Billing limits for this product may be different depending on your [account type](https://www.fastly.com/documentation/guides/account-info/billing/account-types/), if you've purchased a [packaged offering](https://www.fastly.com/package-entitlements/), or are using a [product or feature trial](https://www.fastly.com/documentation/guides/account-info/billing/about-the-products-page). AI Firewall is an add-on to Fastly AI Runtime Control (ARC) and is priced in addition to ARC and other Fastly services. Billing is based on the total number of AI requests that AI Firewall processes each month. These charges are separate from, and do not include, charges associated with ARC or your LLM provider charges for token usage (including the additional tokens added by structural isolation). Consider setting a [spend alert](https://www.fastly.com/documentation/guides/account-info/billing/about-the-spend-alert-page/) for your account to automatically be notified when your month-to-date bill approaches or meets a specific dollar amount. > **NOTE:** For more details about this product, including [pricing information](https://www.fastly.com/pricing) and help with purchasing it, contact your customer success manager or email [sales@fastly.com](mailto:sales@fastly.com).