Summary
- Fastly has released AI Runtime Control, AI Firewall, and expanded API Security capabilities on its edge platform.
- Runtime Control centralises model routing, credentials, token visibility, rate limits, budgets, and failover across AI providers.
- AI Firewall targets prompt injection, while API controls can restrict agent traffic that falls outside defined service contracts.
Fastly has launched runtime and security controls for enterprise artificial intelligence, reflecting a shift in the AI infrastructure market from helping organisations call models towards governing what happens once those calls become part of production systems.
AI Runtime Control creates a common layer for routing requests across public or self-hosted models, while virtual keys can prevent applications from holding the underlying provider credentials directly. Administrators can monitor token consumption, apply rate limits and spending controls, manage failover, and enforce policies without tying those controls to one model provider.
Alongside it, Fastly has released an AI Firewall intended to identify attacks such as prompt injection before a malicious request reaches the model. Its API Security capabilities have also been expanded to inspect traffic generated by agents and block requests that fall outside a service’s defined API contract.
The three products address different points in the same production chain. Applications call models, users interact with those AI-enabled applications, and increasingly autonomous software agents call other business systems. Each connection introduces another place where credentials, cost, data access, reliability, and authorisation must be controlled.
Model choice creates an infrastructure problem
Enterprise AI architectures rarely settle permanently on one model. Organisations may use different providers for coding, extraction, customer service, retrieval, or reasoning, while smaller models can be substituted where cost or latency matters more than maximum capability.
That flexibility creates governance problems when each application contains its own credentials, provider configuration, retry logic, usage limits, and monitoring. A central runtime layer separates some of those controls from the application itself, allowing teams to change model destinations or policies without rewriting each workload.
The approach resembles patterns already common elsewhere in enterprise computing. API gateways centralise controls around services, load balancers route traffic between systems, and identity layers decide who can access them. AI model calls are beginning to acquire similar infrastructure because they are becoming persistent dependencies rather than isolated experiments.
Cost sits inside the same problem. Token prices have fallen sharply for many models, yet applications using agents can issue repeated calls, invoke tools, retry failed actions, and generate substantial background activity. Techopia has examined how falling token prices can coexist with rising agentic-AI costs when one business task becomes a chain of model interactions.
Fastly’s runtime layer exposes token use and allows budget or rate controls to be applied while requests move through the system. The company says AI traffic on its own network grew roughly 30% between January and May, around 6.5 times faster than human traffic, while machine-generated requests became more than half of network traffic during July and August.
Agents turn APIs into an authorisation boundary
The security problem changes again once AI systems are allowed to act rather than simply respond. An agent booking an appointment, updating a record, changing a configuration, or initiating a transaction usually does so through an API, meaning ordinary service interfaces become the boundary between model-generated intent and a real business action.
Fastly’s API controls can compare those requests with an expected contract and either observe or block traffic that does not conform. That may prevent an agent from attempting unsupported operations or sending malformed requests, but it does not determine whether a technically valid action is appropriate in the wider business context.
Enterprises still need identity controls, permissions, approval logic, and application-specific rules above the API layer. An agent authorised to call a service should not necessarily be permitted to invoke every endpoint or perform every transaction available to the human account behind it.
Prompt injection creates a separate path for attackers because untrusted content can manipulate the instructions seen by a language model. Fastly says its firewall evaluates prompts in the request path to identify malicious activity before it reaches the model, bringing a familiar edge-security approach to a threat expressed through language rather than conventional network packets.
No firewall removes the need to design AI applications around limited privileges and recoverable actions. Model behaviour remains probabilistic, and agents can produce harmful requests without an external attacker being involved at all. Runtime protection is therefore one control around a system that still needs explicit boundaries further down the stack.
Fastly is packaging those layers alongside its existing content-delivery, web-application firewall, DDoS, bot, and API products. If AI traffic continues moving through the same edge infrastructure already serving applications, the vendor has an obvious route to becoming one of the points where organisations apply policy before requests reach models or business services.
Production AI is beginning to inherit the less glamorous machinery of ordinary enterprise software — routing, budgets, credentials, rate limits, permissions, and failover — precisely because organisations are starting to rely on it.
