Deployment guides for the Prisma AIRS AI Gateway, the centralized security and observability layer for LLM prompts, MCP interactions, and agent-to-agent traffic, managed through Strata Cloud Manager.
End-to-end deployment of the Prisma AIRS AI Gateway: flex credit licensing, SaaS or Hybrid data plane enablement, LLM integrations with workspace provisioning, budgets, rate limits, and model allowlists, plus guardrails and two-tier logging.
Start here whichever model you choose. Licensing, LLM integrations, MCP integrations, guardrails, and logging are identical for SaaS and Hybrid. Only the enablement phase differs, and it covers the SCM Gateway Registration wizard path in full.
Infrastructure planning for a Hybrid data plane: what the Helm chart deploys, which platforms are viable, how to size the cluster, what egress the gateway needs, and the prerequisites for EKS, AKS, and on-premises VMware.
Deploying a Hybrid data plane on managed Kubernetes with Helm. Cluster preparation, the managed cache and log store, workload identity, the values.yaml file, the chart install, ingress, outbound connectivity to the management plane, and verification, with a tab per platform.
Deploying a Hybrid data plane without Kubernetes. Terraform-driven deployment on Amazon ECS and Azure Container Apps: architecture, secret preparation, the module configuration, ingress and TLS, outbound connectivity to the management plane, and verification.
The consolidated list of everything a hybrid data plane must reach, written to hand to a network team: the management plane hostnames and why your Strata Cloud Manager URL is not one of them, what the nodes need separately from the pods, per-cloud identity and storage endpoints, hostname filtering, and the three independent ways TLS inspection breaks a deployment.
Secure key storage for customers who need a key management process in place before configuring the gateway: creating the key vault, storing provider API keys, giving the gateway an identity, granting access, retrieving secrets at runtime, and rotation with expiry alerting.
Three capabilities that change what the gateway can enforce and what it can see: server-sent event streaming and why an output guardrail can only report on it, semantic caching with its embedding provider and vector store, and the Agent Gateway for agent-to-agent traffic. Includes the support and roadmap position for each.
How an AI agent's identity reaches the gateway and what the gateway does with it: Cloud Identity Engine directory sync into workspaces, the Entra app registration and JWKS configuration, gateway-local JWT validation, the email_id to sub to uid claim precedence, the single comparison that decides attribution, and where identity forwarding stops. Carries a full flow diagram and the canonical reference URLs.
The Prisma AIRS AI Gateway is the Palo Alto Networks native gateway for AI traffic. Every LLM prompt, Model Context Protocol interaction, and agent-to-agent exchange routes through it, gaining unified visibility, guardrails, budgets, rate limits, and model allowlists. The gateway is managed end to end in Strata Cloud Manager and runs either as SaaS or as a Hybrid data plane in your own environment, on Kubernetes (EKS, AKS, GKE, or on-premises) or on a managed container platform (Amazon ECS or Azure Container Apps).
The Hybrid guides above are not alternative write-ups of one procedure. They document two install paths that use different charts, and mixing them leaves two data planes syncing against a single Organisation ID.
values.yaml for the airs-gw chart. Needs Kubernetes, works on any conformant cluster, and is documented in Phase 2 of the deployment guide.portkey-ai/gateway chart on Kubernetes, or Terraform on ECS and Container Apps. Documented in EKS, AKS, and GKE and ECS and Container Apps.If you are not sure which suits you, Which path are you on? compares them on connectivity, endpoints, and whether Palo Alto Networks has to be involved.