Prisma AIRS: AI Gateway

The roles below must be present on the TRD discovery call to unblock all Part C configuration decisions. If any role is absent, record which sections are deferred and schedule a targeted follow-up before the configuration session begins.

Pre-call prep: Send §4 (Token Volume Sizing table) and §3 (Integration Inventory) to the AI/ML Platform Team and Finance/FinOps Lead 48 hours before the call. These require data lookup and should not be filled in on the call.

Slug naming matters: The slug is a developer-facing identifier that appears in API request paths and the Model Catalog. Pick a slug your developers will recognize. Convention: default-anthropic, prod-openai, sandbox-bedrock. Once set, changing it requires creating a new integration — applications hard-coding the old slug break.

When to create multiple integrations for the same provider: When different teams need different model allowlists (engineering gets GPT-4o, support gets GPT-3.5 only), or when you want separate budget tracking per team with one provider. Same credentials, different governance.

Provider API keys become shared infrastructure: The API key entered in Part C powers every workspace provisioned against that integration — no workspace member ever sees it. Use a dedicated organizational key (not a personal one), and plan for rotation.

Context windows inflate counts dramatically: A RAG pipeline that retrieves 10 documents per query (averaging 2,000 characters each) adds 20,000 characters to every prompt before the user question even appears. Agent workflows with tool schemas and multi-turn history can easily reach 50K+ characters per request.

Both directions count: A 500-character user question that produces a 3,000-character model response is 3,500 characters = 875 tokens. Most customers undercount by ignoring responses.

Err high for the initial profile: If the gateway runs out of tokens mid-month, traffic stops. You can increase the monthly token volume on the deployment profile, but any reset requires a new deployment profile activation cycle.

Default recommendation: SaaS. No infrastructure, no Helm, no Redis to manage. Start here unless there's a specific reason to self-host (data residency, S3 export, existing K8s investment).

Pricing is identical for both models — there is no cost penalty for Hybrid. The cost difference is operational burden (you manage the K8s cluster, Redis, and HA configuration).

The CSP deployment mode selection is not enforced: Choosing "Managed Service" on the form does not block a Hybrid deployment later. The selection is informational tracking only.

Alert Threshold vs. Budget Limit: The UI labels this field "Alter Threshold" (confirmed typo in the SCM UI). It maps to the underlying platform's alert threshold — when spend crosses this amount, the gateway raises an alert without blocking traffic. Requests are blocked only when the Budget Limit itself is reached. Recommend setting at 80% of the budget.

Rate limit of 0 disables the provider: If a workspace's rate limit is set to 0, that provider becomes unavailable to the workspace immediately. This is an easy mistake to make. Confirm the intent before the session.

Budget limits apply only to future requests: They are never retroactive. If a workspace has already spent $400 before a $500 budget is set, the budget tracks from $0 forward — it doesn't count the prior $400.

Cost-based budget expires the key: When a cost budget is exhausted, the key expires and further usage is blocked until the reset date. Token-based budgets block when the token count is reached. Both are hard stops — not alerts.

Service vs. User key: Service keys power backend applications and automations running unattended. User keys are personal credentials tied to an individual's identity. For CI/CD pipelines, backend services, and shared integrations: always Service. For developers accessing the gateway directly (e.g., Claude Code): User.

Least-privilege permissions: A customer support bot that only sends LLM prompts needs only Completions/Write. Granting all five permissions to every key is a common mistake. Match permissions to what the consuming application actually calls.

Key-level limits vs. workspace limits: Key-level limits are additive to workspace limits — the most restrictive limit wins. Use key-level limits for per-application guardrails within a workspace that has a shared budget.

Metadata tags: Encourage customers to add JSON metadata (e.g., {"app": "chatbot", "env": "prod"}) to every key. These tags appear in the Observability logs, making cost attribution and incident investigation far easier.