>
    Strata Copilot
    Configure the Prisma AIRS Guardrail
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma AIRS
    3. AI Gateway
    4. AI Gateway Guardrails
    5. Configure the Prisma AIRS Guardrail
    Download PDF
    Prisma AIRS

    Configure the Prisma AIRS Guardrail

    Table of Contents

    Configure the Prisma AIRS Guardrail

    Integrate AI Runtime Security API Intercept with AI Gateway as a Partner guardrail to apply deep LLM security inspection to all gateway traffic.
    Where Can I Use This?What Do I Need?
    • Prisma AIRS AI Gateway (Americas region)
    • AI Gateway activated
    • AI Runtime Security (API Intercept) activated with a deployment profile
    • A routing configuration to attach the guardrail to
    The Prisma AIRS guardrail connects AI Gateway to the Prisma AIRS AI Runtime Security API Intercept service. When the guardrail fires, AI Gateway forwards the request payload to API Intercept for deep inspection — including detection of prompt injection, sensitive data exfiltration, and custom threat signatures — before forwarding the request to the LLM provider. This integration requires a deployed AI Runtime Security profile and an API key generated from that profile.
    Configuration has three phases: (1) create the AI Runtime Security deployment profile and generate an API key, (2) register the provider integration in AI Gateway Admin Settings, and (3) create the Partner guardrail and attach it to a routing configuration.
    1. Create an AI Runtime Security (API Intercept) deployment profile.
      If you have not already done so, create a deployment profile for AI Runtime Security in Strata Cloud Manager and generate an API key for it. Record the API key and the deployment endpoint URL — you need both in the following steps.
    2. In Strata Cloud Manager, select AI SecurityAI GatewayAdmin SettingsPlugins.
    3. On the PANW Prisma AIRS plugin tile, click Configure.
    4. In API Endpoint, enter the AI Runtime Security API Intercept endpoint URL from your deployment profile.
    5. In API Key, enter the API key generated from the AI Runtime Security deployment profile.
    6. Click Save.
      If this step returns HTTP 401, verify that the API key matches the one in your AI Runtime Security deployment profile. If it returns HTTP 400, check for typos in the API endpoint URL — the value is not validated at save time.
    7. Select Security ServicesPolicies & ProfilesGuardrails and click Add Guardrail.
    8. For Guardrail Type, choose Partner, then select PANW Prisma AIRS Guardrail from the provider list.
    9. Configure the guardrail's security profile settings and action (Deny or Log Only), then click Save.
      Note the pg- prefixed ID assigned to the guardrail.
    10. Add the guardrail to a routing configuration's before_request_hooks array using its pg- ID. See Create a Guardrail for the JSON format.
    11. Click Commit to apply the configuration.

    © 2026 Palo Alto Networks, Inc. All rights reserved.