Skip to main content
Agents and users can bypass Inviolet by calling an LLM directly instead of through the governed path. Inviolet closes that gap at the network layer by integrating with your existing Secure Web Gateway (SWG) / CASB — in two directions:
  • Enforce (SWG — write): push a rule into the vendor that blocks direct LLM access, forcing traffic through Inviolet.
  • Observe (CASB — read): pull or receive the vendor’s egress logs so Inviolet sees bypass volume and attributes it to a user.

​
Read vs write

The same vendor appliance can be integrated either way, with very different cost and blast radius: Most teams start with observe (low risk, quick visibility) and add enforce where they want a hard block.

​
Vendor support

Cloudflare is the reference implementation, validated end to end (see its page for the full setup, including everything we learned). For the other vendors, the observe side connects via an API token today; enforce packs are delivered per engagement — contact us to scope one.

​
What you don’t need

You don’t have to route all traffic through Inviolet to prevent API bypass — the strongest control is credential isolation (agents never hold the LLM API key; they can only call via Inviolet). The SWG layer is complementary: it catches the human/browser case and enforces at the network for teams that want it.