Skip to content
PromptGlassDocs

Gateway forward proxy

In forward-proxy mode the PromptGlass Gateway sits between users and AI services, the same way a corporate web proxy does. It decrypts and inspects TLS only for domains in the AI app catalog. Every other connection is tunneled byte-for-byte without decryption. That makes it the most complete sensor: it sees every AI app, browser or desktop, on managed devices, and it can redact or block inline.

How it works

Section titled “How it works”
client ──CONNECT chatgpt.com:443──▶ gateway
                                     │ domain in AI catalog?
                     yes ◀───────────┴───────────▶ no
   TLS terminate with enterprise CA            blind TCP tunnel
   parse request → detect → policy             (no inspection, no logging of content)
   re-encrypt to upstream

The gateway understands the request formats of the major AI web apps and APIs, including streaming responses (SSE and WebSocket), so it can pull out the prompt, attachments and model, rather than just recording that a URL was visited.

Send traffic to the gateway

Section titled “Send traffic to the gateway”
Section titled “Option 1: PAC file (recommended)”

Serve a PAC file that sends only AI domains to the gateway. The console generates one from the live catalog at https://<tenant>/api/v1/pac. Here is a trimmed example:

function FindProxyForURL(url, host) {
  var ai = [
    "chatgpt.com", "*.openai.com", "claude.ai", "*.anthropic.com",
    "gemini.google.com", "copilot.microsoft.com", "*.perplexity.ai",
    "chat.deepseek.com", "*.mistral.ai", "poe.com"
  ];
  for (var i = 0; i < ai.length; i++) {
    if (shExpMatch(host, ai[i])) {
      return "PROXY ai-gw.example.com:3128; PROXY ai-gw-b.example.com:3128";
    }
  }
  return "DIRECT"; // or your existing proxy
}

Push the PAC URL with Intune, Group Policy (AutoConfigURL), Jamf or Google Admin.

Option 2: Explicit proxy

Section titled “Option 2: Explicit proxy”

For servers, CI runners and developer tools:

Terminal window
export HTTPS_PROXY=http://ai-gw.example.com:3128
export NO_PROXY=localhost,127.0.0.1,.internal.example.com

Option 3: Behind your secure web gateway

Section titled “Option 3: Behind your secure web gateway”

If you already run Zscaler, Netskope or Palo Alto Prisma Access, forward only AI categories to PromptGlass. See SWG chaining.

Trust the gateway CA

Section titled “Trust the gateway CA”

Endpoints must trust the CA the gateway uses to re-sign AI domains. Deploy it as a trusted root (or intermediate) with your MDM. Some desktop apps pin certificates. The catalog marks those apps, and the gateway tunnels them without inspection while still recording metadata (who, which app, bytes and timing).

Configuration

Section titled “Configuration”
gateway:
  forwardProxy:
    enabled: true
    port: 3128
    caSecret: promptglass-gateway-ca
    inspect:
      catalogCategories: [generative-ai, ai-coding, ai-search, ai-image]
      extraDomains: [ai.internal-tool.example.com]
      neverInspect: [bank.example.com]           # wins over everything
    unknownAiDomains: log                         # log | block | coach
    upstreamProxy: http://zscaler-pse.example.com:80   # optional chaining
  identity:
    methods: [kerberos, ntlm, mtls-device-cert, extension-header]

Identity

Section titled “Identity”

The gateway attributes requests to users in this order: the identity header from the PromptGlass browser extension, Kerberos/NTLM proxy authentication, a device certificate (mTLS) mapped to the primary user, and finally an IP-to-user lookup from your SIEM or DHCP logs. Unattributed traffic is still inspected and enforced, and it is reported as unknown.

Verify

Section titled “Verify”
Terminal window
curl -x http://ai-gw.example.com:3128 https://chatgpt.com -o /dev/null -w '%{http_code}\n'
promptglass gateway status
promptglass events tail --sensor gateway