Spots 
An AI gateway is easy to justify to engineers and hard to justify to a security review. Engineers ask about throughput and failover. The review asks who can call which model, who approved that, where the prompt went, and whether you can prove any of it six months later.
Those questions are where the five gateways below actually differ, and they are what this comparison is organised around.
Bifrost: the most specific audit and isolation story of the five: HMAC-signed audit logs, row-level data access control between teams, SCIM 2.0. Open source on GitHub; the governance features are Enterprise.
LiteLLM: the widest provider coverage (140+) and the largest community, at the cost of a Postgres-and-Redis production topology.
Kong: one control plane for AI and non-AI traffic, if you already run Kong. Effectively Enterprise-only for enterprise needs.
Cloudflare: the only one that inspects prompt content in flight (DLP, guardrails). Account-scoped tokens complicate tenant isolation. Vercel: traces that never carry prompt content, and ZDR routing. Governance is metered per request. What "enterprise" changes about the question
For a small team, the free tier is the product. For an enterprise, the free tier is a trial. The tier you deploy is the paid one, and the interesting question is what it buys. Five requirements come up in almost every procurement review:
Identity. SSO against your IdP, and SCIM so that deprovisioning a leaver in Okta actually removes their gateway access. A shared dashboard password is not an answer.
Authorization. RBAC deep enough to express your org chart, and ideally row-level controls so a developer on one team cannot read another team's keys, prompts, or spend.
Auditability. A record of who changed which policy and when, retained long enough for an audit cycle, and exportable to the SIEM you already run.
An AI gateway is easy to justify to engineers and hard to justify to a security review.