A method for controlling access to a Cloud, wherein the method is implemented in a gateway, and wherein the method comprises: establishing an enterprise session and an Enterprise user key unique to an Enterprise user with the Enterprise user; establishing a cloud session and a cloud key unique to the gateway with the Cloud; keeping records of the enterprise session and the cloud session by mapping the Enterprise user key and the cloud key; receiving traffic from the Enterprise user, wherein the traffic carries the Enterprise user key; replacing the Enterprise user key with the cloud key, wherein the cloud key is generic to a plurality of Enterprise users which permits access to the Cloud; and sending the traffic to the Cloud, wherein the traffic from the Enterprise user is intended for a first destination, wherein the Cloud comprises a second destination different from the first destination, and wherein changing the first destination to the second destination is opaque to the Enterprise user, wherein the method further comprises applying a policy to the traffic prior to sending the traffic to the Cloud, wherein the policy is selected from a group consisting of: encryption, compression, optimization, traffic steering, traffic distribution, de-identification, and re-identification, evaluating the traffic based on information specific to the user, wherein the information specific to the user is selected from a group consisting of: user geographic location, user identity, user-group identity, user access type, user device type, and user-requested resource; and applying the policy on the traffic based on the results of the evaluation prior to sending the traffic to the Cloud. establishing an enterprise session and an Enterprise user key unique to an Enterprise user with the Enterprise user; establishing a cloud session and a cloud key unique to the gateway with the Cloud; keeping records of the enterprise session and the cloud session by mapping the Enterprise user key and the cloud key; receiving traffic from the Enterprise user, wherein the traffic carries the Enterprise user key; replacing the Enterprise user key with the cloud key, wherein the cloud key is generic to a plurality of Enterprise users which permits access to the Cloud; and sending the traffic to the Cloud, wherein the traffic from the Enterprise user is intended for a first destination, wherein the Cloud comprises a second destination different from the first destination, and wherein changing the first destination to the second destination is opaque to the Enterprise user, wherein the method further comprises applying a policy to the traffic prior to sending the traffic to the Cloud, wherein the policy is selected from a group consisting of: encryption, compression, optimization, traffic steering, traffic distribution, de-identification, and re-identification, evaluating the traffic based on information specific to the user, wherein the information specific to the user is selected from a group consisting of: user geographic location, user identity, user-group identity, user access type, user device type, and user-requested resource; and applying the policy on the traffic based on the results of the evaluation prior to sending the traffic to the Cloud. <EOS>