# Core Concepts

> Concept pages covering the Agent Gateway's architecture, protocols, identity model, access control, and federation.

Agentic workflows operate without a shared trust foundation across systems and organisations. The Agent Gateway provides that shared foundation: agent identity, scope management, and observability configured once and applied consistently. Your deployment gets a consistent, auditable governance layer from day one. [Architecture →](/products/affinidi-trust-fabric/agent-gateway/concepts/architecture.md)

The Agent Gateway is part of the [Affinidi Trust Fabric](https://www.affinidi.com/trust-fabric), a suite of products for decentralised identity management, scope governance, and trust in agentic AI systems.

## Deploy AI with confidence

Understand the routing primitives and the capabilities that make every LLM deployment safe, cost-accountable, and observable.

| Concept | What it explains |
| [Architecture](/products/affinidi-trust-fabric/agent-gateway/concepts/architecture.md) | How the gateway’s internal components fit together and how traffic flows through them. |
| [Surfaces](/products/affinidi-trust-fabric/agent-gateway/concepts/surfaces.md) | How developers visually design and manage agent interaction flows across protocols through a protocol-agnostic surface model. |
| [Surface routing model](/products/affinidi-trust-fabric/agent-gateway/concepts/surface-routing-model.md) | How Access Points, Targets, Transit Points, and Listeners define inbound and outbound traffic for one managed agent surface. |
| [Payments](/products/affinidi-trust-fabric/agent-gateway/concepts/payments.md) | How x402 payment policies enforce paid access, verification, and settlement before protected requests are forwarded. |
| [Dashboard](/products/affinidi-trust-fabric/agent-gateway/concepts/dashboard.md) | What the management dashboard shows, how to read its charts, and how to drill down from gateway-wide metrics to individual surfaces. |
| [Observability](/products/affinidi-trust-fabric/agent-gateway/concepts/observability.md) | How the gateway produces distributed traces, metrics, and logs for every request, what each in-dashboard monitoring tool shows, how to export telemetry to an OTLP-compatible backend, and how event notifications push alerts to external systems. |
## Make your agent enterprise-ready

Understand how every inbound agent receives a verified identity, how scope is applied, and how trust is delegated and audited across A2A workflows.

| Concept | What it explains |
| [Agent identity and DIDs](/products/affinidi-trust-fabric/agent-gateway/concepts/identity.md) | How the gateway derives a deterministic Decentralised Identifier (DID) for each unique agent configuration. |
| [Token exchange and ID-JAG](/products/affinidi-trust-fabric/agent-gateway/concepts/token-exchange.md) | How the gateway’s Security Token Service uses RFC 8693 OAuth 2.0 Token Exchange and ID-JAG to carry an already-verified identity across a gateway or service boundary. |
| [Credentials](/products/affinidi-trust-fabric/agent-gateway/concepts/credentials.md) | How the gateway stores and uses outbound delegated credentials to authenticate external calls on behalf of agents and users. |
| [Secrets](/products/affinidi-trust-fabric/agent-gateway/concepts/secrets.md) | How the gateway centralises sensitive values in an encrypted store and applies rotation or revocation everywhere they are referenced. |
| [Caller context binding](/products/affinidi-trust-fabric/agent-gateway/concepts/caller-context-binding.md) | How the gateway binds authenticated caller identity, generated agent identity, and request intent into a verifiable presentation that propagates through tool calls and audit logs. |
| [OPA policies](/products/affinidi-trust-fabric/agent-gateway/concepts/opa-policies.md) | How the gateway uses Open Policy Agent (OPA) and the Rego language for layered, declarative access control at the gateway, surface, and agent trust levels. |
| [Audit log](/products/affinidi-trust-fabric/agent-gateway/concepts/audit-log.md) | How the gateway records the governance audit events you select, keeps them in the VP Audit Log, and delivers them to Governance Audit integrations. |
## Build an ecosystem of agents

Understand how agent identities are portable across systems, how gateways federate across organisational boundaries, and how Gateway Connection routes traffic at ecosystem scale.

| Concept | What it explains |
| [Gateways](/products/affinidi-trust-fabric/agent-gateway/concepts/connections/gateways.md) | How gateway instances connect over encrypted tunnels and how Gateway Connection routes traffic across boundaries. |
| [Workload binding](/products/affinidi-trust-fabric/agent-gateway/concepts/workload-binding.md) | How the gateway attests the original caller’s identity in a signed VP that receiving gateways can verify and enforce policy against. |
| [Trust registries](/products/affinidi-trust-fabric/agent-gateway/concepts/connections/trust-registry.md) | How the gateway verifies agent credentials against an external trust registry and injects trust data into OPA policy evaluation. |
## Protocols

The gateway implements these open standard protocols. Not all are inbound surface protocols. DIDComm is the G2G federation transport and x402 is the payment layer.

| Concept | Used in | What it explains |
| [A2A](/products/affinidi-trust-fabric/agent-gateway/concepts/protocols/a2a.md) | Surfaces | Google Agent-to-Agent protocol: structured task execution between agents. |
| [MCP](/products/affinidi-trust-fabric/agent-gateway/concepts/protocols/mcp.md) | Surfaces | Model Context Protocol: tool, resource, and prompt serving for AI models. |
| [DIDComm](/products/affinidi-trust-fabric/agent-gateway/concepts/protocols/didcomm.md) | Gateway federation (G2G) | End-to-end encrypted messaging transport used for gateway-to-gateway federation. |
| [x402](/products/affinidi-trust-fabric/agent-gateway/concepts/protocols/x402.md) | Surface policy | HTTP-native payment protocol enabling on-chain micropayments between agents. |

## Pages in this section
- [Connections](/products/affinidi-trust-fabric/agent-gateway/concepts/connections.md)
- [Protocols](/products/affinidi-trust-fabric/agent-gateway/concepts/protocols.md)
- [Architecture](/products/affinidi-trust-fabric/agent-gateway/concepts/architecture.md): A high-level view of where Agent Gateway sits, how traffic flows through it, and how it helps you govern agent interactions.
- [Surfaces](/products/affinidi-trust-fabric/agent-gateway/concepts/surfaces.md): The primary configuration and runtime unit for managed agent traffic in Agent Gateway, unifying ingress, routing, identity, policy, and outbound capability.
- [Surface routing model](/products/affinidi-trust-fabric/agent-gateway/concepts/surface-routing-model.md): How Access Point, Target, Transit Point, and Listener work together as the routing model for one Agent Surface.
- [Caller context binding](/products/affinidi-trust-fabric/agent-gateway/concepts/caller-context-binding.md): How the gateway identifies each unique caller and isolates their delegated credentials from all other callers on the same surface.
- [Workload binding](/products/affinidi-trust-fabric/agent-gateway/concepts/workload-binding.md): How the gateway attests the original caller's verified identity in a signed VP that downstream gateways can verify and enforce policy against.
- [Agent identity and DIDs](/products/affinidi-trust-fabric/agent-gateway/concepts/identity.md): How the Agent Gateway derives a deterministic Decentralised Identifier for each agent, from request payload fields, a stored API key, or a validated JWT claim.
- [Token exchange and ID-JAG](/products/affinidi-trust-fabric/agent-gateway/concepts/token-exchange.md): How the gateway's Security Token Service uses RFC 8693 OAuth 2.0 Token Exchange and ID-JAG to carry an already-verified identity across a gateway or service boundary, without a fresh sign-in at every hop.
- [Credentials](/products/affinidi-trust-fabric/agent-gateway/concepts/credentials.md): How the gateway stores outbound delegated credentials and uses them to authenticate to external services on behalf of agents and users.
- [Secrets](/products/affinidi-trust-fabric/agent-gateway/concepts/secrets.md): How the gateway centralises sensitive values in an encrypted store and lets other configuration reference them safely.
- [OPA policies](/products/affinidi-trust-fabric/agent-gateway/concepts/opa-policies.md): How the Agent Gateway uses Open Policy Agent (OPA) and the Rego language for layered, declarative access control across gateway and surface policy layers.
- [Observability](/products/affinidi-trust-fabric/agent-gateway/concepts/observability.md): What telemetry the Agent Gateway produces, what each dashboard monitoring tool shows, how event notifications push alerts to external systems, and when to reach for each one.
- [Audit log](/products/affinidi-trust-fabric/agent-gateway/concepts/audit-log.md): How the Agent Gateway produces governance audit records for the events you select, what each audit event captures, how the VP Audit Log and Governance Audit integrations receive them, and how records tie to signed Verifiable Presentations.
- [Dashboard](/products/affinidi-trust-fabric/agent-gateway/concepts/dashboard.md): What the Agent Gateway management dashboard shows, how to read its stat cards and charts, and how to reach the Identities and Surfaces views from it.
- [Payments](/products/affinidi-trust-fabric/agent-gateway/concepts/payments.md): How Agent Gateway enforces paid access using x402 or MPP, and how admins configure verification and settlement controls.