Core Concepts
Agentic workflows operate without a shared trust foundation across systems and organisations. The Agent Gateway provides that shared foundation: agent identity, scope management, and observability configured once and applied consistently. Your deployment gets a consistent, auditable governance layer from day one. Architecture →
The Agent Gateway is part of the Affinidi Trust Fabric, a suite of products for decentralised identity management, scope governance, and trust in agentic AI systems.
Deploy AI with confidence
Understand the routing primitives and the capabilities that make every LLM deployment safe, cost-accountable, and observable.
| Concept | What it explains |
|---|---|
| Architecture | How the gateway’s internal components fit together and how traffic flows through them. |
| Surfaces | How developers visually design and manage agent interaction flows across protocols through a protocol-agnostic surface model. |
| Surface routing model | How Access Points, Targets, Transit Points, and Listeners define inbound and outbound traffic for one managed agent surface. |
| Payments | How x402 and MPP payment policies enforce paid access, verification, and settlement before protected requests are forwarded. |
| Dashboard | What the management dashboard shows, how to read its charts, and how to drill down from gateway-wide metrics to individual surfaces. |
| Observability | How the gateway produces distributed traces, metrics, and logs for every request, what each in-dashboard monitoring tool shows, how to export telemetry to an OTLP-compatible backend, and how event notifications push alerts to external systems. |
Make your agent enterprise-ready
Understand how every inbound agent receives a verified identity, how scope is applied, and how trust is delegated and audited across A2A workflows.
| Concept | What it explains |
|---|---|
| Agent identity and DIDs | How the gateway derives a deterministic Decentralised Identifier (DID) for each unique agent configuration. |
| Credentials | How the gateway stores and uses outbound delegated credentials to authenticate external calls on behalf of agents and users. |
| Secrets | How the gateway centralizes sensitive values in an encrypted store and applies rotation or revocation everywhere they are referenced. |
| Caller context binding | How the gateway binds authenticated caller identity, generated agent identity, and request intent into a verifiable presentation that propagates through tool calls and audit logs. |
| OPA policies | How the gateway uses Open Policy Agent (OPA) and the Rego language for layered, declarative access control at the gateway, surface, and agent trust levels. |
Build an ecosystem of agents
Understand how agent identities are portable across systems, how gateways federate across organisational boundaries, and how Gateway Connection routes traffic at ecosystem scale.
| Concept | What it explains |
|---|---|
| Gateways | How gateway instances connect over encrypted tunnels and how Gateway Connection routes traffic across boundaries. |
| Workload binding | How the gateway attests the original caller’s identity in a signed VP that receiving gateways can verify and enforce policy against. |
| Caller context binding | How the gateway scopes per-caller delegated credentials so each caller’s tokens remain isolated on a shared surface. |
| Trust registries | How the gateway verifies agent credentials against an external trust registry and injects trust data into OPA policy evaluation. |
Connections
Understand how trust and routing relationships are established across organisations and systems.
| Concept | What it explains |
|---|---|
| Trust registries | How the gateway verifies agent credentials against an external trust registry, and how trust registry data is injected into OPA policy evaluation. |
| Gateways | How gateway instances are identified, how they connect to each other, and how Gateway Connection routes traffic across boundaries. |
Use cases
Concrete scenarios that show how the gateway’s capabilities combine to address real operational and integration challenges.
| Use case | What it covers |
|---|---|
| Multi-client authentication | Assign isolated credentials per client, partner, or application and enforce route-level access control. |
| Your telemetry, your control | Export logs and metrics using OTLP-compatible pipelines to your preferred observability stack. |
| Deployment on your own terms | Run the gateway on-premises, in hosted infrastructure, or in air-gapped environments based on compliance posture. |
| Powering the MCP ecosystem | Enable agents to discover and retrieve tools dynamically via linked gateways or direct connections. |
| Private network connectivity | Route agent traffic to internal systems without exposing endpoints to the public internet. |
Protocols
The gateway implements these open standard protocols. Not all are inbound surface protocols. DIDComm is the G2G federation transport and x402 is the payment layer.
| Concept | Used in | What it explains |
|---|---|---|
| A2A | Surfaces | Google Agent-to-Agent protocol: structured task execution between agents. |
| MCP | Surfaces | Model Context Protocol: tool, resource, and prompt serving for AI models. |
| AP2 | Surfaces | Agent Payments Protocol: AI-driven payments with verifiable credential transformation. |
| DIDComm | Gateway federation (G2G) | End-to-end encrypted messaging transport used for gateway-to-gateway federation. |
| x402 | Surface policy | HTTP-native payment protocol enabling on-chain micropayments between agents. |
Glad to hear it! Please tell us how we can improve more.
Sorry to hear that. Please tell us how we can improve.
Thank you for sharing your feedback so we can improve your experience.