# Core Concepts

> Concept pages covering the Agent Gateway's architecture, protocols, identity model, access control, and federation.
Agentic workflows operate without a shared trust foundation across systems and organisations. The Agent Gateway provides that shared foundation: agent identity, scope management, and observability configured once and applied consistently. Your deployment gets a consistent, auditable governance layer from day one. [Architecture →](/products/affinidi-trust-fabric/agent-gateway/concepts/architecture.md)

The Agent Gateway is part of the [Affinidi Trust Fabric](https://www.affinidi.com/trust-fabric), a suite of products for decentralised identity management, scope governance, and trust in agentic AI systems.

### Deploy AI with confidence

Understand the routing primitives and the capabilities that make every LLM deployment safe, cost-accountable, and observable.

| Concept | What it explains |
| [Architecture](/products/affinidi-trust-fabric/agent-gateway/concepts/architecture.md) | How the gateway’s internal components fit together and how traffic flows through them. |
| [Surfaces](/products/affinidi-trust-fabric/agent-gateway/concepts/surfaces.md) | How developers visually design and manage agent interaction flows across protocols through a protocol-agnostic surface model. |
| [Surface routing model](/products/affinidi-trust-fabric/agent-gateway/concepts/surface-routing-model.md) | How Access Points, Targets, Transit Points, and Listeners define inbound and outbound traffic for one managed agent surface. |
| [Payments](/products/affinidi-trust-fabric/agent-gateway/concepts/payments.md) | How x402 and MPP payment policies enforce paid access, verification, and settlement before protected requests are forwarded. |
| [Dashboard](/products/affinidi-trust-fabric/agent-gateway/concepts/dashboard.md) | What the management dashboard shows, how to read its charts, and how to drill down from gateway-wide metrics to individual surfaces. |
| [Observability](/products/affinidi-trust-fabric/agent-gateway/concepts/observability.md) | How the gateway produces distributed traces, metrics, and logs for every request, what each in-dashboard monitoring tool shows, how to export telemetry to an OTLP-compatible backend, and how event notifications push alerts to external systems. |
### Make your agent enterprise-ready

Understand how every inbound agent receives a verified identity, how scope is applied, and how trust is delegated and audited across A2A workflows.

| Concept | What it explains |
| [Agent identity and DIDs](/products/affinidi-trust-fabric/agent-gateway/concepts/identity.md) | How the gateway derives a deterministic Decentralised Identifier (DID) for each unique agent configuration. |
| [Credentials](/products/affinidi-trust-fabric/agent-gateway/concepts/credentials.md) | How the gateway stores and uses outbound delegated credentials to authenticate external calls on behalf of agents and users. |
| [Secrets](/products/affinidi-trust-fabric/agent-gateway/concepts/secrets.md) | How the gateway centralizes sensitive values in an encrypted store and applies rotation or revocation everywhere they are referenced. |
| [Caller context binding](/products/affinidi-trust-fabric/agent-gateway/concepts/caller-context-binding.md) | How the gateway binds authenticated caller identity, generated agent identity, and request intent into a verifiable presentation that propagates through tool calls and audit logs. |
| [OPA policies](/products/affinidi-trust-fabric/agent-gateway/concepts/opa-policies.md) | How the gateway uses Open Policy Agent (OPA) and the Rego language for layered, declarative access control at the gateway, surface, and agent trust levels. |
### Build an ecosystem of agents

Understand how agent identities are portable across systems, how gateways federate across organisational boundaries, and how Gateway Connection routes traffic at ecosystem scale.

| Concept | What it explains |
| [Gateways](/products/affinidi-trust-fabric/agent-gateway/concepts/connections/gateways.md) | How gateway instances connect over encrypted tunnels and how Gateway Connection routes traffic across boundaries. |
| [Workload binding](/products/affinidi-trust-fabric/agent-gateway/concepts/workload-binding.md) | How the gateway attests the original caller’s identity in a signed VP that receiving gateways can verify and enforce policy against. |
| [Caller context binding](/products/affinidi-trust-fabric/agent-gateway/concepts/caller-context-binding.md) | How the gateway scopes per-caller delegated credentials so each caller’s tokens remain isolated on a shared surface. |
| [Trust registries](/products/affinidi-trust-fabric/agent-gateway/concepts/connections/trust-registry.md) | How the gateway verifies agent credentials against an external trust registry and injects trust data into OPA policy evaluation. |
### Connections

Understand how trust and routing relationships are established across organisations and systems.

| Concept | What it explains |
| [Trust registries](/products/affinidi-trust-fabric/agent-gateway/concepts/connections/trust-registry.md) | How the gateway verifies agent credentials against an external trust registry, and how trust registry data is injected into OPA policy evaluation. |
| [Gateways](/products/affinidi-trust-fabric/agent-gateway/concepts/connections/gateways.md) | How gateway instances are identified, how they connect to each other, and how Gateway Connection routes traffic across boundaries. |
## Use cases

Concrete scenarios that show how the gateway’s capabilities combine to address real operational and integration challenges.

| Use case | What it covers |
| [Multi-client authentication](/products/affinidi-trust-fabric/agent-gateway/concepts/use-cases/multi-client-authentication.md) | Assign isolated credentials per client, partner, or application and enforce route-level access control. |
| [Your telemetry, your control](/products/affinidi-trust-fabric/agent-gateway/concepts/use-cases/telemetry-control.md) | Export logs and metrics using OTLP-compatible pipelines to your preferred observability stack. |
| [Deployment on your own terms](/products/affinidi-trust-fabric/agent-gateway/concepts/use-cases/deployment-on-your-own-terms.md) | Run the gateway on-premises, in hosted infrastructure, or in air-gapped environments based on compliance posture. |
| [Powering the MCP ecosystem](/products/affinidi-trust-fabric/agent-gateway/concepts/use-cases/powering-mcp-ecosystem.md) | Enable agents to discover and retrieve tools dynamically via linked gateways or direct connections. |
| [Private network connectivity](/products/affinidi-trust-fabric/agent-gateway/concepts/use-cases/private-network-connectivity.md) | Route agent traffic to internal systems without exposing endpoints to the public internet. |
## Protocols

The gateway implements these open standard protocols. Not all are inbound surface protocols. DIDComm is the G2G federation transport and x402 is the payment layer.

| Concept | Used in | What it explains |
| [A2A](/products/affinidi-trust-fabric/agent-gateway/concepts/protocols/a2a.md) | Surfaces | Google Agent-to-Agent protocol: structured task execution between agents. |
| [MCP](/products/affinidi-trust-fabric/agent-gateway/concepts/protocols/mcp.md) | Surfaces | Model Context Protocol: tool, resource, and prompt serving for AI models. |
| [AP2](/products/affinidi-trust-fabric/agent-gateway/concepts/protocols/ap2.md) | Surfaces | Agent Payments Protocol: AI-driven payments with verifiable credential transformation. |
| [DIDComm](/products/affinidi-trust-fabric/agent-gateway/concepts/protocols/didcomm.md) | Gateway federation (G2G) | End-to-end encrypted messaging transport used for gateway-to-gateway federation. |
| [x402](/products/affinidi-trust-fabric/agent-gateway/concepts/protocols/x402.md) | Surface policy | HTTP-native payment protocol enabling on-chain micropayments between agents. |


## Pages in this section

- [Connections](/products/affinidi-trust-fabric/agent-gateway/concepts/connections.md)

- [Use cases](/products/affinidi-trust-fabric/agent-gateway/concepts/use-cases.md)

- [Protocols](/products/affinidi-trust-fabric/agent-gateway/concepts/protocols.md)


- [Architecture](/products/affinidi-trust-fabric/agent-gateway/concepts/architecture.md): A high-level view of where Agent Gateway sits, how traffic flows through it, and how it helps you govern agent interactions.

- [Surfaces](/products/affinidi-trust-fabric/agent-gateway/concepts/surfaces.md): The primary configuration and runtime unit for managed agent traffic in Agent Gateway, unifying ingress, routing, identity, policy, and outbound capability.

- [Surface routing model](/products/affinidi-trust-fabric/agent-gateway/concepts/surface-routing-model.md): How Access Point, Target, Transit Point, and Listener work together as the routing model for one Agent Surface.

- [Caller context binding](/products/affinidi-trust-fabric/agent-gateway/concepts/caller-context-binding.md): How the gateway identifies each unique caller and isolates their delegated credentials from all other callers on the same surface.

- [Workload binding](/products/affinidi-trust-fabric/agent-gateway/concepts/workload-binding.md): How the gateway attests the original caller's verified identity in a signed VP that downstream gateways can verify and enforce policy against.

- [Agent identity and DIDs](/products/affinidi-trust-fabric/agent-gateway/concepts/identity.md): How the Agent Gateway derives a deterministic Decentralised Identifier for each agent, from request payload fields, API keys, mTLS certificates, JWT claims, or a static DID configured on the surface.

- [Credentials](/products/affinidi-trust-fabric/agent-gateway/concepts/credentials.md): How the gateway stores outbound delegated credentials and uses them to authenticate to external services on behalf of agents and users.

- [Secrets](/products/affinidi-trust-fabric/agent-gateway/concepts/secrets.md): How the gateway centralises sensitive values in an encrypted store and lets other configuration reference them safely.

- [OPA policies](/products/affinidi-trust-fabric/agent-gateway/concepts/opa-policies.md): How the Agent Gateway uses Open Policy Agent (OPA) and the Rego language for layered, declarative access control across gateway and surface policy layers.

- [Observability](/products/affinidi-trust-fabric/agent-gateway/concepts/observability.md): What telemetry the Agent Gateway produces, what each dashboard monitoring tool shows, how event notifications push alerts to external systems, and when to reach for each one.

- [Dashboard](/products/affinidi-trust-fabric/agent-gateway/concepts/dashboard.md): What the Agent Gateway management dashboard shows, how to read its charts, and how to drill down from gateway-wide metrics to individual surfaces.

- [Payments](/products/affinidi-trust-fabric/agent-gateway/concepts/payments.md): How Agent Gateway enforces paid access using x402, and how admins configure verification and settlement controls.