# Agent enablement
An agent surface is the gateway’s primary configuration unit. It combines inbound routing, caller authentication, identity derivation, policy enforcement, and outbound call controls for one managed agent backend. Start with a starter guide to create a working surface for your protocol, then layer on access controls and policies.

| Guide | What you will achieve |
| [A2A surface starter](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/setup/a2a-surface-starter.md) | Build and deploy a Vertex A2A example agent, route A2A traffic through an Agent Gateway surface, and validate direct versus gateway-mediated calls. |
| [MCP surface starter](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/setup/mcp-surface-starter.md) | Create an MCP surface from a starter template, configure required fields, validate outbound routing, and save reusable templates. |
| [Expose a REST API as MCP tools](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/setup/expose-a-rest-api-as-mcp-tools.md) | Configure an MCP proxy that reads an OpenAPI specification and generates one MCP tool per REST endpoint, making any REST API accessible to MCP-compatible agents. |
| [Configure per-caller Credential Delegation](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/setup/configure-per-caller-credential-delegation.md) | Add a Credential Delegation element to a surface, bound to each caller’s Caller Context identity, so the gateway acquires and injects per-user OAuth tokens without exposing App credentials to callers. Works for any surface type and any OAuth 2.0 Authorization Code API; uses GitHub Copilot MCP as the sample target. |


## Pages in this section


- [A2A surface starter](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/setup/a2a-surface-starter.md): Clone the A2A Vertex AI sample agent, deploy it to Vertex AI Agent Engine, configure an Agent Gateway A2A surface with the deployment endpoint, and validate end-to-end A2A messaging.

- [MCP surface starter](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/setup/mcp-surface-starter.md): Create an MCP surface in the Agent Surface canvas, connect an MCP transit point through the gateway, and test routing with the correct URL pattern.

- [Expose a REST API as MCP tools](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/setup/expose-a-rest-api-as-mcp-tools.md): Register an MCP proxy that reads an OpenAPI specification and generates one MCP tool per REST endpoint, then optionally attach it to an MCP surface for authentication, policies, and observability.

- [Configure per-caller Credential Delegation](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/setup/configure-per-caller-credential-delegation.md): Add a Credential Delegation element to a surface so the gateway acquires and injects each caller's OAuth token after a one-time consent step. Works on any surface type with any OAuth 2.0 Authorization Code API. Uses GitHub Copilot MCP as the sample target.