Gateway reference
A gateway record represents either this Agent Gateway instance (the self gateway) or a remote Agent Gateway that this instance communicates with. Use this page to check which surfaces a remote gateway exposes, control which of your local surfaces that remote gateway can see, and attach a gateway-wide OPA policy that runs before any surface policy.
For conceptual background, see Gateways. For step-by-step connection setup, see Connect two gateways.
Overview tab fields
| Setting | Required | Editable | Description |
|---|---|---|---|
| Name | Yes | Yes | Human-readable display name for the gateway. |
| Description | No | Yes | Optional description of the gateway’s purpose. |
| Gateway DID | Yes | No | The DID that identifies this gateway instance. Cannot be changed after creation. |
| Gateway ID | — | No | Internal identifier. Used in fabric:// target URLs and API calls. |
| Gateway Enabled | No | Yes (remote only) | Toggle to enable or disable the gateway. The self gateway cannot be disabled. |
| Created | — | No | When this gateway record was created. Shown in edit mode. |
| Last Updated | — | No | When this gateway record was last modified. Shown in edit mode. |
The self gateway’s DID is generated automatically at first startup. It cannot be changed. If you need a different DID, you must reinitialise the gateway.
On a remote gateway record, a Connection failed alert appears above the fields whenever none of the gateway’s connection points is currently connected. It shows the failure reason, the next scheduled retry time, the number of consecutive failed attempts since the connection was last healthy, an expandable Error details section, and when the gateway was last active. This is a roll-up of the gateway’s own connection points: it reports a connected connection point if any exists, otherwise the first unhealthy one. See Connection Health for the full status vocabulary and how to retry a connection manually. This alert never appears on the self gateway.
Remote tab
Lists the surfaces available on the remote gateway. This tab is visible only on remote gateway records.
| Column | Description |
|---|---|
| Name | Display name of the remote surface. |
| Description | Optional description from the remote gateway. |
| Protocol | Protocol declared on the remote surface: A2A or MCP. |
| Listen Address | The network address the remote surface listens on. |
| Surface ID | Internal identifier of the remote surface. Used when selecting a target in the Gateway routing mode. |
Select Refresh to query the remote gateway for an updated surface list.
Publishing tab
Visible only on remote gateway records in edit mode. Controls which local surfaces are visible to this remote gateway when it queries for available surfaces.
| Setting | Description |
|---|---|
| Surface checkboxes | Each active surface on this gateway appears as a checkbox. Check a surface to expose it to this remote gateway. |
When no surfaces are checked, all active surfaces are exposed. When one or more surfaces are checked, only those surfaces are visible to the remote gateway.
Integrations tab
Available on all gateway records in edit mode. Configure integrations that fire on gateway management events, so an external system such as email, Slack, a webhook, or a streaming platform is notified when something happens to this gateway, using category Gateway.
An expandable About Gateway Integrations panel lists the supported event types for this category and the runtime variables available to populate integration templates. See Integrations reference for the field-level reference for each integration type and the full runtime-variable list.
Select Save Integrations to apply changes.
Global Policy tab
The Global Policy tab is available on all gateway records in edit mode. The direction of enforcement differs by gateway type:
- Self gateway: the policy applies to all inbound traffic arriving at this gateway instance, before any surface-level policy runs.
- Remote gateway: the policy applies to all outbound traffic sent to that remote gateway, before any surface-level policy runs.
In both cases, a gateway deny cannot be overridden by a surface allow.
This tab assigns policies to this one gateway record only. To enforce a policy definition across every gateway (or every surface) on the appliance at once, use appliance-wide enforcement instead; see Appliance-wide (global) policy enforcement.
| Setting | Description |
|---|---|
| Enabled | Toggle on to activate the policy. When disabled, the policy definition is retained but not evaluated. |
| Select Gateway Policy | The gateway policy definition to apply. Selected from the dropdown. Create and manage definitions from the sidebar’s Policies page. |
| Additional policies | Optional deny-overriding policies, layered on top of the primary policy above. Shown once Enabled is on and at least one other gateway policy definition exists. |
When the dropdown is empty, no gateway policy definitions of type gateway exist yet. Select the link in the empty-state message to create one.
A read-only policy preview is shown below the dropdown once a policy is selected.
Every policy checked under Additional policies must independently allow the request; a deny from any one of them blocks the request even if the primary policy and every other additional policy allow it. The list only offers policies other than the one currently selected as the primary policy, and shows a plain message when none are available.
Select Save Policy to apply the primary and additional policy selections. No restart is required.
Related
- Connection point: Field reference for the connection point editor.
- Gateways: Conceptual overview of gateway types and connection points, including
fabric://routing. - Integrations reference: Field-level reference for integration types, event categories, and runtime variables.
- OPA policies: How gateway and surface-level OPA policies evaluate requests.
Glad to hear it! Please tell us how we can improve more.
Sorry to hear that. Please tell us how we can improve.
Thank you for sharing your feedback so we can improve your experience.