# Surfaces

| Reference | What it covers |
| [Surface reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/surface-reference.md) | Top-level AgentSurface panel fields, protocol options, gateway DID injection settings, and the canvas element index. |
| [Access Point](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/access-point.md) | Inbound listener: panel settings (surface prefix, custom path, A2A protocol) and canvas elements (policy, rate limit, caller context, identity, trust check, extension validation, metadata). |
| [Managed Agent](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/managed-agent.md) | Upstream destination: endpoint routing and authentication. |
| [Transit Points](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/transit-points.md) | Agent-initiated outbound routes: transit point panel settings and canvas elements for per-destination policy, rate limiting, and payment. |
| [Variants](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/variants.md) | Named surface snapshots: alias grammar, canvas configuration, and default variant promotion. |
| [Caller Context](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/caller-context.md) | Authentication method selection and per-method credential extraction configuration. |
| [Identity](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/identity.md) | Agent DID extraction at inbound, protected, external, or outbound pipeline edges. |
| [Networking](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/networking.md) | Request control: timeouts, automatic retry, circuit breaking, traffic mirroring, and the Rate Limit canvas element. |
| [Per-tool policy bindings](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/mcp-proxy-tool-policies.md) | Per-tool RBAC policy bindings for a Managed Agent targeting an MCP Proxy, on the node labelled MCP Proxy. |
| [MCP Tool Gating](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/mcp-tool-gating.md) | Regex and condition-based allow/deny firewall over MCP tool names, distinct from the per-tool RBAC bindings above. |
| [Payment](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/payment.md) | x402 or MPP paywall configuration for MCP and A2A surfaces. |
| [Trust elements](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/trust-element.md) | Trust Check and Trust Recorder elements: TRQP queries, template syntax, result wire shape, error codes, and trust registry writes. |
| [OPA policies](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/opa-policies.md) | The Policy element and the complete input field reference for gateway, surface, and MCP tool policy scopes. |
| [Protocol extensions](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/protocol-extensions.md) | Extension Validation and Extension Rules elements for A2A surfaces. |
| [Metadata elements](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/metadata.md) | Metadata Injection and Metadata Extraction elements: header manipulation and protocol metadata normalisation. |
| [Outbound binding](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/outbound-binding.md) | Credential Delegation and Workload Binding elements: outbound credential injection and VP binding. |

## Pages in this section
- [Surface reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/surface-reference.md): Field reference for the top-level AgentSurface configuration.
- [Access Point](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/access-point.md): Field reference for the Access Point panel settings and canvas elements: the inbound configuration of an Agent Surface.
- [Managed Agent](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/managed-agent.md): Field reference for the Managed Agent canvas node: endpoint routing, authentication, and the canvas elements that add networking, MCP tool policies, and identity injection to the pipeline.
- [Transit Points](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/transit-points.md): Field reference for Transit Points: panel settings and canvas elements for agent-initiated outbound routes on an Agent Surface.
- [Variants](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/variants.md): Field reference for Surface Variants: named surface snapshots selectable at request time via `$alias`.
- [Caller Context element](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/caller-context.md): Field reference for the Caller Context canvas element: authentication method selection and per-method credential extraction configuration.
- [Identity element](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/identity.md): Field reference for the Identity canvas element: agent DID extraction at inbound, protected, external, or outbound pipeline edges for VP stamping.
- [Networking elements](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/networking.md): Field reference for the Networking and Rate Limit canvas elements: request and connection timeouts, automatic retry, circuit breaking, traffic mirroring, and per-surface request throttling.
- [MCP Tool Gating element](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/mcp-tool-gating.md): Field reference for the MCP Tool Gating firewall element: allow/deny gates that match MCP tool names by regex pattern, with an optional OPA condition and a configurable default policy.
- [Per-tool policy bindings](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/mcp-proxy-tool-policies.md): Field reference for per-tool OPA policy bindings on an MCP Proxy hop, configured from the Managed Agent's via MCP Proxy endpoint rather than a standalone canvas element.
- [Payment element](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/payment.md): Field reference for the Payment canvas element: x402 or MPP paywall configuration for MCP and A2A surfaces.
- [Trust elements](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/trust-element.md): Field reference for the Trust Check and Trust Recorder canvas elements: TRQP verification queries against trust registries, and writing agent-registration records into trust registries.
- [Protocol extension elements](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/protocol-extensions.md): Field reference for the Extension Validation and Extension Rules canvas elements: require protocol extension URIs on inbound A2A requests, and control per-URI pass-through, stripping, or rejection.
- [Metadata elements](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/metadata.md): Field reference for the Metadata Injection and Metadata Extraction canvas elements: inject fixed key/value pairs into headers or protocol extensions, and map HTTP headers into protocol metadata.
- [Outbound binding elements](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/outbound-binding.md): Field reference for the Credential Delegation and Workload Binding canvas elements: attaching cached OAuth or API key tokens to outbound calls, and binding managed-agent identity and caller context into outbound Verifiable Presentations.
- [OPA policies reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/opa-policies.md): Complete reference for OPA policy configuration in the Agent Gateway: the Policy canvas element, policy scopes, and the full input object available to Rego rules.