# Managed Agent

> Field reference for the Managed Agent canvas node: endpoint routing, authentication, and the canvas elements that add networking, MCP tool policies, and identity injection to the pipeline.

The Managed Agent node defines the single upstream destination the gateway forwards traffic to. Every surface has exactly one Managed Agent. The properties panel covers endpoint routing and authentication. Policy enforcement, networking resilience, MCP tool access policies, Trust Check queries, and identity extraction each require a separate canvas element added to the surface. Reference pages for each element are linked from the canvas table below.

## Managed Agent node fields

These fields appear directly in the Managed Agent properties panel when you select the node on the canvas.

| Field | Type | Required | Default | Description |
| Endpoint Type | select | Yes | Direct URL | How the upstream destination is addressed. Options: Direct URL, via Gateway Connection, via MCP Proxy (MCP surfaces only), via A2A Proxy (A2A and AP2 surfaces only, requires copilot_integration feature flag). |
| Target Endpoint URL | string | Yes (Direct URL) | — | Full upstream URL. See [Endpoint schemes](#endpoint-schemes). |
| Gateway / Agent Surface on Gateway | select | Yes (via Gateway Connection) | — | Remote gateway and the agent surface on it to route to. Builds a fabric:// endpoint automatically. |
| MCP Proxy | select | Yes (via MCP Proxy) | — | MCP proxy to front this agent’s tools. Builds a proxy:// endpoint automatically. |
| A2A Proxy | select | Yes (via A2A Proxy) | — | A2A proxy backend for this surface. Builds an a2a-proxy:// endpoint automatically. |
| Display name | string | No | — | Cached name shown in the dashboard for fabric:// endpoints when the remote gateway is offline. |
| Target Authentication | select | No | None | Service-level credentials the gateway injects into requests forwarded to the target. Options: None, Bearer Token, Basic Auth, API Key, Custom. Not available on MCP Proxy or A2A Proxy endpoint types. |
| Send signed identity VP to target | bool | No | true | When enabled, the gateway signs and injects a Verifiable Presentation into each outbound request carrying the resolved agent identity and caller context. See [Identity element reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/identity.md). |

## Canvas elements on the Managed Agent

The following elements can be added to the surface from the element palette. Each appears as its own node on the canvas and attaches to the Managed Agent’s edges.

| Element | Description |
| Caller Context | Extracts caller authentication context from inbound callers (JWT, API key, DID Auth, mTLS). See [Caller Context element reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/caller-context.md). |
| Policy | OPA policy evaluation gate. Can be placed on the request or response edge. See [Policy element reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/opa-policies.md). |
| Rate Limit | Per-route or per-caller request rate limiting. See [Rate Limit element reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/networking.md#rate-limit-element). |
| Payment | x402 paywall (MCP and A2A surfaces only). See [Payment element reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/payment.md). |
| Identity | Extracts agent DID from inbound or outbound traffic for VP stamping. See [Identity element reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/identity.md). |
| Trust Check | Runs a TRQP authorisation or recognition query against a trust registry. See [Trust registry elements reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/trust-element.md#trust-check). |
| Trust Recorder | Writes agent-registration records into one or more trust registries. See [Trust registry elements reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/trust-element.md#trust-recorder). |
| Extension Validation | Requires and validates protocol extensions on requests (A2A / AP2 only). See [Protocol extension elements reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/protocol-extensions.md). |
| Extension Rules | Allows, strips, or rejects protocol extensions per URI (A2A / AP2 only). See [Protocol extension elements reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/protocol-extensions.md). |
| Metadata Injection | Injects custom request or response headers, extensions, or body fields. See [Metadata elements reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/metadata.md). |
| Metadata Extraction | Maps request headers into protocol metadata before downstream controls run. See [Metadata elements reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/metadata.md). |
| Credential Delegation | Injects outbound credentials for upstream calls. See [Outbound binding elements reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/outbound-binding.md). |
| Workload Binding | Binds managed-agent identity and caller context into the outbound VP for a Transit Point. See [Outbound binding elements reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/outbound-binding.md). |
| MCP Tools | Per-tool RBAC policies for MCP endpoints. See [MCP Tools element reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/mcp-tools.md). |
| Networking | Timeout, retry, circuit breaker, and traffic mirroring. See [Networking element reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/networking.md). |

## Endpoint schemes

| Scheme | Format | Use case |
| HTTPS | https://<host>:<port>/<path> | Standard HTTP/S upstream target. |
| Fabric | fabric://{gateway_id}/{surface_id} | Gateway-to-gateway routing through the fabric. |
| Proxy | proxy://{mcp_proxy_id} | Routes through a configured MCP proxy backend. Requires mcp_proxy_id. |
| A2A Proxy | a2a-proxy://{a2a_proxy_id} | Routes through a configured A2A proxy backend. Available on A2A and AP2 surfaces when the copilot_integration feature flag is enabled. |

## Related

- [Access Point reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/access-point.md): Inbound configuration and caller authentication.

- [Transit Points reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/transit-points.md): Agent-initiated outbound routes.

- [Trust registry elements reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/trust-element.md): Full field reference for Trust Check and Trust Recorder elements.

- [OPA policies concepts](/products/affinidi-trust-fabric/agent-gateway/concepts/opa-policies.md): How gateway and surface-level OPA policies are evaluated.