Agent Gateway

A control layer for agentic AI

Agent Gateway empowers businesses with a unified control layer that governs AI usage and safeguards sensitive data across every agent interaction. As organisations scale to multi‑team, cross‑boundary agent swarms, it answers the when, who, what and why of every agentic flow.

Request Early Access See Capabilities

Where it fits

A single enforcement point for agentic traffic

Agent Gateway is deployed between your applications and agents and the AI backend services they rely on (MCP servers, databases, external actors and beyond), routing all AI traffic through a single point.

It acts as a unified enforcement point for compliance, security and operational policies, and evolves with emerging architectures, supporting next‑generation protocols and agent‑to‑agent interactions.

Single enforcement point

One place to apply compliance, security and operational policies, instead of scattered SDK wrappers and bespoke middleware.

Protocol-native

Native support for MCP, A2A, AP2 and emerging agentic protocols. Add new transports without re-architecting.

Evolves with the stack

Drop-in deployment today, ready for next-generation agent meshes and cross-boundary orchestration tomorrow.

Core capabilities

What the Gateway does

Six capabilities work together to give every agent interaction the right level of trust, visibility, and control.

Agent Flow Builder

Visual, protocol-agnostic design layer. Compose flows by connecting endpoints, identity and validation rules, with no manual schemas. Works across MCP, A2A, AP2 and beyond.

Visual builder
MCP
A2A
AP2

Observability

OpenTelemetry metrics, logs and traces into CloudWatch, Prometheus and Grafana. Demonstrate who acted, under what authority, and with what impact through tamper-evident, exportable audit records.

OpenTelemetry
CloudWatch
Prometheus
Grafana
Audit trails
Traceability

Multi-client authentication

Defense-in-depth across transport, session and application layers. Pick what fits: mTLS, API keys, JWT assertions or DID Auth.

mTLS
API keys
JWT
DID Auth

Policy enforcement

Block requests early with expressive OPA policies. Fine-grained, agent surface level controls for users and tools (e.g. MCP), based on identity, claims and context.

OPA
Agent surface
Identity-aware

Credential delegation

Credential delegation lets agents access external resources on a user's behalf without exposing user credentials. The Gateway centrally manages authentication, authorisation, and credential use, while keeping a transparent audit trail of who accessed what, through which agent, and for what purpose.

Delegation
Auditable access
Sensitive data isolation

Verifiable agent identity

Every agent gets a cryptographic, portable identity at the point of communication, with no agent-code changes. Backed by W3C DIDs and Verifiable Credentials, verifiable by any receiving party.

W3C DID
Verifiable Credentials
Portable
No code changes

How it works

How the Gateway evaluates every request

All agentic traffic routes through one enforcement point, and the four W checks below show how each action is evaluated against a single, versioned policy surface.

Applications & Agents

Operator Agents

Internal teams

Customer Apps

Web & mobile

Partner Agents

Buyers / vendors

Agent Swarms

Multi-team flows

Unified enforcement point

Compliance
Security
Operational policy
Audit & observability

AI Backend Services

MCP servers

Tools & capabilities

Databases

Vector & relational

External actors

Third-party APIs

When

Is this action allowed right now, given session state, rate limits and business hours?

Who

Which operator, agent or partner is calling, and what verified credentials do they hold?

What

Which tool, dataset or service is being accessed, and with what payload and scope?

Why

Is the business purpose declared, logged and consistent with policy and consent?

Use cases

Practical applications across your stack

How teams put Agent Gateway to work in real deployments, from authentication and telemetry to deployment, ecosystem connectivity and private networking.

As your ecosystem grows, Agent Gateway helps you move beyond shared credentials to a scalable security model.

Assign unique API keys per client or partner
Protect specific routes and services with precision
Support multiple authentication headers, especially in MCP environments

Outcome The result: stronger security, cleaner access isolation, and the flexibility to scale without friction.

For developers

Interoperable by design

Trust Fabric acts as an intercepting proxy for AI agent traffic, with configurable channels, policy enforcement, observability, and multi-hop routing across frameworks, clouds, and trust boundaries.

Get started on GitHub

Clone the Affinidi Labs starter to spin up a Trust Gateway, wire up sample agents, and explore policy examples end to end.

View on GitHub

Deep-dive documentation

Architecture guides, API references, deployment recipes, and step-by-step tutorials.

View documentation

Explore the suite

The rest of the Affinidi Trust Fabric

Agent Gateway pairs with two companion products that extend the same identity, policy and audit model end to end.

Where AI execution flows are governed and evaluated in real time.

Unified execution layer across models, tools, and databases
Continuous evaluation and intelligent routing across providers with optimisation and failover
Built-in safeguards enforcing policy, safety, and output integrity at every step

Coming soon

Where AI transactions are governed, verified, and settled in real time.

Enforce payment conditions before access or execution proceeds
Verify payment proofs and handle settlement under policy
Support payment policies using protocols such as x402 and MPP

Coming soon

Get started

Ready to take control?

Agent Gateway is in closed beta. Join the future of agentic AI governance.

Join our Early Access

Request Early Access

Book a Demo

Discuss pilot scope, compliance needs, and deployment topology with our team.

Book A Demo

Explore the docs

See deployment guides, API references, and sample code.

View Documentation