A unified control layer that governs AI usage and safeguards sensitive data across every agent interaction — with verifiable identity, policy enforcement and full observability.
Every agent, person and organisation gets a verifiable identity at birth — before a single request is routed.
Built on self-sovereign identity: decentralised, user-held W3C credentials and DIDs. No central honeypot, no lock-in.
DIDComm tunnels and trust networks carry trust across orgs, clouds, protocols and borders — it travels with the agent.
It is the gateway — not an identity layer added on top of one. A single self-hosted binary owns the whole request path.
Design the path an agent travels, watch every call logged in real time, and hand the receiver proof of why each request was trusted, or refused.
How teams put Agent Gateway to work in real deployments — from authentication and telemetry to deployment, ecosystem connectivity and private networking.
Move beyond shared credentials to a scalable security model as your ecosystem grows.
Stronger security, cleaner access isolation.
Stream telemetry wherever your business needs it — no vendor lock-in.
Full observability on your terms.
Fully on-premises or hosted on Affinidi infrastructure — complete operational freedom.
Enterprise-grade security without compromise.
Enable dynamic, connected ecosystems for agents to discover and use tools.
A more connected ecosystem, less overhead.
VPC peering extends the Gateway securely into private environments.
Stronger security, low-latency connectivity.
Keep Entra or Okta as the source of truth for identity while the Gateway adds verifiable per-agent identity, policy enforcement and audit.
Enterprise identity you already trust, extended to agents.
Agent Gateway sits between your apps and agents and the AI backend services they rely on — MCP servers, databases and external actors — routing all AI traffic through one point.
One place to apply compliance, security and operational policies — instead of scattered SDK wrappers and bespoke middleware.
Native support for MCP, A2A, AP2 and emerging agentic protocols. Add new transports without re-architecting.
Drop-in deployment today, ready for next-generation agent meshes and cross-boundary orchestration tomorrow.
Six capabilities work together to give every agent interaction the right level of trust, visibility and control.
Visual, protocol-agnostic design layer. Compose flows by connecting endpoints, identity and validation rules — no manual schemas.
OpenTelemetry metrics, logs and traces into CloudWatch, Prometheus and Grafana. Tamper-evident, exportable audit records.
Defence-in-depth across transport, session and application layers. Validate OIDC tokens from providers like Entra and Okta, or pick what fits: mTLS, API keys, JWT or DID Auth.
Block requests early with expressive OPA policies. Fine-grained, agent-surface-level controls based on identity, claims and context.
Agents access external resources on a user’s behalf without exposing user credentials — with a transparent audit trail of who accessed what.
Every agent gets a cryptographic, portable identity at the point of communication — no agent-code changes. Backed by W3C DIDs and VCs.
Beyond routing and authentication, the Gateway applies cryptographic trust controls inline — the things a bolt-on identity layer can’t.
Every request carries a signed attestation binding the caller context, delegation actions and the actual policy decisions made — verifiable long after the call, not just a log entry.
Check an agent against external trust registries in the request path — is it recognised, is it authorised — and feed the result straight into policy.
Explore Trust RegistryGateway-to-gateway over encrypted DIDComm. Each side keeps its own policy and identity and verifies the caller’s signed identity on arrival — no shared IdP required.
Require and verify payment conditions in the request path before a call proceeds, using the open x402 standard.
The Gateway doesn’t replace your identity provider — it verifies its tokens and layers verifiable agent identity, policy and audit on top.
Validate inbound requests against any standard OAuth 2.0 / OIDC provider — Microsoft Entra ID (Azure AD), Okta and others — with per-surface JWT Bearer verification.
Tokens are verified at the Gateway against the provider’s published keys (JWKS, fetched and cached, or configured inline) — checking issuer, expiry and audience.
Turn a validated token claim (the Entra oid by default) into a stable, portable agent DID. It stays the same across token rotation and identical across every gateway in the fabric — with no agent-code changes.
Sign in to the management dashboard with SAML 2.0 single sign-on.
Agent Gateway pairs with two companion products that extend the same identity, policy and audit model end to end.
Where AI execution flows are governed and evaluated in real time.
Coming soon Secure agent-driven payments enabled through recognised standards.
Agent Gateway is in closed beta. Join the future of agentic AI governance.