There is a moment every platform team hits when an AI agent stops being a chatbot and starts being a problem. Not a conversation any more – an actor, invoking tools, calling out to other services, spending money, and doing it differently every single time. That shift, from something that talks to something that acts, is the reason the Agentic AI Foundation (AAIF) now has a piece of infrastructure to go with its protocols.

The AAIF – part of the Linux Foundation, launched at the end of 2025 with Anthropic’s Model Context Protocol (MCP), Block’s goose coding agent, and the AGENTS.md standard – has taken in its first new project since it opened, making agentgateway the foundation’s fourth hosted project. agentgateway is an open source proxy that sits in the middle of all that agent traffic and applies the controls a platform team already cares about: authentication, rate limiting, observability, routing, and governance. It was built by Solo.io, donated to the Linux Foundation in 2025, and has now moved under the AAIF’s umbrella.

To understand why a gateway is the piece that had to come next – and why it matters that this one is open rather than proprietary – I spoke to Manik Surtani, the AAIF’s CTO and co-founder, from a dark early-evening Sydney winter.

From goose to a foundation

Surtani is not new to any of this. His open source history runs back through JBoss in the mid-2000s, patches to MySQL and the Linux kernel, and a long stint at Red Hat that, as he puts it, is where he got steeped in open source culture in a really big way. He spent more than 12 years at the company that started as Square and became Block, latterly as its head of open source, remaking it as an open-source-first business.

The AAIF grew directly out of that work. Block had open sourced goose, and it was catching on – but adoption was running into a wall. He recalls:

We found that there was a lot of headwinds to people contributing back, and those headwinds were really around it not being in a neutral foundation. So, Stripe using it, and Databricks were using it, and Expedia we had a custom spin of it. It was really cool to see that people were doing this stuff with it. But they didn’t want to contribute their changes upstream because Block still owned the trademarks and the roadmap and everything else.

The fix was a neutral home. Surtani found that Anthropic was wrestling with the same question for MCP, reached out to a friend – David Soria Parra, MCP’s co-creator and now chair of the AAIF’s Technical Committee – and, with OpenAI joining and bringing a project of its own, they decided to build the foundation rather than hunt for an existing one that fit:

What’s the right sort of foundation for something like this? And the answer was we got to make our own.

What agentgateway actually does

Ask Surtani to describe the gateway in plain terms and he starts with position:

Agent Gateway is basically it has a number of functions. It sits between your agent, whether it’s an on device agent like on your laptop or a headless agent running somewhere in cloud, sits between the agent and the actual model that it’s using for intelligence. Now, it provides various capabilities to that, including authentication and rate limiting and billing and all of this stuff. But I think the most important thing that it provides is model independence. It makes it easy to switch from one model to the other, from a closed model to an open model. And I think that is probably the most powerful reason why it exists.

That emphasis on independence runs through everything else he says. First, though, the operational case, because it explains why old infrastructure patterns do not stretch to cover this.

As an analogy, think of an enterprise as a busy restaurant kitchen. The agents are cooks – and unlike a waiter who only takes orders, a cook acts: goes to the fridge, fires the grill, calls a supplier, asks another cook to plate up. With three cooks, it is fine. With thirty, all reaching into the same fridges and calling the same suppliers, it is chaos – nobody knows who took what, two cooks call the same supplier and double the bill, someone grabs an ingredient they should not have, and when the health inspector asks who touched a dish, there is no record. agentgateway is the pass: the single counter every order and every ingredient flows through, where each request is logged, routed, checked against what that cook is allowed to reach, and capped so no one supplier gets hammered.

agentgateway routes at the application layer, not the physical one – reading each request an agent makes and deciding, per call, which model or tool it reaches and whether it’s allowed. It’s what a network router does for packets, moved up to where agents talk. The insight the project is built on is that a platform team already built a pass, years ago, for its web and API traffic. It should not have to build a second one just for AI. Agent traffic runs through the same controls the team already knows.

Why old assumptions break

So what is different about an agent that stops the old patterns from working? Surtani says it is not really about volume:

It is the frequency of access. It is the changing nature of access because it’s hard to be prescriptive about what that access path looks like. It could be different every time, and your infrastructure needs to cope with that. It’s not like these set two or three patterns that are always happening at scale. So you know exactly how to tune for that. You can’t do that with agentic access. That’s the biggest one, really. It’s all dynamic.

The wider security industry has had some difficult wake-up calls to the word ‘dynamic’ this year. Old infrastructure assumed human-shaped access: authenticate a user, grant access, trust that decision until the next login. Agents don’t behave that way. They appear, act, and vanish in seconds, and they can hold credentials across many systems at once. The path they take gets decided at run time, not drawn up in advance. Security vendors call this behavior non-deterministic, and they’re moving toward per-action authorization and just-in-time credentials because the old static rules assumed a predictability that has gone. But if you strip away the vendor language, Surtani is saying the same thing. You cannot tune for a pattern that changes every time.

He is careful not to overclaim. Although fragmentation – different teams exposing different MCP servers, multiple model providers, authentication scattered across all of it – is part of the pain the gateway solves, Surtani agreed it centralizes that, but pushed back on calling it new:

It does. But to be honest, fragmentation has always been a problem in IT; it’s not new to agents. It’s just because agents are young and new right now. There is lots of fragmentation as it matures. I think that fragmentation in itself will get normalized, but the access patterns themselves being dynamic, I think is the big difference.

The trap that looks like convenience

One point I wanted to ask about was lock-in. The pitch a proprietary vendor makes is seductive: a shiny dashboard, guardrails, everything integrated and plugging straight in. Surtani thinks that is exactly the danger:

There will be vendors that will come in and show you some shiny. And very convenient and integrated, everything just plugs in. That I think is actually a trap. It’s really dangerous because then you do get locked into one vendor. The whole point of open standards and open protocols is so you can change things around, then you always have independence. But that comes at a cost. I mean, they will never be as seamless as something one vendor gives you. Won’t be as shiny, won’t be as perfect. But there’s value to having that independence, and sometimes you’ve got to push against some of the stuff that looks too convenient.

Surtani emphasizes that it may not be as shiny, but the critical point is who controls whether you can leave later. And he has watched it go wrong close to home. The Linux Foundation itself, he told me, nearly got caught:

We actually had a problem like that within the Linux Foundation itself. There was a vendor that was trying to give us a particular platform for agent governance and things like that. And it was all great, it was very shiny, and it worked really well for a lot of the non-technical people in the Linux Foundation. But it was all built on non-standard stuff. Complete lock in nightmare.

When the organization whose entire reason for existing is open governance can still find itself staring down a lock-in nightmare, the rest of us should probably take the risk seriously.

Trust is a promise; portability is a structure

A proprietary vendor can promise it will stay neutral and keep its pricing fair. What can a foundation structure guarantee that a promise cannot? Surtani’s answer is one of the best I’ve heard:

Trust in itself is a really hard thing to believe in because anyone can rescind it. Anyone can change their minds. So the only thing that works, that holds that trust true, is the ability to move. As long as there is complete independence, that no matter what they say, I can completely take my application for a relatively minimal cost and move it somewhere else. As long as that option is there, that’s going to hold people to their word. The moment that’s not there, I don’t believe in trust anymore.

Lock-in is the cost of leaving climbing high enough that you keep paying when you would rather walk. Open standards hold that cost down by design, so your agents speak open protocols like MCP and A2A (Agent-to-Agent), not a proprietary dialect, so you can put a different gateway in front of the same traffic without rewriting all of your code. Anyone who has signed a platform deal that felt magical at the start and then watched the renewal price double two years later, with the entire business now built on top of it, will know how wince-making that feeling is.

Security – the institution, not just the code

I wanted to know what the Linux Foundation puts around a project – OpenSSF, provenance, audits – that a vendor doing its own security behind closed doors cannot replicate. Surtani explains that ‘open’ is more than just a word:

I think being open itself is the structural element that keeps that honest. The fact that it is observable, is scrutinizable by everybody and constantly so. And you can demonstrate that you are performing all the necessary checks and the necessary security processes and practices around it. With a proprietary vendor, you don’t see that. They tell you they’re doing it. You have no guarantee what they’re actually doing. So that lack of openness is the structural bit that’s missing with a proprietary vendor.

The Linux Foundation houses the Open Source Security Foundation (OpenSSF), whose Chief Technology Officer and Chief Security Architect, Christopher “CRob” Robinson, has spent the past year warning that agentic AI is piling new pressure onto an already strained software supply chain. Two pieces of OpenSSF work focus directly on agent traffic. SAFE-MCP, run with the OpenID Foundation, catalogs more than 80 attack techniques against MCP-based systems in the style of MITRE ATT&CK, with named threats like tool poisoning and the “rug pull,” where a tool quietly changes its behavior after you have come to trust it. And a live proposal for OpenSSF’s Scorecard would add agent-specific checks – tool pinning, signed agent communications, cryptographic agent identity – the exact controls a gateway is meant to enforce. Underneath both sits the provenance layer: SLSA, which produces tamper-evident records of how an artifact was built, and Sigstore, which signs artifacts so anyone can verify nothing changed after the fact.

A proprietary vendor’s security is a private process you cannot see. The Foundation’s is out in the open, auditable by anyone, and running on the same machinery that guards the Linux kernel and Kubernetes – not a one-off effort bolted onto a single project.

On where agentgateway itself sits against that machinery, Surtani elaborates:

We’re still setting it up with regards to the Agentic AI Foundation, but I think they’re further along than any other random arbitrary project we bring in because they’ve already been a part of the LF [Linux Foundation] under a separate umbrella. So they actually joined as a top level project under the LF last year, and we only just brought them into the Agentic AI Foundation. So, we’re doing an audit, and we’re doing our own work to make sure everything still works as we expect and has the level of quality.

What to ask when the pitch arrives

agentgateway will not be the last of its kind. Asked what is next, Surtani mentioned that the category is about to get busier inside the Foundation itself:

That sort of category almost of agent gateways is a really hot space right now, and I am seeing a lot of activity there. I actually don’t know what the final shape of the perfect gateway is going to look like. It’s still too early to tell. The industry is early. We’re going to be announcing a few more gateway type things in the foundation very soon as well.

He is watching the field fill up in real time, and not all of it converges:

I am seeing gateways of all different shapes and sizes and colors coming out of the woodworks, but they all solve a slightly different thing.

Which is the whole case for keeping options open, in his words: “being flexible, really important right now.”

So agent gateways are coming to a vendor pitch near you, probably this quarter. Surtani’s advice for telling substance from shine is hands-on, built on the idea that everything should be instantly available for anyone to try:

I actually think give it a try and download it. That is probably the most important thing. I rely less on press release, marketing material. I just want to get my hands dirty. There is nothing quite like feeling it. It’s easy enough to set up and get going in a demo environment or a test environment. Get your hands dirty and try it.

He traces the instinct back to Block and to Jack Dorsey:

If you can’t feel it, I don’t want a demo. I don’t want a presentation. If I can’t feel it, I’m not interested.

It is a good test for a reader too. The gateway that lets you try it out in a test environment in fifteen minutes, without handing over a credit card first, is a signal about two things at once: its confidence, and how easily you could leave.

My Take

One of the standout points that Surtani made during our conversation is the split between two questions that often get muddled. Is this product better today? Will I still be able to operate it in three years?

He gave the shiny proprietary product its due – yes it may be more seamless, more polished, more convenient – but none of it touches the one guarantee that counts when circumstances change, which is the ability to move. Only governance can hand you the exit and let you keep it. That the Linux Foundation itself nearly got locked into a non-standard governance platform is the proof no one is immune to the shiny thing – sometimes it’s structure that saves you from your own worst procurement instincts.

With more gateways heading into the AAIF, I’ll be interested to see how a platform team picks among several open ones. Model independence is only as real as the day-to-day switching cost, but the security machinery is strong. Being able to download it, stand it up, and see whether you could walk away as easily as you arrived is the kind of test more buyers should be running, and few are.