The current gold rush in generative AI has shifted from simple chat interfaces to agentic workflows. Developers are no longer content with models that just talk; they want models that act. This shift has propelled the Model Context Protocol (MCP) into the spotlight, offering a standardized way for AI agents to discover and interact with external tools. However, as companies move these agents from isolated prototypes to production environments, they are hitting a wall. The excitement of a model that can suddenly query a database or trigger a shipping label is quickly replaced by the anxiety of security teams asking who has access to what, how those credentials are stored, and what happens when a tool is called a million times in an hour.
The Governance Gap in Model Context Protocol
DoorDash operates at a scale where these theoretical concerns become immediate operational risks. Their environment now handles millions of tool calls every week, connecting more than 200 servers to a workforce of thousands of employees across 30 or more distinct agents and services. In this high-traffic ecosystem, the limitations of the MCP standard become apparent. While MCP successfully standardizes how an agent describes, discovers, and invokes a tool, it remains silent on the critical requirements of enterprise governance. It provides the language for the conversation but offers no framework for identity management, credential rotation, access revocation, or comprehensive audit logging.
To bridge this gap, DoorDash developed the Agent Gateway. Rather than forcing every individual service team to rebuild authentication and authorization logic for every new tool, DoorDash centralized these functions into a common platform layer. This architectural decision transformed the onboarding process for new MCP servers and tools into a task that takes only a few minutes. By routing all traffic through a central gateway, the company ensured that every single call is authenticated and authorized before it ever reaches the underlying tool. This centralization allows for structured event logging, which provides the organization with immediate visibility into audit trails and precise cost attribution for AI operations.
Engineering the Data and Control Planes
The true technical challenge of the Agent Gateway lies in the tension between security and agent performance. If an agent is exposed to hundreds of tools simultaneously, the quality of tool selection drops, and the risk of unauthorized function calls increases. DoorDash solved this by implementing a system of bundles and filters. Instead of a raw dump of all available capabilities, the gateway presents the agent with a curated bundle—a logical endpoint containing only the tools necessary for a specific task. Filters then further refine this list, ensuring that the agent only sees functions it is explicitly permitted to use. This physical limitation of the agent's choice set reduces unnecessary tool calls and prevents the model from attempting to access restricted features.
Under the hood, the system is split into a data plane and a control plane to maintain stability at scale. The data plane is powered by a Proxy that handles the heavy lifting of real-time requests. This Proxy manages authentication, performs permission checks, enforces rate limits, injects the necessary credentials, and forwards the request to the downstream MCP server while generating observability data. Parallel to this, the control plane consists of a Registry. The Registry serves as the single source of truth, storing metadata about agents, MCP servers, ownership, transmission settings, authentication methods, and the specific configurations for tool discovery and exposure.
Credential management was another primary target for centralization. In a naive implementation, agents might store vendor API keys or OAuth refresh tokens in their own environment variables or prompts, creating a massive security vulnerability. DoorDash moved these original credentials entirely out of the agent's reach and into the Agent Gateway. The gateway manages OAuth permissions as a complex triad involving the agent, the user, and the server. When a call is initiated, the gateway handles the authentication handshake, stores the resulting token in an encrypted state, and automatically injects that token into subsequent calls. This separation ensures that sensitive authentication data never enters the agent's execution environment.
To prevent the emergence of shadow AI—where developers bypass official channels to avoid bureaucratic friction—DoorDash prioritized the developer experience. They implemented a self-service UI and API that allows teams to register MCP servers, discover tools, and manage bundles without waiting for manual approval tickets. The guiding principle was simple: the standardized, governed path must be the path of least resistance. By making the Agent Gateway easier to use than a direct connection, DoorDash ensured that governance became a natural part of the workflow rather than a hurdle to be circumvented.
This shift toward a centralized gateway transforms the AI agent from a fragile script into a manageable enterprise asset, turning the chaos of hundreds of disparate tools into a controlled, observable utility.
