Reading room
DoorDash built a gateway to govern how enterprise AI agents use tools
DoorDash’s shared Agent Gateway places a governance layer between AI agents and the tools they invoke, combining identity checks, authorization, credential injection, tool selection, routing, rate limits and auditing. The analysis argues that MCP standardizes tool connection but does not decide which agents may act, whose credentials they use or how activity is monitored. DoorDash’s reported design separates a policy registry from a traffic-handling proxy and supports curated tool bundles for different workflows.
Editorial summary · Publisher article
What matters
- The gateway distinguishes authentication from authorization and can limit read-only access separately from actions that change data.
- It keeps vendor keys and OAuth refresh tokens away from agents through centralized credential management.
- DoorDash reports more than 200 registered MCP servers, over 30 agents and services, and millions of weekly tool calls.
- Planned work includes cryptographic agent identity, short-lived delegated credentials and task-specific tool discovery.
Context & caveats
- The article is an analysis based on publicly shared details and reports DoorDash’s own scale figures.
Why this made the edition
The piece offers detailed architecture and governance lessons for enterprise agent tooling, while clearly labeling its account as based on public information.
Source material