A gateway can centralize routing, TLS termination, request size limits, authentication checks, rate limiting, and observability. Domain authorization and business invariants should still be enforced by the service that owns the resource; gateway-only authorization can be bypassed by alternate paths.

Because a gateway is on many request paths, run redundant instances and make configuration changes safely. Define behavior when identity or policy services are unavailable. Cached authorization decisions require explicit freshness and revocation semantics.

Retries at the gateway can duplicate non-idempotent requests and multiply load. Propagate deadlines, correlation IDs, and safe error formats. Avoid exposing internal stack traces or topology to clients.