# Project and data plane management

> Operator guides for projects, gateways, and data planes in Tetrate Agent Router: create isolated projects, provision gateways, deploy data planes, and migrate runtimes.

Enterprise Tier

# Project and data plane management

  These guides cover creating isolated projects, provisioning the gateways that serve them, deploying the data planes that host those gateways, and moving runtimes between data planes without disruption. Models must be enabled in the organisation catalog before you can grant them to a project; that catalog work is covered in [Provision models and providers](/agent-router-enterprise/guides/operate-and-govern/provision-models-and-providers).

Three objects underpin every guide in this section. A short definition of each follows; the full treatment is in [Key concepts](/product-architecture/key-concepts#projects) and [Planes and core components](/product-architecture/planes-and-components).

- A **project** is the logical boundary that owns models, API keys, Model Context Protocol (MCP) servers and profiles, routing and policy, budgets, and members. It is also the isolation boundary: each project sees and serves only its own configuration.
- A **gateway** is a single inference endpoint (one customer-facing URL) provisioned by a data plane and mapped to exactly one project. By default a project gets one gateway when you select a data plane; on Enterprise you can optionally attach additional gateways for high availability (see [Gateway sets and DNS-level failover](/agent-router-enterprise/guides/operate-and-govern/project-and-data-plane-management/gateway-sets-and-dns-failover)). A project has no endpoint until at least one gateway is provisioned for it.
- A **data plane** is the layer, deployed in a Kubernetes cluster, that provisions and manages gateways. One data plane can host many gateways, and one management plane can manage many data planes.

Set up a project

  <Link to="/agent-router-enterprise/guides/operate-and-govern/project-and-data-plane-management/create-a-project" className="tare-nav-card">
    Create and delete a project
    Create the project with the wizard, granting members, models, and MCP servers in one pass—or delete a project when it is no longer needed.
  </Link>
  <Link to="/agent-router-enterprise/guides/operate-and-govern/project-and-data-plane-management/provision-a-gateway" className="tare-nav-card">
    Provision a gateway for a project
    Give the project a live inference URL by selecting a data plane, which provisions the project's gateway.
  </Link>
  <Link to="/agent-router-enterprise/guides/operate-and-govern/project-and-data-plane-management/manage-project-members" className="tare-nav-card">
    Manage project members and access
    Add members, assign roles, and keep project access separate from data-plane operations.
  </Link>
  <Link to="/agent-router-enterprise/guides/operate-and-govern/project-and-data-plane-management/issue-a-project-api-key" className="tare-nav-card">
    Issue a project-scoped API key
    Create a key that works only against one project's gateway.
  </Link>
  <Link to="/agent-router-enterprise/guides/operate-and-govern/project-and-data-plane-management/scope-mcp-to-a-project" className="tare-nav-card">
    Grant MCP servers and profiles to a project
    Scope MCP servers and profiles to a project under the same isolation as models.
  </Link>

Operate data planes

  <Link to="/agent-router-enterprise/guides/operate-and-govern/project-and-data-plane-management/deploy-a-data-plane" className="tare-nav-card">
    Deploy and register a data plane
    Provision a data plane, install its credential, and connect it to the management plane.
  </Link>
  <Link to="/agent-router-enterprise/guides/operate-and-govern/project-and-data-plane-management/manage-gateways-on-a-data-plane" className="tare-nav-card">
    Manage multiple gateways on a data plane
    Review the gateways a single data plane provisions and manages after projects select it.
  </Link>
  <Link to="/agent-router-enterprise/guides/operate-and-govern/project-and-data-plane-management/migrate-a-gateway" className="tare-nav-card">
    Migrate a gateway or upgrade its runtime
    Move a gateway between data planes, or upgrade it in place, without changing its URL.
  </Link>
  <Link to="/agent-router-enterprise/guides/operate-and-govern/project-and-data-plane-management/gateway-sets-and-dns-failover" className="tare-nav-card">
    Gateway sets and DNS-level failover
    Run a project on several like-configured gateways and fail over between them with customer-managed DNS.
  </Link>