An API gateway has accumulated authentication, rate limiting, routing, response transformation, request validation and some business logic. Which of these belong there?

What belongs

Cross-cutting concerns that are identical for every service and that benefit from being enforced once:

• Authentication — verifying the caller's identity, ideally by validating a signed token locally rather than calling an identity service per request.
• Rate limiting and quota enforcement, per tenant and per cost class, which must be applied before a request consumes a backend resource.
• Routing to the appropriate service.
• TLS termination and protocol translation.
• Request logging and correlation identifier assignment, so every downstream signal carries it.
• Coarse request validation — size limits, malformed payload rejection — which protects backends cheaply.

What does not

• Authorisation beyond the coarse level. Whether this user may act on this specific resource requires domain knowledge, and putting it in the gateway means the gateway knows every service's permission model — which becomes a change coupling on every service.
• Response transformation per client, which is a backend-for-frontend concern and which accumulates client-specific logic in a shared component.
• Any business logic. Once it is there, it is deployed with every other service's changes, tested by nobody's suite, and owned by a team that does not understand the domain.
• Service-specific error handling, which belongs to the service that knows what its errors mean.

Why the accumulation happens

The gateway is a convenient place to put anything cross-cutting, and each addition is individually justified. The aggregate is a component that every service depends on, that changes constantly, and whose failure is total.

The controls that prevent it

• A stated list of what the gateway may do, and a review for anything else.
• A team that owns it with a stability obligation, since it is on every request path.
• Static stability: it must serve from cached configuration when the control plane is unavailable, and its failure mode must be "use the previous configuration" rather than "fail".
• A measure of its own change rate. A gateway changing weekly has accumulated things that belong elsewhere, and the change rate is the earliest available signal.