Short answer
A gateway centralizes routing, authentication, policy checks, limits, and observability between an application and providers. It cannot make unsafe inputs safe.
Boundary
Give clients scoped gateway credentials and test allowed and denied routes with synthetic data.