Kong hackathon winners show how agentic AI changes API governance

At a glance

What this is: Kong's hackathon recap highlights three agentic AI projects that extend API infrastructure into session memory, MCP integration, and autonomous rollback, showing how gateways are becoming governance points for agent behaviour.

Why it matters: IAM and NHI teams need to treat gateways as decision surfaces for agents, because runtime context, tool mediation, and rollback authority all change how access is issued, observed, and controlled.

Context

Agentic AI changes the governance problem around APIs because the system no longer just forwards requests. When an agent can remember context, translate natural language into structured actions, or trigger rollback logic, the gateway becomes part of the identity and authority chain rather than a simple traffic layer.

This Kong hackathon recap is best read as a signal of where agentic systems are heading operationally. The central issue is not whether APIs still matter, but how session state, protocol mediation, and autonomous actions reshape the controls that IAM, PAM, and NHI programmes normally assume are stable.

Key questions

Q: How should teams govern agent sessions that retain context across requests?

A: Treat retained context as part of the control surface, not just application state. If an agent can use prior session history to influence future tool calls or decisions, then access, logging, retention, and revocation need to follow the session, not just the request.

Q: Why do MCP-connected agents create governance risk even when network controls are in place?

A: MCP-connected agents can operate locally on the same device as the user or developer, so their activity may never cross the perimeter traditional tools watch. That means network-based discovery can miss both the server itself and the actions it performs. The core risk is not just data leaving the environment, but unsanctioned tool use inside trusted workflows.

Q: Where do traditional API controls fail when agents can act autonomously?

A: They fail when the control model assumes a human remains in the loop for every material decision. If an agent can detect a condition, select a response, and execute it without approval, request-level checks alone cannot define or contain that authority.

Q: What should IAM teams do when API gateways become part of agent decision paths?

A: Reclassify the gateway as an identity-governance enforcement point for machine actors. That means aligning authentication, authorisation, session handling, logging, and revocation with the agent’s runtime behaviour, not just with API traffic patterns.

Technical breakdown

Session memory turns the gateway into a stateful control point

The session history pattern shown in the winning project adds persistent session objects to an API gateway flow so context survives across requests. That matters because agentic systems do not behave like stateless integrations. Once session memory exists, the control boundary shifts from single-request authentication to session-scoped authority, where conversation state can influence later tool use and downstream decisions. Context summarisation helps manage scale, but it also means governance has to understand what state is retained, what is discarded, and when that retained state can alter agent behaviour.

Practical implication: Treat session state as governed identity context, not just application data.

MCP integration expands the API attack and trust surface

Model Context Protocol lets an agent connect to tools and data sources through a standardised interface, which makes tool mediation easier but also centralises trust. In the hackathon project, the gateway becomes the place where MCP connections are normalised, observed, and constrained. That is useful because it reduces sprawl, but it also means the gateway is now mediating agent tool selection and execution. For identity teams, this is where authorisation, inventory, and logging need to align with agent intent rather than just API endpoint access.

Practical implication: Govern MCP-connected tools as first-class non-human access paths.

Autonomous rollback shows how operational authority can move into the agent

The auto rollback project is an example of an agent making remediation decisions without waiting for a person to intervene. That creates a different control problem from ordinary automation because the agent is not just executing a fixed playbook; it is evaluating gateway failures and choosing a response. The technical question is therefore not only whether rollback works, but who or what is authorised to detect failure, approve reversal, and re-enter configuration state. For governance, the boundary between observability, control, and authority becomes much thinner.

Practical implication: Define what operational actions an agent may take without human approval.

NHI Mgmt Group analysis

Gateway governance is now an identity problem, not just an API problem. The winning projects show that agentic AI can use gateways for session memory, tool mediation, and automated remediation. That means the gateway is no longer only enforcing traffic policy; it is helping shape what an agent knows, what it can call, and when it can act. Practitioners should treat API governance as part of machine identity governance rather than a separate network concern.

Session persistence creates a new form of trust accumulation. A stateless request model assumes each call can be judged on its own. A stateful agent session preserves prior context, and that context can change future authorisation decisions, tool selection, and rollback triggers. The result is a governance shift from request-level checks to session-level accountability, which is where many current API controls are still weak. Teams need to recognise that retained context becomes an asset with security meaning.

Runtime authority drift: agentic systems can start with limited access and end with broader effective power as session state, protocol bindings, and autonomous actions accumulate. That is the real lesson in the hackathon entries. The risk is not only bad inputs or broken APIs, but the way an agent’s authority expands across a session without a human operator re-asserting intent. Practitioners should model where that drift can occur and which controls are supposed to stop it.

API gateways are becoming the policy layer for non-human decision-makers. As more agent workflows pass through gateways, identity teams will need clearer standards for issuance, observation, and revocation across machine actors. This aligns more closely with OWASP-NHI and Zero Trust principles than with traditional API management alone. The practical conclusion is simple: if the gateway is where the agent acts, it must also be where the agent is governed.

From our research library:

• 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
• Read next: Agentic AI Identity Guide

What this signals

Session history becomes governance state. Agentic systems that preserve conversation context across requests create a control problem IAM teams are not used to handling. The practical shift is that authorisation can no longer be reviewed only at call time, because prior context may alter future action selection in ways that look legitimate until the full session is inspected.

API gateways are starting to behave like non-human identity enforcement points. Once agents use gateways to select tools, retain state, and trigger remediation, the gateway stops being just middleware. It becomes the place where issuance, observation, and revocation for machine actors have to line up, which is why NHI governance and API governance are converging.

Agent authority needs explicit boundaries, not implied trust. The more an agent can chain context, protocols, and corrective actions, the more likely it is to exceed the intent of the original integration. Teams should prepare for policy models that define what an agent may know, call, and change within a session, rather than relying on endpoint-level permissions alone.

For practitioners

• Map agent session state to governance controls Identify where persistent conversation history, cached context, and session identifiers influence later authorisation or tool calls. Classify that state as governed control data, not incidental application metadata.
• Inventory MCP-connected tools and data sources Document every tool an agent can reach through the gateway, including indirect connections and chained integrations. Reconcile the list with ownership, purpose, and revocation responsibility.
• Separate decision authority from request routing Define which gateway actions are purely transport functions and which can alter agent behaviour, such as retry logic, rollback triggers, or context persistence. Apply tighter approvals to the latter.
• Review autonomous remediation boundaries Specify which corrective actions an agent may take without human sign-off, and which require intervention before execution. Revalidate those boundaries whenever the agent gains new tools or broader session scope.

Key takeaways

• Agentic AI is turning API gateways into active governance points where machine context, tool access, and runtime authority all matter.
• The hackathon projects illustrate a shift from stateless request handling to session-aware and action-capable agent behaviour.
• IAM and NHI programmes should treat gateway policy, session state, and autonomous remediation as one control surface.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Session State: The information that persists across an interaction, including prompts, outputs, files, and intermediate context. In agentic systems, session state is a governance boundary because persistence, transfer, and reconstruction determine whether the conversation is auditable and whether data leaves the original trust domain.
• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Autonomous remediation: Autonomous remediation is a security response model that acts automatically when risky identity behaviour is detected. Instead of waiting for manual triage, the control plane can step up authentication, block access, roll back changes, or contain a session before abuse spreads.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.