Topic starter
24/06/2026 8:41 pm
TL;DR: AI traffic is shifting from human-facing API consumption to agent-to-agent token flows, making the traffic layer the new control point for security, governance, and performance as hypervolume growth accelerates, according to Kong. That re-centres identity decisions on access, routing, auditability, and blast-radius control instead of only API management.
Editorial analysis by NHI Mgmt Group, based on content published by Kong: “# The Age of AI Connectivity”.
Key questions
Q: How should security teams govern AI agent traffic at the control plane level?
A: Security teams should govern AI agent traffic where routing, authentication, and auditability intersect, not only where applications connect.
Q: Why does agentic AI change the way access and routing should be controlled?
A: Agentic AI changes access and routing because machine workflows can chain actions faster than human review cycles can follow.
Q: What breaks when AI gateway controls are treated like ordinary API security?
A: Ordinary API security assumes stable clients and predictable request paths.
Practitioner guidance
- Map AI traffic to a named control plane Identify where model calls, MCP sessions, and agent-to-agent exchanges currently bypass policy enforcement, then decide which layer owns authentication, routing, and audit logging.
- Segment agentic flows by blast radius Classify agent workflows by the downstream systems they can reach, and apply tighter routing and permission boundaries to high-impact paths such as finance, customer data, and admin tools.
- Make token governance part of access design Treat token issuance, propagation, and reuse as part of the access model so that delegated machine activity can be constrained at runtime instead of only at integration time.
Bottom line: Agentic AI moves governance from human-facing application access toward the traffic layer where tokens, routing, and runtime policy converge.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:25 am
AI connectivity is becoming an identity control plane, not just a transport layer. Once agents exchange tokens, prompts, and tool calls directly, the network path starts carrying authorisation context as well as data. That means the control point shifts from static integration design to runtime governance over non-human traffic. Practitioners should read this as a change in where identity policy must be enforced.
A question worth separating out:
Q: How do teams reduce the blast radius of agentic workflows?
A: Limit the agent's ability to move from observation to mutation in one path. Use narrow credentials, separate approval boundaries, and human review before high-risk sinks such as commits, deployments, or database writes. The goal is to stop the workflow before tainted context turns into operational change.
👉 Read our full editorial: AI connectivity is becoming the control plane for agentic traffic