Topic starter
24/06/2026 7:31 pm
TL;DR: Modern enterprise traffic now splits across external APIs, internal microservices, and AI calls, and separate tools create policy drift, fragmented observability, and security gaps, according to Kong. Its analysis frames unified control planes as the practical response to governance sprawl.
Editorial analysis by NHI Mgmt Group, based on content published by Kong: “# From Microservices to AI Traffic: Kong's Unified Control Plane When Architecture Gets Complicated”.
By the numbers:
- Kong cites Salt Security’s 2025 State of API Security report, which found that 95% of organizations experienced an API security incident in the past 12 months.
- Kong cites the CNCF Annual Surveys, which show Kubernetes production adoption rising from 66% in 2023 to 82% in 2025.
Key questions
Q: How should security teams govern API, service, and AI traffic together?
A: Security teams should govern these traffic types through a shared control plane that centralises policy enforcement, observability, and auditability.
Q: Why does gateway sprawl create identity governance risk?
A: Gateway sprawl creates identity governance risk because each gateway often introduces its own policy language, logging model, and exception handling.
Q: What breaks when APIs, microservices and AI calls use different control planes?
A: The main failure is that identity, redaction and policy decisions stop lining up across requests that belong to the same application flow.
Practitioner guidance
- Map all request paths Inventory where external APIs, internal service calls and AI or LLM requests are currently governed by different tools or teams.
- Consolidate policy expression Define common rules for authentication, authorisation, throttling, logging and redaction that can be enforced across every traffic type.
- Unify audit and tracing Require a single request trace that can follow a transaction from the front door API through service-to-service calls and any AI backend interaction.
Bottom line: Modern enterprise traffic now spans APIs, microservices and AI calls, and separate gateways make consistent governance harder to sustain.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:50 am
Unified control planes are becoming an identity governance requirement, not a convenience layer. When API traffic, service traffic and AI traffic are governed separately, teams end up with three different trust models for what is functionally one application estate. That fragmentation weakens policy consistency and obscures accountability. Practitioners should treat convergence as a governance design choice, not a tooling preference.
A question worth separating out:
Q: When should organisations centralise control for AI traffic?
A: Organisations should centralise control for AI traffic when model access, prompt handling, or data exposure decisions are being managed by multiple teams or tools. If the same organisation must prove who accessed which model, with what content, and under what rules, a shared governance layer becomes necessary rather than optional.
👉 Read our full editorial: Kong’s unified control plane and the rise of AI traffic governance