Topic starter
24/06/2026 7:31 pm
TL;DR: Modern enterprise traffic now spans APIs, microservices and AI calls, Kong says, and separate gateways make consistent governance harder to sustain. A shared control plane is needed to keep policy, observability and security aligned across the same application flow.
Editorial analysis by NHI Mgmt Group, based on content published by Kong: “# From Microservices to AI Traffic: Kong's Unified Control Plane When Architecture Gets Complicated”.
By the numbers:
- Kong cites Salt Security’s 2025 State of API Security report, which found that 95% of organizations experienced an API security incident in the past 12 months.
- Kong cites the CNCF Annual Surveys, which show Kubernetes production adoption rising from 66% in 2023 to 82% in 2025.
Key questions
Q: Why does gateway sprawl create identity governance risk?
A: Gateway sprawl creates identity governance risk because each gateway often introduces its own policy language, logging model, and exception handling.
Q: What breaks when APIs, microservices and AI calls use different control planes?
A: The main failure is that identity, redaction and policy decisions stop lining up across requests that belong to the same application flow.
Q: How should security teams govern API, service, and AI traffic together?
A: Security teams should govern these traffic types through a shared control plane that centralises policy enforcement, observability, and auditability.
Practitioner guidance
- Map all request paths Inventory where external APIs, internal service calls and AI or LLM requests are currently governed by different tools or teams.
- Consolidate policy expression Define common rules for authentication, authorisation, throttling, logging and redaction that can be enforced across every traffic type.
- Unify audit and tracing Require a single request trace that can follow a transaction from the front door API through service-to-service calls and any AI backend interaction.
Bottom line: Modern enterprise traffic now spans APIs, microservices and AI calls, and separate gateways make consistent governance harder to sustain.
Glossary terms: Unified Control Plane, Access Sprawl, AI Traffic, East-west traffic
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 21 hours ago by NHI Mgmt Group
25/06/2026 4:50 am
Unified control planes are becoming an identity governance requirement, not a convenience layer. When API traffic, service traffic and AI traffic are governed separately, teams end up with three different trust models for what is functionally one application estate. That fragmentation weakens policy consistency and obscures accountability. Practitioners should treat convergence as a governance design choice, not a tooling preference.
A question worth separating out:
Q: When should organisations centralise control for AI traffic?
A: Organisations should centralise control for AI traffic when model access, prompt handling, or data exposure decisions are being managed by multiple teams or tools. If the same organisation must prove who accessed which model, with what content, and under what rules, a shared governance layer becomes necessary rather than optional.
👉 Read our full editorial: Unified control planes are the answer to AI traffic drift
This post was modified 21 hours ago by NHI Mgmt Group