Notifications
Clear all
Topic starter
24/06/2026 7:31 pm
TL;DR: Modern enterprise traffic now splits across external APIs, internal microservices, and AI calls, and separate tools create policy drift, fragmented observability, and security gaps, according to Kong. Its analysis frames unified control planes as the practical response to governance sprawl.
NHIMG editorial — based on content published by Kong: From Microservices to AI Traffic: Kong's Unified Control Plane When Architecture Gets Complicated
By the numbers:
- Kubernetes production adoption has surged from 66% in CNCF's 2023 survey to 82% in 2025.
- Semantic caching can reduce API calls by up to 68.8% with cache hit rates ranging from 61.6% to 68.8%.
Questions worth separating out
Q: How should security teams govern API, service, and AI traffic together?
A: Security teams should govern these traffic types through a shared control plane that centralises policy enforcement, observability, and auditability.
Q: Why does gateway sprawl create identity governance risk?
A: Gateway sprawl creates identity governance risk because each gateway often introduces its own policy language, logging model, and exception handling.
Q: When should organisations centralise control for AI traffic?
A: Organisations should centralise control for AI traffic when model access, prompt handling, or data exposure decisions are being managed by multiple teams or tools.
Practitioner guidance
- Inventory duplicated policy engines Map where the same authentication, rate-limiting, or data-handling logic exists across API gateways, meshes, and AI gateways.
- Standardise request traceability across traffic types Require a common request identifier, logging schema, and audit trail from API, microservice, and AI paths so incident response does not depend on manual log correlation.
- Separate model access from application logic Treat AI model invocation as a governed entitlement so policy, routing, and data-handling rules are not hardcoded into individual applications.
What's in the full article
Kong's full analysis covers the operational detail this post intentionally leaves for the source:
- Detailed product architecture for Konnect, Kong Gateway, Kong Mesh, and Kong AI Gateway in one operating model
- Specific configuration examples for policy enforcement, observability, and multi-model routing across traffic types
- Benchmark-style claims and platform comparisons around semantic caching, token analytics, and deployment patterns
- The article's full walkthrough of how Kong positions unified governance for API, microservice, and AI traffic
👉 Read Kong’s analysis of unified control planes for API, microservice, and AI traffic →
AI traffic governance: what a unified control plane changes?
Explore further
25/06/2026 4:50 am
Unified traffic governance is becoming an identity problem, not just an infrastructure problem. Once APIs, microservices, and AI requests are all routed through separate control planes, the organisation loses one coherent policy story. That fragments auditability, complicates accountability, and forces identity teams to maintain different trust assumptions for systems that are functionally part of the same business flow. Practitioners should treat unified control as a governance model, not a platform preference.
A few things that frame the scale:
- 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: What is the difference between an API gateway and a unified control plane?
A: An API gateway primarily enforces traffic controls for request routing, authentication, and throttling. A unified control plane extends that idea across multiple traffic types and governance layers, so APIs, service mesh traffic, and AI requests can share policy, observability, and audit logic. The difference is scope and consistency.
👉 Read our full editorial: Kong’s unified control plane and the rise of AI traffic governance
