Topic starter
24/06/2026 8:48 pm
TL;DR: 24% of organisations design APIs for AI agents, Kong survey data shows, even as those interfaces now serve AI, telecom, finance and healthcare. API policy has to track machine use at the point of access, or fragmented gateways will undercut authorization and auditability.
Editorial analysis by NHI Mgmt Group, based on content published by Kong: “The Rapidly Changing Landscape of APIs in 2026”.
Key questions
Q: Why do autonomous agents create more API security risk than human users?
A: Autonomous agents can chain actions, improvise workflow order, and operate at machine speed without the natural pauses humans introduce.
Q: What breaks when API governance is spread across multiple gateways?
A: Control consistency breaks first.
Q: How should security teams govern API access for AI agents and service accounts?
A: Security teams should treat API access as a governed identity path, not a transport detail.
Practitioner guidance
- Map API consumers by identity type Separate human users, service accounts, application credentials, and AI agents in the API inventory so policy can differ by consumer behaviour and risk.
- Bind authorization to machine-readable policy Require scopes, claims, and contextual rules that can be evaluated automatically at request time, rather than relying on human-readable governance documents.
- Instrument every protocol boundary Track where REST, GraphQL, gRPC, event streams, and WebSocket traffic enforce or weaken identity decisions, especially across multiple gateways.
Bottom line: APIs are increasingly acting as identity control points for machines, services, and AI agents rather than just developer integration endpoints.
Glossary terms: Machine-Readable Authorization Package, API Identity, Agentic API Consumption, Protocol Fragmentation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 22 hours ago by NHI Mgmt Group
25/06/2026 5:36 am
API identity is becoming the real control plane: Kong’s core signal is that API security can no longer be separated from identity governance because the authorisation decision now determines whether a machine may act, not merely whether a request is syntactically valid. That is especially true when AI agents become first-class API consumers and policy must be enforced at runtime. Practitioners should stop treating APIs as integration plumbing and start treating them as identity-bearing infrastructure.
A few things that frame the scale:
- 71% of organizations use third-party APIs, according to Gartner’s 2024 data.
A question worth separating out:
Q: What is the difference between authentication and authorization in agentic systems?
A: Authentication proves who or what is acting. Authorization decides what that identity may do, under which context, and for how long. In agentic systems, the distinction matters because the same identity can be authenticated once and still require repeated authorization as actions unfold.
👉 Read our full editorial: API security is becoming identity security for the agentic era