Topic starter
24/06/2026 8:48 pm
TL;DR: APIs are shifting from developer interfaces to regulated infrastructure that now power AI agents, telecom, finance, and healthcare, while only 24% of organisations currently design APIs for AI agents according to Kong and GenAI in Enterprise research. The governance gap is no longer about API scale alone: it is about whether identity, authorization, and machine-readable policy can keep pace with autonomous consumption and multi-protocol estates.
Editorial analysis by NHI Mgmt Group, based on content published by Kong: “The Rapidly Changing Landscape of APIs in 2026”.
Key questions
Q: How should security teams govern API access for AI agents and service accounts?
A: Security teams should treat API access as a governed identity path, not a transport detail.
Q: Why do autonomous agents create more API security risk than human users?
A: Autonomous agents can chain actions, improvise workflow order, and operate at machine speed without the natural pauses humans introduce.
Q: What breaks when API governance is spread across multiple gateways?
A: Control consistency breaks first.
Practitioner guidance
- Map API consumers by identity type Separate human users, service accounts, application credentials, and AI agents in the API inventory so policy can differ by consumer behaviour and risk.
- Bind authorization to machine-readable policy Require scopes, claims, and contextual rules that can be evaluated automatically at request time, rather than relying on human-readable governance documents.
- Instrument every protocol boundary Track where REST, GraphQL, gRPC, event streams, and WebSocket traffic enforce or weaken identity decisions, especially across multiple gateways.
Bottom line: APIs are increasingly acting as identity control points for machines, services, and AI agents rather than just developer integration endpoints.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:36 am
API identity is becoming the real control plane: Kong’s core signal is that API security can no longer be separated from identity governance because the authorisation decision now determines whether a machine may act, not merely whether a request is syntactically valid. That is especially true when AI agents become first-class API consumers and policy must be enforced at runtime. Practitioners should stop treating APIs as integration plumbing and start treating them as identity-bearing infrastructure.
A few things that frame the scale:
- 71% of organizations use third-party APIs, according to Gartner’s 2024 data.
A question worth separating out:
Q: What is the difference between authentication and authorization in agentic systems?
A: Authentication proves who or what is acting. Authorization decides what that identity may do, under which context, and for how long. In agentic systems, the distinction matters because the same identity can be authenticated once and still require repeated authorization as actions unfold.
👉 Read our full editorial: API security is becoming identity security for the agentic era