Topic starter
24/06/2026 7:40 pm
TL;DR: Gartner’s view that 50% of software providers will need to expose their context layer externally by 2029 frames context as a governable asset, not just data, according to Kong’s summary of the research. The real governance challenge is that AI connectivity expands access paths, monetisation pressure, and policy complexity faster than most IAM and API controls were built to handle.
Editorial analysis by NHI Mgmt Group, based on content published by Kong: “The Platform Enterprises Need to Compete? Kong Already Built It”.
Key questions
Q: How should teams govern access to context exposed through MCP servers?
A: Treat MCP exposure as a governed entitlement problem, not a simple integration task.
Q: Why does the context economy increase identity governance risk?
A: Because it adds more subjects, more delivery paths, and more policy decisions around the same business content.
Q: What breaks when context is monetised without usage governance?
A: Billing, audit, and access control drift apart.
Practitioner guidance
- Map context consumers by identity type Inventory which humans, service accounts, APIs, and AI agents consume exposed context, then classify each by the policy conditions under which that consumption is allowed.
- Separate context discovery from context delivery Require distinct policy decisions for discovering context, subscribing to it, and consuming it through MCP, API, or event paths so each stage has its own control boundary.
- Align metering with entitlement evidence Tie usage records to the identity and policy that authorised the context request so billing, audit, and security teams can reconcile the same transaction.
Bottom line: Context is no longer just something applications use internally. It is becoming a governed enterprise asset that can be exposed, brokered, and sold.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:02 am
Context is becoming an identity-governed asset, not just an API payload. Once enterprises sell, expose, or broker context, the access question changes from who can call an endpoint to who is entitled to consume a business-ready representation of operational reality. That shifts governance from transport control to context control, where policy must follow meaning as well as data. The practitioner conclusion is that API governance alone no longer covers the full access decision.
A few things that frame the scale:
- 71% of organizations use third-party APIs, according to Gartner’s 2024 data.
A question worth separating out:
Q: What is the difference between API governance and context governance?
A: API governance controls how services are exposed and consumed. Context governance goes further by controlling the meaning-bearing data, event, and AI-layer packages that agents and orchestrators use to make decisions, which means entitlement and accountability have to follow the content itself.
👉 Read our full editorial: Kong’s context-economy thesis raises new AI connectivity governance risks