Topic starter
24/06/2026 8:47 pm
TL;DR: H&M’s Generative AI Gateway centralised LLM traffic to address fragmented security, compliance, cost, and observability risks created by ad hoc AI integrations, according to Kong. The pattern matters because enterprise AI is quickly becoming an identity and governance problem, not just an application architecture choice.
Editorial analysis by NHI Mgmt Group, based on content published by Kong: “# Building the Nervous System for Enterprise AI: How H&M Tamed the GenAI Wild West”.
Key questions
Q: How should security teams govern direct LLM integrations at scale?
A: They should treat direct integrations as a temporary pattern and move policy, routing, and observability into a central control plane.
Q: Why do ad hoc AI integrations create security and compliance risk?
A: Because they scatter credentials, logging, and data-handling decisions across many code paths.
Q: What breaks when AI agent traffic is not governed by a centralized control plane?
A: Without centralized governance, teams usually end up with fragmented API keys, inconsistent rate limits, and weak cost attribution.
Practitioner guidance
- Centralise AI model access Place all LLM traffic behind one governed gateway so security, logging, and routing policies are applied consistently across teams.
- Standardise secret handling for AI integrations Remove direct, team-specific API key patterns and require shared lifecycle ownership for credentials used to reach model endpoints.
- Build auditability into model calls Capture request identity, route, policy decision, and usage volume for every model interaction so compliance and finance can trace activity.
Bottom line: Distributed AI integrations create the same governance problems that identity teams already know from unmanaged access paths, only faster and across more teams.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:35 am
Enterprise AI governance is now an identity control problem. Once multiple teams can call LLMs directly, the organisation is no longer managing isolated experiments. It is managing an access layer with credentials, policy, logging, and accountability requirements that look increasingly like IAM and NHI governance. The practitioner takeaway is that AI adoption without a shared control plane creates unmanaged access paths faster than governance teams can review them.
A few things that frame the scale:
- Enterprise AI use rose from 55% of organisations in 2023 to 88% in 2025, according to McKinsey’s Global Surveys on the State of AI.
A question worth separating out:
Q: Why do AI gateways matter for enterprise IAM programmes?
A: AI gateways matter because they create a central point for identity, routing, and observability across model and tool traffic. Without that layer, AI systems tend to sprawl across multiple providers and integrations, making access controls inconsistent and audit evidence incomplete. For IAM teams, the gateway becomes the place where AI privilege is actually enforced.
👉 Read our full editorial: H&M's AI gateway shows how enterprise AI governance scales