Topic starter
24/06/2026 8:47 pm
TL;DR: Agentic AI is moving from concept to working infrastructure, with projects spanning session memory, MCP integration, and autonomous rollback agents built on Kong AI Gateway, according to Kong. The signal is clear: API gateways are becoming identity and control points for agents, so governance has to move beyond simple request mediation.
Editorial analysis by NHI Mgmt Group, based on content published by Kong: “Meet the Winners of the Kong Agentic AI Hackathon 2025”.
Key questions
Q: How should teams govern agent sessions that retain context across requests?
A: Treat retained context as part of the control surface, not just application state.
Q: Why do MCP-connected agents create governance risk even when network controls are in place?
A: MCP-connected agents can operate locally on the same device as the user or developer, so their activity may never cross the perimeter traditional tools watch.
Q: Where do traditional API controls fail when agents can act autonomously?
A: They fail when the control model assumes a human remains in the loop for every material decision.
Practitioner guidance
- Map agent session state to governance controls Identify where persistent conversation history, cached context, and session identifiers influence later authorisation or tool calls.
- Inventory MCP-connected tools and data sources Document every tool an agent can reach through the gateway, including indirect connections and chained integrations.
- Separate decision authority from request routing Define which gateway actions are purely transport functions and which can alter agent behaviour, such as retry logic, rollback triggers, or context persistence.
Bottom line: Agentic AI is turning API gateways into active governance points where machine context, tool access, and runtime authority all matter.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:34 am
Gateway governance is now an identity problem, not just an API problem. The winning projects show that agentic AI can use gateways for session memory, tool mediation, and automated remediation. That means the gateway is no longer only enforcing traffic policy; it is helping shape what an agent knows, what it can call, and when it can act. Practitioners should treat API governance as part of machine identity governance rather than a separate network concern.
A few things that frame the scale:
- 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
A question worth separating out:
Q: What should IAM teams do when API gateways become part of agent decision paths?
A: Reclassify the gateway as an identity-governance enforcement point for machine actors. That means aligning authentication, authorisation, session handling, logging, and revocation with the agent’s runtime behaviour, not just with API traffic patterns.
👉 Read our full editorial: Kong hackathon winners show how agentic AI changes API governance