Agentic AI hackathon winners: what they mean for IAM teams

TL;DR: Agentic AI is moving from concept to working infrastructure, with projects spanning session memory, MCP integration, and autonomous rollback agents built on Kong AI Gateway, according to Kong. The signal is clear: API gateways are becoming identity and control points for agents, so governance has to move beyond simple request mediation.

NHIMG editorial — based on content published by Kong: Announcing the winners of Kong Agentic AI Hackathon

Questions worth separating out

Q: How should organisations govern agentic AI systems that can call tools and act on their own?

A: Organisations should govern agentic AI as a runtime identity problem, not only an application feature.

Q: Why do AI agents complicate existing IAM and NHI controls?

A: AI agents complicate IAM and NHI controls because they can combine memory, tools, and timing into a sequence that changes effective privilege during execution.

Q: What breaks when session history is treated as harmless state in agentic systems?

A: Session history stops being harmless when it preserves decisions, tool references, or operational cues that influence later actions.

Practitioner guidance

• Map agent session state to governance scope Define which conversation history, summaries, and session identifiers an agent may retain across requests.
• Register MCP-connected tools as governed access paths List every tool exposed through MCP and assign an owner, scope, logging requirement, and review cadence.
• Separate decision rights from actuation rights For rollback, remediation, or other autonomous actions, define what the agent may observe, what it may recommend, and what it may execute.

What's in the full analysis

Kong's full blog post covers the project details this post intentionally leaves at the governance level:

• The named hackathon winners and the specific build details behind each project
• How the Session History Plugin uses x-ai-session-id and MongoDB to preserve state
• How the AgenticAI-MCP-Client connects to the Mongo MCP Server and structures queries
• How the autonomous rollback agent monitors gateway configurations and reverses failures

👉 Read Kong's announcement of the 2025 Agentic AI Hackathon winners →

Agentic AI hackathon winners: what they mean for IAM teams?

Explore further

View Full Forum →  |  NHI Foundation Course →