Topic starter
22/06/2026 10:09 am
TL;DR: Enterprise AI governance breaks down when APIs, gateways, agent frameworks, MCP routers, event pipelines, and context stores are fragmented, leaving 86% of organisations blind to AI data flows, according to Kong. The practical lesson is that data-path control, not model tuning, becomes the gating factor for governing GenAI and agentic AI at scale.
Editorial analysis by NHI Mgmt Group, based on content published by Kong: “# Why API modernization is the prerequisite to full data path governance”.
By the numbers:
- 86% of organisations are completely blind to their AI data flows.
- 95% of AI initiatives go nowhere because the infrastructure underneath them is ungoverned, fragmented, and flying blind.
Key questions
Q: What breaks when API governance and observability are fragmented across AI and traditional traffic?
A: Fragmented governance creates blind spots in policy enforcement, cost attribution, and incident investigation.
Q: Why do fragmented AI control layers increase governance and compliance risk?
A: Fragmented layers increase risk because each layer may approve its own part of the transaction while missing the larger data movement, tool invocation, or context access.
Practitioner guidance
- Map the full AI data path Document every route AI traffic can take through APIs, gateways, agent frameworks, MCP routers, event pipelines, and context stores, then identify where policy enforcement is missing or inconsistent.
- Eliminate gateway bypass paths Find alternate access paths that let prompts, tool calls, or context requests reach backend services without passing through the primary enforcement point, then standardise policy across them.
- Unify governance across runtime layers Treat API management, LLM governance, agent governance, and context management as one control problem so that logging, authorisation, and policy decisions remain aligned.
Bottom line: Fragmented API and AI control points leave organisations unable to enforce one governance model across the full data path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 10:55 am
API modernization is now an identity governance problem, not just an integration problem. When AI workloads move through gateways, routers, event buses, and context stores, the control plane itself becomes part of the identity story. The issue is not simply routing efficiency. It is whether policy, visibility, and accountability survive when one logical AI transaction spans several enforcement layers. Practitioners should treat the API layer as the governance substrate for AI.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams govern AI agents that can reach APIs, events, and memory?
A: Teams should govern those agents as runtime identities, not as isolated integrations. That means enforcing policy at execution time, logging every tool and data access, and binding actions back to a clear initiating workflow or identity. If the control plane cannot show who acted, what they reached, and why, the programme does not have usable governance.
👉 Read our full editorial: API modernization is the prerequisite for AI data path governance