Topic starter
24/06/2026 7:21 pm
TL;DR: AI tool adoption can be governed before shadow-AI patterns and cost drift outpace policy, as Kong’s A2A and MCP Metrics add visibility into agent-to-agent and Model Context Protocol usage, including request counts, latency, and tool consumption across agents, consumers, and task IDs, according to Kong.
Editorial analysis by NHI Mgmt Group, based on content published by Kong: “# Introducing Kong A2A and MCP Metrics: Visibility and Governance for AI Tool Adoption at Scale”.
Key questions
Q: How can organisations tell whether AI governance is actually working?
A: Organisations can tell AI governance is working when they can inventory every agent, explain its purpose, show who owns it, and prove that permissions are tightly scoped.
Q: Why do uptime and latency metrics fail to govern agentic AI programmes?
A: Because they show service health, not control effectiveness.
Q: What breaks when AI tool access is not tied to usage and scope telemetry?
A: Teams lose the ability to tell whether low adoption is caused by poor training, broken integration, or overly broad or narrow access.
Practitioner guidance
- Instrument AI adoption telemetry Track request counts, latency, task IDs, consumer IDs, and tool-level usage so policy decisions reflect real behaviour rather than assumed adoption.
- Separate availability from governance reporting Report uptime and latency as service health, but use blocked requests, tool consumption, and adoption trends for security and governance decisions.
- Apply scope-based tool filtering Limit each agent or consumer to the smallest tool scope that matches its role, and review those scopes against actual invocation patterns.
Bottom line: AI tool adoption cannot be governed well if teams only measure infrastructure health instead of actual usage and access patterns.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:36 am
AI adoption now has a governance telemetry problem, not just an observability problem. Uptime, latency, and request health do not tell security or platform teams whether agents are actually using approved tools in approved ways. Once adoption reaches enterprise scale, governance depends on usage evidence, blocked-request patterns, and consumption trends, not infrastructure health alone. The practitioner conclusion is simple: without actor-level telemetry, policy becomes retrospective.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams decide who owns AI gateway governance as adoption scales?
A: Ownership usually shifts toward platform and infrastructure teams because they can see the traffic and enforce the controls closest to execution. That only works if security, IAM, and AI governance requirements are built into the operating model, so technical ownership does not become a blind spot for access, risk, or accountability.
👉 Read our full editorial: Kong A2A and MCP metrics expose the governance gap in AI tool adoption