Topic starter
24/06/2026 7:32 pm
TL;DR: Event streaming teams still rely on coarse topic-level ACLs, fragmented identity models, and complex mTLS setups even as Kafka underpins financial transactions and AI inference pipelines, according to Kong. The security gap is no longer theoretical: event systems need identity-aware policy enforcement, not just infrastructure controls.
Editorial analysis by NHI Mgmt Group, based on content published by Kong: “Kong Event Gateway 1.1: Secure Kafka Event Streaming”.
Key questions
Q: How should teams apply identity-aware policy to event streaming platforms?
A: Start by treating the event layer as an authorisation surface, not just a transport path.
Q: Why do Kafka ACLs create governance gaps for multi-tenant event access?
A: Because ACLs usually control topics and actions without enough context to distinguish one tenant or caller intent from another.
Q: What breaks when event security relies only on mTLS and topic ACLs?
A: You get strong transport authentication but weak entitlement control, so identity and authorisation drift apart.
Practitioner guidance
- Map event claims to policy inputs Define which OAuth claims, such as tenant identifiers, roles, or scopes, should drive publish and consume decisions before streams are exposed cross-domain.
- Separate broker reach from data entitlement Keep connectivity and entitlement distinct so that reaching a Kafka broker does not automatically imply access to every topic the broker hosts.
- Centralise certificate trust for event gateways Maintain trusted certificate bundles in one governed place and use the extracted principal to support both authorisation and audit decisions.
Bottom line: Event streaming security is moving from infrastructure-centric controls toward identity-aware policy enforcement at the stream boundary.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:53 am
Event streaming has become an identity governance problem, not just a messaging problem. Kafka and similar platforms now carry business-critical workloads, which means access control has to keep pace with the identity patterns already used elsewhere in the stack. When topic-level ACLs and transport-only checks are the dominant model, practitioners end up with a security posture that lags the rest of their IAM programme. The implication is that event systems must be governed as first-class identity surfaces.
A question worth separating out:
Q: How do security teams decide whether to expose Kafka topics externally?
A: They should expose only the streams that can be tied to explicit identity claims and clear policy rules. If the team cannot express who the caller is and what data slice they deserve, the stream is not ready for external access.
👉 Read our full editorial: Identity-aware policy enforcement is arriving in event streaming