April 2026 Summaries

Salesforce's recent announcement of Headless 360, which exposes every capability of its platform as an API, MCP tool, or CLI command, marks a significant shift in enterprise software architecture away from traditional browser-based interfaces. This move is motivated by the growing importance of agents, who utilize APIs rather than clicking through UIs, making traditional SaaS interfaces less relevant. The transition to a headless architecture, however, poses challenges, including the need for reliable API discovery, governance, and cross-platform control, to avoid creating security vulnerabilities and inefficiencies. While Salesforce's initiative highlights the shift toward agent-native systems, it also underscores the broader industry challenge of achieving seamless multi-vendor interoperability and governance. This evolution signifies a move towards connectivity that is open and governed, with Kong and other companies focusing on creating comprehensive control planes to manage the complex demands of modern, agent-driven enterprises.

Modern Kafka deployments face challenges with traditional static ACLs, which are difficult to manage, scale, and maintain across different teams and environments. By leveraging Kong Event Gateway and Kong Identity, organizations can implement dynamic, identity-aware access control using OAuth or JWT token claims, allowing for more flexible and context-driven permissions. This system enables the embedding of authorization data directly into tokens, which Kong Event Gateway enforces, thus eliminating the need for static configuration and manual updates. By defining access at the identity provider level, permissions can be updated dynamically as needs change, reducing operational overhead and minimizing the risks associated with misconfigured ACLs. This approach shifts the focus from infrastructure-defined ACLs to identity-driven policies, enhancing security and simplifying access management for Kafka clients.

Scaling the adoption of large language models (LLMs) and agentic AI from pilot programs to enterprise-wide deployments poses significant logistical challenges, particularly in ensuring that AI tools are used effectively. Kong has introduced Kong A2A and MCP Metrics within the Kong AI Gateway, offering unified visibility, governance, and business-level insights to address these challenges. The new metrics, coupled with the capabilities of Kong AI Gateway 3.14, facilitate the management of AI adoption at scale, providing insights into usage and performance, which are crucial for making informed decisions about tool deployment and optimization. These enhancements allow platform teams to track various metrics, such as request counts and latency, thus enabling targeted interventions for performance optimization and stakeholder engagement through data-driven conversations. This structured approach helps organizations manage AI tools efficiently, ensuring compliance and security, and ultimately supports a robust AI governance and adoption strategy.

Migrating from Postman to Kong Insomnia offers users a streamlined transition process, leveraging Insomnia's ability to natively interpret Postman's export format for collections, environments, and scripts, thus automating most of the conversion. Insomnia's local-first approach retains data on the user's machine, enhancing privacy and regulatory compliance, while its free plan supports unlimited team collaboration, unlike Postman, which reserves such features for paid plans. Users can export their Postman data via UI or CLI for bulk migrations and import it into Insomnia, where workspaces are mapped to projects, and scripts are auto-converted to Insomnia's format. Insomnia's lightweight design, AI workflow support, and plugin flexibility cater to modern, cost-effective API management needs. Checking imported environments and scripts ensures a successful migration, with Insomnia effectively handling the majority of script conversions. Overall, Insomnia provides a faster, more collaborative, and affordable alternative, appealing to developers seeking enhanced API workflow management.

Digital agreements are increasingly central to business processes as companies modernize their technology stacks and adopt API-driven architectures. By integrating Kong Konnect with Docusign for Developers, organizations can create robust digital agreement systems that are secure and automated, addressing the inefficiencies of traditional, manual workflows. These integrations allow agreement processes to be deeply embedded into enterprise systems, enhancing security, traffic management, and observability through Kong's API management capabilities. Docusign's Extension Apps enable developers to connect workflows with a variety of systems, facilitating seamless data flow and compliance across platforms. The collaboration of Kong Gateway and Docusign Maestro orchestrates the entire lifecycle of agreements, from document creation to electronic signatures, while maintaining strong governance and visibility over API interactions. This modern architecture allows businesses to automate end-to-end agreement processes, ensuring compliance and security while supporting flexible workflow automation, ultimately enhancing operational efficiency and scalability.

Kong Gateway 3.14 introduces a unified approach to cloud-native authentication across major cloud providers like AWS, Azure, and GCP, thereby eliminating the need for static credentials in service-to-service connections. This update ensures that all components Kong connects to, such as databases, caches, and secrets managers, can authenticate using the cloud's native identity systems, enhancing security and operational consistency. The strategic shift focuses on IAM-based identity models, exemplified by Kong's ability to authenticate to HashiCorp Vault using AWS IAM roles without relying on access or secret keys. Instead, Kong utilizes a signed AWS API request, verified independently by AWS STS, to grant temporary credentials, ensuring a secure and traceable authentication process. This approach not only reduces the burden of credential rotation and potential leaks but also provides a unified audit trail and enforces least-privilege access policies. By adopting this model, enterprises can maintain a consistent security posture across their cloud infrastructure, simplifying the operational model for connecting with various services.

Kong Gateway 3.14 has introduced conditional plugin execution, a significant shift from static, hierarchical API Gateway configurations to a more dynamic and context-aware approach. This feature allows platform engineers to set precise, fine-grained execution rules using Kong’s Advanced Traffic Control (ATC) expression language, enabling plugins to execute based on specific request attributes like headers or paths. By decoupling logic from infrastructure, conditional execution treats plugins as policies, reducing configuration complexity and eliminating the need for duplicative routing logic. This advancement enhances observability, as logs and metrics become more descriptive, and improves performance by ensuring that conditions are evaluated efficiently. The innovation supports a modern, intent-based control plane, allowing for real-time adaptability in complex environments, which is essential for AI-ready, policy-driven infrastructures. This offers engineers the ability to build sophisticated, context-aware API policies without the burdens of configuration sprawl, leading to reduced vulnerabilities and more precise control over API traffic flows.

Kong Gateway 3.14 addresses complex API platform challenges by introducing several key features to enhance infrastructure configuration, security, and observability without custom code. The update introduces conditional plugin execution, allowing users to specify conditions for plugin activation, reducing maintenance complexity and enhancing control over API traffic. It also adds JWT nodes for Datakit, enabling complex authentication workflows without code, and enhances WebSocket security with native OIDC and mTLS authentication, providing consistent security across HTTP and WebSocket traffic. Additionally, the new OpenID Token Exchange feature supports token transformation at the gateway level, mitigating security risks associated with token forwarding in microservices. Enhanced cloud-native authentication across AWS, Azure, and GCP improves security posture by eliminating static credentials. The introduction of the OpenMeter Plugin enables real-time metering and billing at the gateway, facilitating precise control over API and AI traffic usage. These innovations help platform teams focus on building robust infrastructures while maintaining security and efficiency.

OAuth 2.0 Token Exchange, as defined by RFC 8693, provides a method for services to establish trust by allowing a client to exchange an existing security token for a new one tailored for specific scopes or identity relationships, without re-authenticating. This process is ideally managed at the API gateway, which serves as a centralized point for enforcing security policies and managing token exchanges across services. The API gateway's role in handling token exchanges helps maintain least privilege access, simplify identity complexity for backend services, and ensure privacy by stripping unnecessary claims before forwarding tokens. Kong's implementation, integrated within its OpenID Connect plugin as of version 3.14, performs a series of validation checks to ensure secure token exchanges, addressing new attack surfaces by defining strict trust models. This approach enhances security by treating the API gateway as a security control plane, allowing for consistent, scoped, and trusted tokens regardless of the original authentication method.

Kong Agent Gateway introduces a comprehensive solution for managing complex AI data paths, addressing the challenges posed by agent-to-agent (A2A) communication, which is increasingly prevalent in modern agentic architectures. As part of Kong AI Gateway's 3.14 release, it extends governance capabilities across large language models (LLMs), Model Context Protocol (MCP) servers, and A2A interactions, providing a unified governance layer for APIs, events, LLM calls, and tool access. This innovation is critical as enterprises adopt agentic AI, where agents autonomously call tools, delegate tasks, and consume event streams with minimal human oversight, often leading to governance and security challenges. Kong Agent Gateway offers features like agent identity verification, real-time traffic inspection, cost allocation by agent, and full audit logging to prevent security pitfalls and maintain scalable and secure AI operations. As enterprises face the complexities of integrating agentic AI into their workflows, Kong's platform, part of the larger Kong Konnect suite, provides the necessary infrastructure to manage and secure these multi-agent systems effectively, ensuring compliance and optimized resource usage.

Kong AI Gateway 3.14 addresses the growing complexity of multi-agent AI workflows by providing comprehensive governance over agent-to-agent (A2A) communication, ensuring consistency in authentication, rate limiting, and observability across AI traffic. This release introduces native support for A2A traffic management, allowing enterprise teams to manage complex AI workflows involving multiple providers and services without altering application code. Key features include token exchange for finer permission control, scope-based tool filtering, JWK-based token validation, and body-based model routing, which decouples client requests from backend topology. Enhanced structured logging and global rate limiting offer improved visibility and control, while custom guardrails integration allows for third-party API connections for content safety. The release supports various AI models and platforms, such as Databricks, DeepSeek, and vLLM, providing a unified governance framework for diverse AI infrastructure components.

Building a Model Context Protocol (MCP) server can be deceptively simple for proof-of-concept demonstrations, but the transition to a production environment reveals significant hidden costs related to security, governance, observability, and maintenance. As companies increasingly adopt MCP, which standardizes connections for AI agents to discover and invoke tools, the challenges of managing authentication complexities, ensuring governance to avoid server sprawl, and maintaining observability for debugging become apparent. The DIY approach often leads to technical debt, with high security risks and governance without a control plane, resulting in server sprawl and shadow AI issues, which can incur substantial costs. Additionally, maintaining a DIY setup requires constant updates to align with evolving MCP standards. These issues suggest that while building an MCP server might seem appealing initially, leveraging enterprise-grade infrastructure, like those offered by Kong, could provide a more robust solution by offering seamless API integration, centralized governance, and comprehensive observability, allowing teams to focus on innovative AI features rather than infrastructure maintenance.

The discussion highlights the ongoing debate between Command Line Interfaces (CLIs) and the Model-Context Protocol (MCP) in shaping enterprise AI workflows, emphasizing the strengths and limitations of each. CLIs are praised for their efficiency, debuggability, and low overhead in local agent workflows, being effective for developers managing their own data and credentials. However, they fall short in organizational settings where centralized governance, structured observability, and scoped permissions are crucial, as CLIs lack standardized mechanisms for delegation and access control. MCP, despite its context bloat challenges, offers robust authentication, authorization, and audit capabilities, providing a more structured and governed approach to managing agents across teams. The evolution of MCP server design, from initial tool overload to workflow-driven tools, and now towards code mode, reflects an adaptation to models' growing capabilities, emphasizing the need for enterprises to clearly define their problems and build adaptable infrastructures. The narrative underscores the importance of understanding the distinct requirements of different user scenarios rather than prematurely declaring one approach superior, advocating for a balanced strategy that leverages the strengths of both CLIs and MCP according to specific organizational needs.

Enterprises implementing AI in production face a significant challenge with the rising costs associated with Large Language Model (LLM) usage, akin to the early cloud adoption issues. The Mavvrik report highlights that 84% of companies experience over a 6% gross margin impact due to AI costs, termed the "hidden AI fragmentation tax," caused by fragmented AI workloads and lack of unified cost visibility. The solution lies in effective AI cost governance through showback and chargeback mechanisms, which provide visibility and accountability for LLM token consumption. Kong Konnect's Metering and Billing platform addresses this need by offering real-time cost analytics tied to LLM usage, enabling organizations to track and manage expenses across different teams and applications. This system allows for cost-conscious decision-making by engineering and business teams, ensuring that AI deployments are economically viable and strategically planned. By building robust cost visibility into their AI infrastructure, companies can protect their margins and prevent financial surprises that arise from uncontrolled LLM expenditures.