Systems | Development | Analytics | API | Testing

Bots make up more than a third of internet traffic, and API endpoints attract more of it than web pages do. Scanners hunting for.env files, credential-stuffing scripts, LLM training crawlers, and the long tail of low-effort probes all hit your gateway before they ever reach a service. Every one of those requests costs you — in upstream load, in noise across your analytics, and in the bill.

Agentic AI governance is the structured management of the authority an organization hands to autonomous AI systems that plan and take action on its behalf. It covers what an AI agent is allowed to do, which systems it can touch, and how those permissions are monitored, limited, and revoked using robust autonomous AI governance controls.

Standing up a production agent means taking it through six stages: At API & AI Summit, we announced the evolution of Kong Konnect into the AI Connectivity Platform and announced a slate of launches built around that idea. Here's what we launched, where each piece fits, and what you can use today. An agent that only runs when a person prompts it isn't autonomous. Real autonomy starts when something happens in the world, like a payment failing or a ticket opening, and the agent responds.

Traditional observability was built around requests. A request comes in. A service processes it. A response goes out. You trace what happened in between. That model works well for APIs. It breaks down for AI. With agents, a single user request can trigger multiple model calls. An agent might invoke a tool, call another agent, query an MCP server, retry a model, hit a guardrail, and call another tool before finally producing a response. And all of this happens non-determinstically.

Today we're announcing Kong Operator 2.3. Building on 2.2's expansion into supporting Event Gateway and Dev Portal, this release significantly broadens our feature set. While 2.2 introduced foundational event-driven capabilities, 2.3 brings Kong **AI Gateway** fully into the Kubernetes-native fold, enabling teams to manage LLM routing and policies through familiar GitOps workflows. This update also rounds out Gateway API coverage with `TCPRoute`, `UDPRoute`, and `GRPCRoute`.

At Insomnia, we believe your tools should support you (and your agents!), not force you into certain ways of working. Over the last few months, we’ve been hard at work streamlining our interface so that it’s easier than ever for you to get started, stay organized, and work however you want with your APIs. There are two key concepts when a developer works with an API.

*Enterprise AI governance requires a composed stack connecting high-level risk and compliance oversight with real-time runtime enforcement. While oversight tools manage inventories, approvals, and evidence, AI gateways apply policy controls directly to live model, API, MCP, and agent traffic. Implementing both runtime controls and structured governance frameworks ensures comprehensive security, observability, and cost management across your entire AI estate.*

*Kong API Gateway 3.16 is here: runtime log-level tuning, per-consumer plugin configs, credit/usage-based request blocking with the new Entitlement Enforcement plugin, and FIPS 140-3 compliance for regulated industries - all built for live production debugging and governance, no downtime or custom code required.*

We're pulling back the curtain on a project we've been working on for some time now: the next evolution of the Kong brand. You may have noticed some changes recently to our site, swag, or socials. But today it's official: we're announcing Kong's rebrand and introducing our new mascot, Karl. Without further ado, let's dig in. Along the way, we'll give some insight into the "why" behind it all, while looking back at how things have changed since the early days of Kong. We were the API connectivity company.

Kong AI Gateway already gives platform teams a central place to route, observe, and enforce policy across AI traffic. Security teams working alongside those platform teams often need another set of answers: Which agents are connected? Which attack paths actually succeed against them? What happened across the full session or tool chain? And if an agent is compromised, can its next action be stopped before it reaches an enterprise system? The integration is designed to be complementary.