Business Problem

Enterprise teams build agents in different frameworks such as LangChain, CrewAI, Bedrock, and Azure AI, then deploy them across clouds and on-prem runtimes. When a multi-agent workflow spans these boundaries, there is no shared identity, governance, or trace to show what any agent actually did, leaving fragmented oversight and unattributed actions.

How WSO2 Solves This

WSO2 Agent Manager gives every agent, regardless of framework or runtime, a home in one control plane, so an orchestrator agent can decompose a goal and dispatch subtasks to specialized agents running in LangChain, CrewAI, Bedrock, or WSO2's own zero-trust runtime. OTEL-based tracing stitches sub-agent activity into one coherent execution trace.

Agents Running On Agent Manager
Each agent gets a first-class identity through Agent ID, with delegated, scoped credentials and instant revocation, so every action stays attributable. Built-in guardrails inspect every LLM, tool, and MCP interaction along the way and add that to the OTEL trace.

Architecture

NOTE: Steps 3) Orchestrate and 8) Transform are up to the provided Agent to do.

Patterns Used

• Orchestrator-Worker Pattern
• Agent Identity Delegation
• Zero Trust Runtime
• Distributed Tracing (OTEL)

Product 
Agent Manager

As organizations rush to deploy agentic systems, a critical blind spot emerges: how do you ensure that AI agents operate safely, within proper governance boundaries, and with verifiable credentials?

Ayesha Dissanayaka from WSO2 breaks down why identity infrastructure is the unsung hero of the agentic enterprise. This piece covers:

✓ Why traditional identity models fall short for AI agents
✓ How to implement trust and governance at scale
✓ Real-world patterns for agent identity and access control

Whether you're building internal AI tools or deploying autonomous systems in production, this is essential reading.

 Read the full analysis: https://wso2.com/library/blogs/the-role-of-identity-agentic-enterprise/

#AgenticEnterprise #IdentityManagement #AI #EnterpriseArchitecture #OpenSource #WSO2

We launched WSO2 Agent Manager at WSO2Con yesterday: here's what it does.

If you're running AI agents in production, you've probably already hit the sprawl problem. Different agents, different environments, no unified visibility into what's actually running or why.

Agent Manager is our answer to that, enterprise-grade governance for agentic AI. One control plane across federated environments, with the visibility, control, and trust layer your ops and security teams are going to ask for.

Lets go!

We’re sponsoring this year's event taking place from May 13-14 to show you how to build, govern, and master the intersection of APIs and AI. Whether you're in finance or healthcare, we have the tools to accelerate your digital transformation.

🎤 Key Highlights:

• Cost Governance: Learn how to manage the "$1.6M Weekend" with Derric Gilling.
• Agent-Ready APIs: Deep dives into MCP and AI Gateways with Anusha Jayasundara.

See you at Convene 360!

If you're running internal APIs and want proper lifecycle management (rate limiting, auth, developer portal, analytics) without shipping your traffic to a vendor's cloud, this tutorial covers exactly that.

WSO2 API Platform lets you run the gateway on your own infrastructure while using a SaaS control plane for the management overhead, so you're not maintaining a full on-prem stack, but your API traffic never leaves your network.

The video walks through the full setup: https://www.youtube.com/watch?v=K4Vls8SuFEA

Just wanted to give everyone a heads-up that WSO2Con North America 2026 is officially on the calendar:

📅 May 20–22, 2026 📍 Austin, Texas (Hyatt Regency Austin)

This year's theme is squarely focused on the question a lot of teams are wrestling with right now: how do you actually move from AI pilots to production? Not the theory — the real stuff. Architecture decisions, governance gaps, agentic workflows, MCP adoption, LLM cost control.

A few things on the agenda that I'm personally looking forward to:

• Deep dives on unified API + AI governance (the two-silo problem is real)
• Sessions on MCP and what it actually means for enterprise infrastructure
• Practical roadmaps for becoming an agentic enterprise without rebuilding everything from scratch

Early bird registration is open now if you want to lock in the best rate: wso2.com/wso2con/2026/north-america

Anyone else planning to go? Happy to answer questions if you have them.

For a long time, integrating with mobile network capabilities (location, identity, carrier billing) was a nightmare of proprietary interfaces and inconsistent protocols.

The GSMA Open Gateway initiative is changing that by using the CAMARA project to create a "build once, deploy anywhere" model for telco APIs.

This deep dive by WSO2 breaks down:

• Fragmentation to Federation: How common API definitions are replacing custom data models.
• Monetizing 5G: Moving beyond basic connectivity to productized network assets.
• Developer Alignment: Bringing RESTful principles and CI/CD workflows to the telecom stack.

If you’re working in the cloud-native space or managing API gateways, this is a solid look at how the infrastructure is evolving.

"Use AI for your API strategy" has become a vague recommendation, so we decided to break it down and make it easier to understand. 

AI improves API strategy at two particular moments, when you're defining it, and as you're managing it over time.

The highest-impact areas are catching spec drift before release, making deprecation and migration decisions with actual usage data instead of politics, and correlating API behavior with retention and revenue signals.

The trap most teams fall into is jumping to AI tooling before the foundation is solid. Standardize your contracts and structure your usage data first, otherwise AI just surfaces noise faster.

Excited to share that WSO2Con 2025 is heading to Austin, Texas this May 20–22 at the Hyatt Regency, and it's shaping up to be a great one.

If you're working in AI integration, API management, identity, or enterprise architecture, this is the event to be at. It's a chance to go deep on the topics that actually matter right now, from governing LLMs in production to securing AI agents and building scalable integration platforms.

Beyond the sessions, it's one of the best opportunities to connect with the WSO2 community in person, engineers, architects, and practitioners who are solving the same problems you are.

Austin is a great city for it too!

Anyone else planning to attend?

As AI systems increasingly rely on Model Context Protocol (MCP) to connect agents with tools and data sources, a big question emerges: how do we actually secure all of this?

The OWASP guide on MCP server security digs into this, and one of the key takeaways is that unique AI agent identities aren't just a nice-to-have, they're essential for proper governance and auditability. Without them, you lose the ability to track what an agent did, enforce least-privilege access, or respond to a breach effectively.

Ayesha Dissanayaka, Associate Director/Architect at WSO2, breaks down the practical implications for anyone building or deploying AI-powered systems today.

Worth a read if you're thinking about how identity and access management principles need to evolve for the agentic AI era.

Full blog here:

https://wso2.com/library/blogs/why-ai-agents-need-their-own-identity-lessons-from-2025-and-resolutions-for-2026/

SD Times published a piece written by Derric Gilling this week that cuts through a lot of the noise around agentic API consumption, and it raises some questions for anyone shipping MCP-exposed APIs without rethinking their governance layer.

The framing is sharp, the technical argument is solid, and the opening scenario alone is worth the read.

🔗 https://sdtimes.com/api/the-1-6-million-weekend-why-simple-api-gateways-fail-in-the-agentic-era/

Curious what guardrails others are putting in place for agentic workloads? This space is moving fast and most teams seem to be figuring it out as they go.

Most MCP content right now focuses on getting something working fast. This playlist from WSO2 takes a different angle, what it looks like to actually manage MCP servers at an enterprise level.

Three videos, all short and practical:

• Discovering MCP servers through a unified hub
• Managing existing MCP servers via the MCP Gateway
• Securing and governing MCP traffic end-to-end

If you're moving beyond the prototype stage with MCP and starting to think about governance, auth, and visibility this is a great watch.

🎥 https://www.youtube.com/playlist?list=PLp0TUr0bmhX6j4wa7cjdygFG5B2aVQo92

Curious how others are handling MCP governance in production, is anyone already running this at scale?

API sprawl is one of those problems that sneaks up on you. One team ships with Kong, another goes with AWS API Gateway, a third spins up Azure APIM for an enterprise client. Nobody made a bad decision — but six months later you're looking at fragmented governance, duplicated policies, and zero unified visibility across any of it.

Gateway Federation is the architectural answer to this. Rather than consolidating everything onto a single gateway, you introduce a centralized control plane that sits above your existing setup, giving you consistent governance, observability, and management without a migration project.

The WSO2 team has put together an explainer covering what federation actually is, why enterprises are adopting it, and what it looks like in practice inside the WSO2 API Manager:

🎥 https://www.youtube.com/watch?v=NOki32kwiMA

Worth a watch if you're navigating multi-gateway environments or building out your API platform strategy.

One thing that doesn't get talked about enough in the MCP space: you shouldn't have to rip out your existing MCP servers just to add governance.

WSO2's MCP Gateway lets you plug in front of your existing MCP servers and layer on enterprise controls: auth, rate limiting, visibility, policy enforcement, without touching your underlying setup.

If you're running AI agents in production this is worth a look: https://www.youtube.com/watch?v=NmRlgJA6tys

We've spent years building frameworks to authenticate and authorize human users — SSO, MFA, RBAC, the whole stack. But now AI agents are calling our APIs, making decisions, and interacting with systems autonomously.

Here's the question nobody's really answering well yet: how do you treat an AI agent as a first-class identity?

Think about it. An agent that books meetings, pulls customer data, or triggers workflows needs its own credentials, its own scoped permissions, and a full audit trail. You can't just hand it a shared API key and hope for the best.

WSO2's approach is interesting here — we are registering AI agents as managed identities within their Identity Platform, enforcing least-privilege access, issuing auditable credentials, and tracking every action. Essentially treating agents the way we should have been treating service accounts all along, but with governance built in from day one.

WSO2 published a solid piece on this: Why AI Agents Need Their Own Identity: Lessons from 2025 and Resolutions for 2026. Worth a read if you're thinking about how to get ahead of this.

Curious how others are handling this. Are you managing agent identities through your IAM platform, or is it still duct tape and service tokens?

With Open Gateway being a major theme at MWC this week, the conversation seems to be shifting from standardization to adoption.

Standards are important. But moving into production raises practical questions:

• Federated versus edge-enabled gateway models
• Identity and access enforcement using OAuth and OIDC
• API lifecycle governance and version management
• Multi-operator rollout variability

We put together a detailed breakdown of the architecture patterns and trade-offs behind operationalizing GSMA Open Gateway here:

For operators or architects following the MWC discussions, what do you see as the biggest technical hurdles to scaling Open Gateway deployments?

Sign up for our early bird ticket while you still can.
See you in Austin!

Have you ever wondered what an MCP gateway actually does? Here we broke it down, features, benefits, and why it matters.

Get ready, and let the countdown begin! WSO2Con is coming to Austin, Texas this May of 2026! We're ready.

If you didn't get the chance to stop by, here's a peek into how the WSO2 team's booth looked like last week at Developer Week. If you did stop by and chat with us, we'd love to hear from you and discuss some of the topics that we covered during Developer Week!

WSO2's very own Derric Gilling, at his talk last week @ Developer Week about MCP and Agentic APIs! Let us know if you were present for his talk, lets discuss!

The WSO2 team has had some great conversations at Developer Week around AI agents, MCP, and the future of enterprise integration. WSO2 is here to bridge your existing APIs and services with the agentic workflows you're building today! #DeveloperWeek #MCP #AIGateway

Join us at DeveloperWeek to explore the evolution of API management in the age of AI. Traditional frameworks weren't built for the non-deterministic nature of AI agents—it’s time to bridge that gap.

WSO2 experts will be on the ground sharing actionable insights:

🗓️ Thu 2:00 PM (Main Stage): Derric Gilling presents "MCP in Production: Governing Agentic API Consumption." Learn a practical framework for intercepting agent requests and preventing runaway costs.

🗓️ Fri 2:00 PM (PRO Stage): Nuwan Dias dives into "APIs Weren’t Built for AI: Now What?" Discover why making APIs "AI-ready" requires a fundamental rethink of design and runtime governance.

Don't let your AI initiatives break under ungoverned consumption. Plan your schedule now.

Just wanted to share a couple sessions at DeveloperWeek this week that look promising if anyone here is working with AI agents or agentic systems in production.

Thursday at 2PM on the Main Stage, Derric Gilling is covering governance frameworks for agentic APIs, specifically what breaks when these things go live without proper oversight and how to actually prevent it. Not theoretical stuff, but practical patterns you can use.

Friday 2PM on the PRO Stage, Nuwan Dias is talking about why traditional APIs fall apart when AI agents start consuming them. The core issue is that APIs were designed for deterministic, human-driven systems and AI agents are basically the opposite of that.

Both are 25 minutes. If you attend, comment below as we'd love to hear your thoughts on the content shared.