AI agents are multiplying fast — but who is actually governing the traffic between them? At PlatformCon Live Day London 2026 I stopped by the Gravitee sponsor booth and spoke with Charlie Dyson about how the company evolved its API and real-time event-stream management heritage into a full agent management platform for the AI era.
From API Gateway to Agent Management Platform
Gravitee’s pitch is built on a specific insight: agent traffic is not a new kind of network call that needs an entirely new tooling category. It is API traffic and event-stream traffic with a different consumer at the end of it, which means a platform that already knows how to secure, govern, discover, and observe APIs is closer to solving agent governance than a greenfield tool would be.
The platform now covers the full stack an agentic system actually generates traffic across:
- MCP — the protocol connecting agents to tools and data sources
- LLM traffic — requests and responses flowing to and from the models themselves
- Agent-to-agent traffic — the newest and least mature category, where one agent calls another directly
Building agent governance on top of proven API and event-stream management foundations rather than starting over is a sound bet. Most of the hard problems — authentication, rate limiting, schema validation, audit logging — were already solved for APIs; extending them to cover MCP and agent-to-agent calls is incremental work, not a rewrite.
Trusted at Scale
Gravitee’s customer base — McDonald’s, Open Energy, ClearScore among the names mentioned — signals this is not a speculative pivot chasing the AI hype cycle. These are organizations with existing API management stakes who are now routing agentic traffic through the same governance layer they already trust for everything else.
Charlie put the moment plainly: “We’re on a rocket ship at the moment.” That tracks with the broader pattern across the PlatformCon booth floor — every API and security vendor with an existing governance story is repositioning it for agents, because the underlying problem (traffic between untrusted or semi-trusted endpoints needs policy enforcement) has not changed, only the identity of the caller has.
Related Reading
- PlatformCon London 2026: The AI Era Runs on Platforms
- Your IDP Is the Foundation for Agentic AI
- Production Guardrails for AI Agents
- OWASP Top 10 for LLM Applications
About the Author
I am Luca Berton, AI and Cloud Advisor. I work at the intersection of platform engineering, cloud security, and enterprise AI deployments. Book a consultation.
