The Problem: As organizations adopt agentic AI, a massive gap exists between compliance approvals and network reality.

Often, AI governance is relegated to manual reviews and "paper approvals," meaning network firewalls and gateways have no context regarding which AI tools are actually approved for use.

This fragmented approach leads to inconsistent, bolt-on governance where unapproved or highly risky agents and MCP tools might still be accessible to developers or autonomous agents, creating severe security liabilities.

**Kong** and **ModelOp** bridge this gap by seamlessly connecting governance intent with operational enforcement.

**Kong** is the industry's leading unified API/AI platform, purpose-built to bring APIs, AI traffic, event-driven systems, and microservices into one operating model. In the agentic era, Kong's AI Gateway serves as the critical infrastructure for routing, securing, and observing traffic to large language models (LLMs), Model Context Protocol (MCP) servers, and agent-to-agent (A2A).

Kong AI Gateway helps organizations control costs with token-based throttling, reduces latency through semantic caching, manages and balances the load across multiple GenAI models and enforces the battle-tested runtime required to securely expose APIs and AI tools at a Fortune 500 scale. Kong AI Gateway also provides extensive capabilities to define guardrails, controls the MCP servers consumption with OAuth2 standards as well as protects sensitive personal information.

**ModelOp** is the Enterprise AI Command Center, providing a centralized AI System of Record for all machine learning, GenAI, and agentic models. Designed to cure AI delivery gridlock, ModelOp's AI Delivery Engine (MADE™) automates the end-to-end AI lifecycle. By orchestrating reviews and approvals across Data Science, Security, and Legal teams, ModelOp ensures 100% policy adherence and drastically accelerates time-to-value without requiring additional headcount.

ModelOp acts as the "brain," evaluating AI use cases against corporate policies and calculating risk. When a tool is approved in ModelOp Center, it automatically triggers an integration with Kong, acting as the "muscle", to dynamically create an API route and allow traffic. If an AI tool is unapproved or revoked, Kong natively blocks all access, delivering mathematically guaranteed, zero-trust AI security.

This diagram illustrates a comprehensive architecture for AI governance and runtime security. Developers, corporate apps, and autonomous agents generate prompts and MCP requests that flow into the system.

At runtime, the Kong AI Gateway Data Plane Node acts as the A2A, LLM, and MCP traffic controller. On the other hand, the ModelOp Risk Tiering & Control Mapping integrates with the Konnect Control Plane to ensure governance through configuration management, asset discovery, and lifecycle approval workflows

Here is a look at the automated workflow in action when an enterprise requests access to a new MCP tool:

1. - Registration & Discovery: The workflow begins when a new MCP tool is detected by ModelOp discovery service, and automatically imported into inventory within ModelOp Center.
2. - Automated Risk Assessment: Upon import, ModelOp’s agile life cycle engine automatically evaluates the tool, calculating a draft risk tier. The system's decision logic immediately applies relevant enterprise controls—such as NIST AI RMF or NAIC guidelines—based on factors like target geography and external data routing. Finally, an approval request is generated and assigned to the appropriate team for review.
3. - Active Network Blocking: During risk assessment, ModelOp queries Kong Gateway to determine whether the tool has been configured in Kong or not. Upon determining it has not been configured, ModelOp then instructs Kong to actively block all client connection attempts to the MCP server, enforcing a strict zero-trust posture.
4. - Governance Approval: The approver reviews the request associated with the new tool and acknowledges any controls or risks and officially approves the tool's usage for that specific use case in ModelOp.
5. - Dynamic Runtime Enforcement: Upon approval, ModelOp automatically signals Kong to instantly update its policies, allowing authorized users or agents to securely access the tool through the gateway, with all usage meticulously tracked for enterprise-grade observability.

ModelOp governs the AI lifecycle. Kong delivers the zero-trust API edge. Together, we are eliminating the gap between AI governance policies and operational reality. By automating the "last mile" of AI deployment, enterprises can confidently scale their AI and agentic innovations, knowing that unbreakable API security and absolute compliance are mathematically guaranteed for every single request.

Kong’s **Technology Partner Program** is designed to accelerate innovation through trusted integrations and enterprise-grade plugins. Every plugin is rigorously tested against the latest Kong releases and backed by dedicated engineering support, ensuring reliability at scale.

For customers, the program delivers a richer developer ecosystem with seamless, secure integrations and access to advanced AI-driven security. For partners, it opens the door to direct collaboration with Kong’s engineering team, enabling them to fine-tune solutions for the most demanding enterprise environments.

This architecture establishes Kong as the backbone of AI connectivity and governance, linking agents, MCP servers, and LLMs, while ModelOp provides the critical runtime security layer.

Together, they enable a next-generation agentic AI platform: agents collaborate seamlessly, tools are dynamically discovered through MCP, LLMs are managed behind a governance framework, and every interaction is secured, observable, and policy-driven.

Experience the integration firsthand. Visit [_modelop.com_](http://modelop.com)_modelop.com_ and [_konghq.com_](http://konghq.com)_konghq.com_ to schedule a demo, or explore the [Kong Partner Program](http://konghq.com/partners)Kong Partner Program[](http://konghq.com/partners).