# How Kong’s AI Gateway Governs Autonomous Agents for EU Payment Compliance

This talk explains how Vipps MobilePay is building trust and governance for autonomous agents in a tightly regulated Nordic payments environment. Because agents can access personal data, move information across systems, and make their own tool and model choices, the team argues that controls cannot live only inside each agent; they need centralized enforcement. Their approach uses Kong AI Gateway plus a YAML-based contract that defines an agent’s identity, owner, model class or specific model, personal-data rules, rate limits, and cost center. That contract is created through Backstage, reviewed in GitHub, and automated into Kong policies and agent identities using OAuth2 and Microsoft Entra tokens. Kong then validates tokens, routes requests, strips PII before data leaves the environment, enforces model access and rate limits, and provides observability for logging and cost attribution. The team’s next priorities are model routing, caching, prompt compression, and learning from usage before agent scale reaches hundreds or thousands.