AI Agents often reach enterprise APIs and MCP tools through a gateway. This makes the gateway a natural control point for authorization, and a natural vantage point for seeing what Agents actually do.
PlainID integrates smoothly with leading gateways through dedicated Authorizers. Each Authorizer plugs into the gateway you already run, with minimal configuration. You don't need to modify your Agents, MCP servers, or upstream services, or reroute any traffic.
Each Authorizer serves two roles:
- Enforcement: The Authorizer acts as a Policy Enforcement Point (PEP). It sends the Identity and request context to the PlainID Policy Decision Point (PDP) and enforces the decision before the request reaches the upstream service.
- Discovery and insights: The gateway serves as an interception point for agentic activity. As Agents call APIs and MCP tools, PlainID discovers the Agents and tools in use and creates them in the Platform. You can then use them to author Policies and to gain insights into how Agents access your resources.
You manage Policies centrally in the Platform, and a Policy change takes effect on the next call, with no changes to Agents or upstream services.
PlainID currently supports the following AI Gateways:
- Kong Gateway: a single plugin enforces Policies on both MCP tool calls and REST API calls. For MCP servers, it filters which tools each Agent can see and use. For permitted calls, it can also mask sensitive response fields based on the calling Identity. See Kong Gateway.
- Azure API Management (APIM): applies fine-grained, Policy-based access control to APIs exposed through APIM. The Authorizer evaluates each request in real time based on Identity, roles, and request context, and then allows or denies it. See Azure API Management Authorizer.
.png)