Most enterprises run APIs and AI assets on multiple gateways. While teams choose the best tools for their specific context, these decentralized decisions quickly create silos that obscure the full picture of an organization’s digital estate.
Until recently, governance was limited to MuleSoft-managed APIs. Assets on Kong or other hyperscalers lived in separate consoles managed by disconnected teams, leaving central architects with no visibility, let alone the ability to remediate gaps. MuleSoft’s enhanced experience now bridges this gap by supporting policy scanning and application across federated APIs.
Policy scanning is already live for Kong, AWS API Gateway, Azure API Management, and Apigee. Full policy enforcement is active for Kong today, with the remaining vendors following in September 2026—offering one control plane and real enforcement without requiring any re-proxying.
The Gateway Reality
Large organizations face a simple truth: an API portfolio spread across multiple vendors results in fragmented control and inconsistent security. This operational reality is best described by the practitioners managing it:
“We have APIs on Kong, Apigee, and MuleSoft. Each has its own policy model, its own console, its own set of admins. Proving compliance means pulling reports from three different systems and hoping they’re current.” – Enterprise Platform Architect
“We found out a payment API on Kong was missing rate limiting after an incident. By the time we traced it and got the right team to apply the fix, the gap had been open for weeks.” – Security Architect
“We want one control plane. We don’t want to re-proxy everything through MuleSoft, we just want to govern it from there.” – API Program Owner
These aren’t edge cases; they are the standard conversations following audits or security incidents. Because the multi-gateway estate is here to stay, governance must evolve to meet it where it lives. This evolution starts with expanding the technical foundation to cover modern requirements.
Broader Spec Coverage, Flexible Rulesets, and Deeper Security Signals
As APIs and the specifications describing them evolve, customers’ governance programs must keep pace. This month, MuleSoft API Governance closes critical gaps by introducing wider specification coverage, flexible rulesets, and deeper security signals through our Akamai partnership, all while expanding into new regions.
Rulesets that flex with you
With Ruleset Customization, customers can now adjust severity levels directly on out-of-the-box rulesets without duplicating them. We’re also rolling out Natural Language Ruleset Generation: describe the policy you want in plain language, and generate the corresponding ruleset instead of authoring it by hand.
A deeper security signal, from our Akamai partnership
Our partnership with Akamai brings Akamai API Security’s discovery of shadow APIs and MCP servers into MuleSoft’s governance layer. Akamai-discovered findings now flow into MuleSoft’s’s conformance reporting, giving teams one governance view across MuleSoft-managed and externally discovered assets.
Policy Scanners: Know What’s Actually Running
To move beyond static reporting, governance must reflect reality. While traditional tools rely on stale snapshots, our policy scanners surface the live runtime state—what is actually applied on each instance right now. MuleSoft federated scanner ingests APIs from providers like Kong with no endpoint changes, normalizing runtime policies into four canonical categories: Access & Security, Performance & Cost, Data Privacy & Integrity, and Compliance & Observability. This unified approach delivers:
- Real-time visibility into which policies are applied on every provider, not what was intended, what’s actually there
- Instance-level gap detection to see which APIs are missing authentication, rate limiting, TLS, logging, and exactly which gateway instance they’re running on
- A single conformance dashboard across MuleSoft-native and third-party APIs, continuously updated from one control plane
With this real-time visibility, conformance shifts from a quarterly report to a live, actionable dashboard. However, visibility is only the first step toward total control.
Policy Application: Fix It Without Leaving MuleSoft
Visibility without action only documents problems; policy application closes the loop. When a scanner identifies a missing rate limit on a Kong-managed payment API, there is no need to switch consoles or file tickets. The fix is applied directly to the instance from the same screen in seconds.
Policy application to Kong gateways is available today. Teams with Kong instances connected to MuleSoft can:
- Apply governance policies directly to Kong APIs from the MuleSoft control plane
- Remediate policy gaps without gateway-specific expertise or context switching
- Complete the detect → review → apply cycle in a single, auditable workflow
- Reduce remediation time from days to minutes
What’s on the Roadmap
With policy scanning now GA across all four gateways, the next milestone is policy enforcement for AWS API Gateway, Azure API Management, and Apigee — coming in September 2026.
The model is consistent:
One control plane. One governance ruleset. Applied consistently — whether the API lives on MuleSoft, Kong, Apigee, AWS, or Azure.
No re-proxying. No migration. No gateway-specific policy authoring for each vendor. Define rate limiting, authentication, TLS, and data protection once. MuleSoft translates each policy to the gateway’s native implementation — no per-vendor expertise required.
