## A governed ecosystem for enterprise AI
Enterprise AI has moved from pilots to production faster than most governance programs could keep up. Agents now run across every major cloud and model provider, built by central teams, business units, and developers alike. Each one reasons with models, calls tools, reads data, and increasingly hands work to other agents.
The ServiceNow Super Intelligence Control Tower is ServiceNow's answer: a central hub to discover, secure, govern, observe, and measure AI across any system, agent, or asset in the enterprise.
The Control Tower Alliance extends that hub into the larger AI governance ecosystem. This means into the inference providers themselves, into payments and monetization, security, and — with Kong specifically — AI Connectivity.
The alliance matters because it accepts something the industry has been slow to say out loud. As Amit Zavery, ServiceNow's president, chief product officer, and COO, put it in today's announcement, "no single solution, no matter how powerful, can see everything, protect anything on its own." AI governance is now an ecosystem problem. The companies that build models, run clouds, secure agents, and connect them have to work together, around a shared system of record, so customers get governance from day one rather than bolting it on later.
## A control tower is only as good as what it can see...and enforce
The control tower metaphor is a good one, so it's worth taking seriously. An airport control tower doesn't just keep a register of aircraft and pilots. It sees the airspace in real time, every flight on radar, and it can direct any one of them at any moment. Its authority comes from that live view.
AI governance works the same way. Most enterprises can now write down their AI policy: which models are approved, which data an agent may touch, who owns each system, and what a team may spend. Far fewer can show that policy holding on every live request. And even fewer can actually *enforce *that policy for every request.
The hardest parts of governance happen at the moment an agent calls a model, invokes a tool, reads data, or hands off to another agent. A control tower that can't see those moments, or act on them, is **only governing on paper**.
That's why Kong and ServiceNow belong in this alliance together. ServiceNow brings the organizational view: the inventory of AI assets, who owns them, how risky they are, and what the business has decided they may do. It's where policy is defined, approved, and tracked, on a platform that already runs more than 100 billion workflows a year. Kong brings deep runtime experience and expands the Control Tower's reach into runtime connectivity. Kong sits in the path of the traffic itself, between agents and everything they connect to, where policy either holds or it doesn't. An AI control tower needs both.
If the organizational control tower decides what AI is allowed to do, something has to make sure it actually happens, on every request, in real time. That is the runtime control tower, and it's what Kong is built to be.
A runtime control tower has four jobs:
- - **See every connection: **Agents talk to models, MCP tools and APIs, data and event streams, and other agents. The runtime control tower sits in all of those paths, across every cloud, model provider, and deployment model.
- - **Know who is calling: i**t verifies which agent is making each call and carries the identity of the person it acts for to every downstream service.
- - **Enforce on every request:** It authorizes access against policy, guards prompts and responses for sensitive data and unsafe content, and caps consumption before a budget is blown, not after the invoice arrives.
- - **Measure what actually happened--deeply: **It meters tokens and attributes them to the team, application, and agent, and it logs and traces every call so there's evidence that policy held.
Kong Konnect, with Kong AI, API, and Event Gateways at its core, does this today for the AI traffic enterprises *already* run through Kong.
The runtime control tower also has to be neutral. Enterprises run AI across AWS, Google, Microsoft, OpenAI, NVIDIA, and their own infrastructure, often all at once, and each platform governs only its own traffic. Model leadership changes week to week, sovereignty rules keep arriving, and open-weight models keep getting better. We call the answer **strategic portability**: one runtime policy across every platform, so teams can change providers without rebuilding their controls.
Put the two towers together and governance becomes a loop. Policy is defined in the organizational control tower, enforced and measured in the runtime control tower, and evidence of what happened flows back to the people who own the policy so they can refine it.
The organizational control tower knows what should happen. The runtime control tower makes sure it does and reports what actually did.
Today is the start. Over the coming months, we'll have much more to share about how Kong and ServiceNow will work together within the alliance, and what that means for customers building their AI control tower across both the organization and the runtime.
In the meantime, the enterprises that scale AI safely will be the ones that can decide policy once, enforce it everywhere, and prove it held. We're glad to be building toward that with ServiceNow and the other founding members.
Learn more about the [ServiceNow Control Tower Alliance](https://newsroom.servicenow.com/press-releases/details/2026/ServiceNow-launches-Control-Tower-Alliance-to-help-enterprises-adopt-AI-safely-at-scale/default.aspx)ServiceNow Control Tower Alliance, and see how[ _Kong AI Gateway_](https://konghq.com/products/kong-ai-gateway) _Kong AI Gateway_ governs AI traffic today.
**Topics**
Alex Drag
Head of Product Marketing
# AI Token Cost Management: Why AI Spend Gets Out of Control (and How To Fix It)
This post is based on Kong's webinar on token cost management. Watch it below, or keep reading for the breakdown. Token cost management is how a business tracks, controls, and governs what it spends on AI model usage, the same way it already track
Kong
# Your Multi-Agent System Is Only as Reliable as Its Context Layer
Multi-agent workflows live and die on context. Every agent-to-agent call and every agent-to-tool call is either a retrieval — fetching information the agent needs — or a mutation — changing state that downstream agents will depend on. At prototype s
Hugo Guerrero
# The Architecture Decision Your Multi-Agent System Will Live With
Multi-agent systems are, at their core, context distribution systems. Every agent in your workflow is a consumer and producer of context. The interesting architectural questions are all about how that context moves. Two operations drive everything:
Hugo Guerrero
# How AI Agents Communicate: Managing Context in Multi-Agent Workflows
An AI agent isn't magic. It's a reasoning engine that makes decisions based on what it knows at a given moment. That "what it knows" is its context — the information available to it right now. Context is everything. Give an agent the wrong context,
Hugo Guerrero
# A New Dawn: Enterprise AI's Shadow — Trillions of Tokens, Zero Governance
You Can't Govern What You Can't See AI spending will reach $2.59 trillion in 2026. I regularly like to share what we're seeing in production at Kong. Not projections or analyst forecasts, but actual traffic flowing through Kong AI Gateway from
Augusto Marietti
# Stop Patching. Start Building: The Kong Context Mesh Stack
Your infrastructure already has the raw materials: compute (VMs, containers, serverless), event streaming (Kafka, Kinesis, Pub/Sub, RabbitMQ), data stores (warehouses, databases, object storage), and AI endpoints (any hosted or self-hosted LLM). Tho
Hugo Guerrero
# From Microservices to AI Traffic — Kong as the Unified Control Plane
The Anatomy of Architectural Complexity Modern architectures now juggle three distinct traffic patterns. Each brings unique demands. Traditional approaches treat them separately. This separation creates unnecessary complexity. North-South API Traf
Kong
