Postman adds security controls for AI agents, APIs, and MCP servers

Postman has released Fabric Gateway, a protocol-agnostic control plane designed to govern how AI agents, LLMs, and MCP servers discover and interact with APIs, tools, and other agents. This system allows organizations to securely connect AI agents to internal resources while centrally controlling agent discovery, access, and actions without relying on fragmented integrations. The development is driven by the observation that existing infrastructure is insufficient for managing autonomous systems collaborating across APIs, especially given the projected need to replace or supplement current API gateways in the context of rising AI workloads.
The core functionality of Fabric Gateway encompasses unifying control over the entire lifecycle: API and agent discovery, design, identity, policy, and governance, all managed through a single gateway deployed within the organization's cloud. Key capabilities include a unified registry that consolidates various surfaces under one endpoint, policy enforcement based on context rather than protocol, centralized oversight for security teams, built-in reliability via fallback mechanisms, and compliance enforced by authenticating and logging interactions before execution.

* Postman announced the general availability of Fabric Gateway.
* Fabric Gateway is a protocol-agnostic control plane for governing AI agents, LLMs, and MCP servers.
* Organizations can use Fabric Gateway to securely connect AI agents to APIs while centrally controlling discovery, access, and actions.
* The need arises because existing infrastructure was designed for applications and human users, not autonomous systems.
* Gartner predicts 80% of organizations will replace or significantly supplement API gateways by 2029 due to the rise of AI workloads.
* Robust support for emerging protocols like Model Context Protocol (MCP) and agent-to-agent (A2A) communications is deemed essential.
* Postman CEO Abhinav Asthana stated that if agents cannot access APIs, the business becomes irrelevant.
* Fabric Gateway routes, governs, and observes LLMs, MCP servers, agents, and internal APIs through one gateway.
* Key capabilities include a unified registry for agent-facing surfaces.
* Policy enforcement is context-driven across HTTP, gRPC, MCP, or A2A interactions.
* The system provides centralized oversight of agent actions, identities, and multi-agent collaboration.

The narrative positions the emergence of agentic AI not just as an application layer shift, but as a fundamental challenge to the established infrastructure paradigms built around traditional API gateways. The core tension lies between decentralized, autonomous agent behavior and the need for centralized, deterministic governance. The argument suggests that the architectural gap is not merely one of integration but one of systemic control—infrastructure designed for human-centric applications cannot inherently manage the complex, dynamic interactions inherent in multi-agent systems.
The emphasis on "policy-driven, not protocol-driven" highlights a necessary abstraction layer: the underlying communication protocols (HTTP, gRPC, MCP) are secondary to the abstract need for least-privilege access and context-aware authorization governing agent capabilities. This shifts the security focus from securing transport layers to securing the semantic relationships between agents and data. The pattern observed is the necessity of abstracting complex computational reality into manageable governance constructs. The implication for agency is that if infrastructure dictates capability boundaries, then controlling that infrastructure becomes a prerequisite for exercising autonomous capacity.
What assumptions underpin the call for this type of unified control? It assumes that security, identity, and access must be governed by a single, overarching lifecycle management system rather than being bolted on sequentially. Who benefits from maintaining fragmented toolsets versus adopting a centralized Fabric Gateway? The fragmentation benefits those who can deploy disparate, siloed integrations; the gateway benefits an organizational structure seeking scalable, consistent control over emerging computational entities. Where does the cost of this "compliance by design" fall when implementation requires redefining foundational API interaction models across heterogeneous protocols like MCP and A2A?