API Management & Integration
3 pieces from Duczer East's engineers on the integration layer of a regulated enterprise: API management, the platforms that move data between systems, event-driven architecture, and the strategy that decides which of them owns what.
What this topic is about
Every regulated enterprise runs an integration layer, whether or not anyone designed it. APIs expose core systems to partners and channels. An integration platform, an ESB or a set of point-to-point interfaces moves data between applications. An event broker carries changes as they happen. Over time these grow into an estate that nobody owns end to end, and that estate is also a control surface: every API, every flow and every stream has to be secured, monitored and explainable to an auditor.
The guides in this collection are written for the people who have to make that estate work. They cover the patterns rather than the products: what event-driven architecture is and when it beats request-response, how an iPaaS, an ESB and an event-streaming platform differ and where each one fits, and how to set an integration strategy that moves a firm from point-to-point interfaces to a governed layer without a big-bang replacement. Where a product is named, it is as one option among several. The first three guides publish the week of November 2. The WSO2 guides that follow cover the platform in production: upgrades, deployment on Kubernetes, throttling and the move from Choreo to Bijira and Devant.
AI traffic now runs through the same layer. The gateway that sits in front of model calls, the protocol an agent uses to reach a tool, and the controls that decide what an agent may do are integration decisions as much as governance ones. Three pieces on that boundary are listed below. The full treatment of agent identity, permissions and model risk is in Agentic AI Governance & Model Risk. Keeping models fed with current data from core systems, through change data capture and streaming inside the perimeter, is covered in Private AI & Data Architecture.
Where AI traffic meets the integration layer
Three pieces on the gateway, the protocol and the controls that now sit between AI agents and enterprise systems. They are part of Agentic AI Governance & Model Risk and are listed here because the integration layer is where the work happens.
-
What Is an AI Gateway, and When Do You Need One
A guide to the policy enforcement point for model traffic: what it does that an API gateway cannot, where it sits, and when to skip it.
12 min read -
Governance Runs on Rails: AI Controls in the Integration Layer
Policies and prompts cannot enforce what an agent does at two in the morning. The gateway, the identity platform and the logs can.
6 min read -
MCP Is a Context Protocol. Most Enterprises Are Letting It Become an Authorization Model.
The API-versus-MCP debate sits one layer above the decision that matters.
8 min read
An integration layer built to be governed, not just to run
Duczer East designs, builds and runs API management, integration and event-driven architecture for regulated enterprises across WSO2, MuleSoft, Apigee, Kong, Boomi, Kafka and message queues, with the policy enforcement and evidence trail an auditor will accept.
For the event layer itself, see event-driven architecture consulting. For keeping a live estate running, see WSO2 support and managed services and Kafka support.