The Agentic Enterprise: Bridging the Gap Between API Management and AI Innovation

00:00:10: Hi, I'm your host Michael Doudin and here with me today is Dr.

00:00:12: Matthias Biel expert in API strategy.

00:00:15: Welcome Matthias!

00:00:16: And thank you for joining me today.

00:00:18: Thanks such a pleasure to be here.

00:00:21: Thank You Awesome.

00:00:22: So we were in London together In the last few weeks where gave it talk Enterprise APIs at MCP The missing link to AI innovation.

00:00:33: Can you please explain how MCP enables AI innovation With APIs?

00:00:39: Yes, absolutely.

00:00:41: So the first question I like to ask always is why do we care about these subjects right?

00:00:47: Why APIs, YMCP and so forth?

00:00:50: And when i talk to my clients then very much here in last let's say six months through a year that they get requirements from top level management About becoming AI ready Becoming agent ready, and that's where MCP plays a role.

00:01:11: So what these top-level management people want to have is an agentic enterprise—that's the vision they strive for right?

00:01:21: And an agenting enterprise means just imagine it in every department or every role of organization you will AI agents sitting right next to the people who are already filling this role.

00:01:35: So you will, as a worker in an big enterprise have colleagues that are AI agents and those AI Agents.

00:01:44: um we'll need to be enabled.

00:01:46: they will need to Be built And there will need To be build for each specific Enterprise because Those AI agents Are only effective if They can leverage The data and the functionality of that specific enterprise.

00:02:01: And, that's how we come to the topic of MCP and APIs right?

00:02:06: AI agents are all about LLMs in new AI models but...and it gets forgotten so much!

00:02:12: They're also about leveraging data.

00:02:14: Those models have generic knowledge they've read all the Wikipedia articles basically But don't know anything about this specific enterprise The specific customers or systems.

00:02:26: you need connect And that happens via MCP.

00:02:29: Now, building MCP is the model context protocol.

00:02:33: it's very similar to APIs.

00:02:35: It's all about interfaces and I like to talk about interfaces.

00:02:39: for a long time right?

00:02:40: That have been in this API space.

00:02:42: we've mostly talked about RESTful APIs so thats kind of the protocol We use but the principles and concepts behind making things accessible programmatically are also applying to MCP.

00:02:58: So each organization will, next to their API landscape in the future have to build an MCP landscape that can be leveraged by those AI agents.

00:03:08: and yeah so that's why I talk about it!

00:03:12: And now we could come to your question.

00:03:15: if you want to ask a question again for...

00:03:17: Yeah of course How does MCP enable AI innovation with APIs?

00:03:23: And to piggyback on something you said earlier, is it a kind of parallel to your API landscape or do they sit on top each other.

00:03:32: Very good question!

00:03:33: So... APIs have been there first.

00:03:38: lots of organizations have built APIs for the last ten years.

00:03:43: Lots of investment, lots of expertise also Is already in APIs and those restful APIs and that can be leveraged now.

00:03:52: And you can basically go a small step on top of your existing API landscape, enable all these APIs, RESTful APIs... ...and kind of automatically transform a couple of those APIs in your landscape.

00:04:07: We could talk about which one should be considered for being upgraded into MCP?

00:04:14: Yeah!

00:04:14: You take those And it's not a lot of work to get MCP interfaces out of them, which then those agents can use.

00:04:24: Now... Which of the existing APIs makes sense?

00:04:30: To be transformed into MCPs?

00:04:31: sometimes people ask me and for new API that I'm supposed to build shall i only built mcp and forget about Those restful apis once in for all?

00:04:42: um i think there is Of course different best practices around this.

00:04:47: But the best practice that makes a lot of sense to me is, you continue to invest in your restful API landscape and build APIs even for new functionality as starting point so that those APIs can be leveraged in existing digital channels for mobile applications, for web applications.

00:05:07: For partner integrations or building digital ecosystems.

00:05:10: all these cool things can be done on the basis of REST APIs.

00:05:14: and then some of those API's make sense to be exposed to agents.

00:05:20: now I've teased you about this.

00:05:22: which of those makes sense?

00:05:24: So i like to classify the existing API landscape of enterprises in three different categories of APIs.

00:05:33: And only for one or two of those categories, it really makes sense to convert them into MCP endpoints.

00:05:41: So if you look at your API landscape You have probably system APIs That's low-level APIs.

00:05:48: All they do is take data and functionality.

00:05:52: that's in the backend systems could be an SAP system, a CRM systems something in your enterprise and they convert it into the API landscape.

00:06:01: Into the API world right?

00:06:03: So now you can access this data programmatically via REST call.

00:06:07: that's all they do.

00:06:08: there is no specifics about the company or so in those APIs.

00:06:12: yeah That comes to next category.

00:06:15: The Next Category that lies on top of these APIs Is typically a Process API Or A Business API.

00:06:22: Here You basically orchestrates several of those system APIs into a process that's specific to your organization.

00:06:32: Business logic goes into business API outs or process APIs, right?

00:06:37: That makes sense!

00:06:38: Those are typically higher-level APIs.

00:06:41: they're more abstract and closer to the business intent or functionality.

00:06:47: They make sense to be exposed kind of abstractly top down, and they basically can leverage those intent-based business APIs much better than putting together manually a step by step process out of five system APIs.

00:07:09: And the third category are experience APIs.

00:07:15: So experienced APIs are variants of process APIs.

00:07:20: They are very lightweight typically and they expose the business process for different types of consumers.

00:07:28: So, For example if you have a customer API exposing that data over customer then in some use cases it might make sense And is allowed to have the birthday off The customer exposed another use case's four compliance reasons or whatever.

00:07:43: You're not allowed to expose the birth team right?

00:07:46: And for that use case your typically create variant and experience API, which is very easy to build because it just filters out certain attributes.

00:07:57: And we've done this for as long as we have APIs.

00:08:02: basically now recall these experienced APIs when the consumer's not just any web application or mobile application but an AI agent.

00:08:13: yeah recall those context APIs, right?

00:08:17: But it's the same concept.

00:08:20: You filter out certain attributes so that makes sense for the consumer of these APIs.

00:08:27: So Context APIs are what we build to bring in context to those AI agents and same principles apply also.

00:08:37: they make sense to be exposed as MCP the context API slash experience APIs, those are really good candidates.

00:08:47: If you go through your list of um of APIs to be exposed via mcp and then The actual exposure You know taking a very well designed REST API And putting it out in the MCP protocol so that is as callable and so forth.

00:09:05: That's actually a mechanical process that doesn't require a lot of additional engineering.

00:09:12: translated and there are products out there that can do that for you.

00:09:16: Sure, so let me take a step back and clarify something really quickly.

00:09:22: when your talking about the MPCP or agents running in production how might this differ from perhaps agent to have helping build code first place?

00:09:33: Because we have built-in codes with those agents writing lower level code less interesting than us.

00:09:42: that's focused more on the business side of the code, but in the flipside.

00:09:47: In the API landscape you're saying push the agents more towards the Business side and less toward some lower level APIs?

00:09:59: Yeah so we can put of course Agents into existence for doing different things.

00:10:06: right there are like.

00:10:08: But if you want to categorize the agents that you could build, You can have coding agents.

00:10:14: Right?

00:10:14: That's where a lot of cloud code and so forth for these developments go.

00:10:18: They basically help the developer become more productive and more efficient.

00:10:22: Those are coding agents.

00:10:24: And yes MCP plays a role there too but it is very specific use case in applications Of generic agent technology just for the purpose of coding.

00:10:33: Then you can business agents.

00:10:36: Business agents apply for any role, not only coding roles but any type of role right?

00:10:43: So the HR department.

00:10:46: The IT Department that helps you order a new mobile phone or something like that or helps you fix a bug on your PC or Something Like That.

00:10:55: they also have the potential to get value out of business agents.

00:11:00: now and I think the broader term is the Business Agent And that's what I was referring to when I was talking about the agentic enterprise, because the agenting enterprise is kind of this all-encompassing idea and vision.

00:11:15: Every department every role would be affected not only the coding roll but the developers and the coding agents are, so to say trailblazers because developers are very open towards exploring new technology.

00:11:35: And maybe they're the first in the organization to explore agents that are very close to their role but I think other parts of the organization Are equally interesting or even more interesting To be exposed to agent technology and getting productivity gains through agents.

00:11:54: So yeah, I think it makes a lot of sense to have agents on all these different roles.

00:12:01: Sure sure

00:12:02: okay.

00:12:03: so how did we get here?

00:12:06: What does the trajectory or that development of technology look like from your perspective?

00:12:11: and you spent a long time in API landscape.

00:12:15: obviously now an AI.

00:12:17: what are some other steps for?

00:12:19: key pivotal moments got us where today?

00:12:23: So if we look at, for example how agents were built or how AI technology was leveraged since twenty-twenty three maybe when the first public chat GPT it was launched.

00:12:36: I mean that was basically a start of where everything changed Where people saw ChatGPT producing these really well for formulated answers to a quick question that you had, and business got inspired.

00:12:51: And said well we want to have this as well.

00:12:54: in every company people say yeah We want to build this cool technology into our product and we want leverage it to the max.

00:13:01: In twenty-twenty three People were experimenting with those LLMs I call naked LLMs because there was nothing around those LLM's, right?

00:13:12: We did some prompt engineering.

00:13:14: Maybe that was the maximum we did.

00:13:16: You remember?

00:13:17: maybe in those days people said oh There's a new job coming out and it's going to be the prompt engineer.

00:13:23: Right no one talks about this anymore.

00:13:25: No problem still Still is a valuable piece of the whole thing But at that kind of illustrates The milestones we have gone through.

00:13:34: the first step was really How do we prompt and give context in a prompt to an agent?

00:13:42: And it was mostly text-in, text out.

00:13:46: Those agents or those AI projects they didn't do anything except produce texts that were kind of passive.

00:13:53: there are just spitting our text.

00:13:56: They're not very specific to your enterprise right now but they were responding based on the corpus knowledge Wikipedia, they've read a couple of books from the library and that's what their response was based on.

00:14:11: Not so relevant from a business perspective yet because as a business you need to solve customer problems right?

00:14:20: There is no data in there for customers.

00:14:23: So next step we went through was the RAG architecture the RAG reference architecture.

00:14:32: It's basically retrieval augmented generation, that's what RAG stands for.

00:14:37: and in a RAG-based architecture you already get a little bit of enterprise knowledge into those LLMs right?

00:14:47: And your wiki articles to solve certain typical customer issues, for example.

00:15:01: And you just have this as a database and then you do a search semantic search on the data base.

00:15:07: people use them this vector database in embeddings.

00:15:11: it's semantic search technology is basically two search the snippet out of these big corpus off enterprise specific data that is relevant, and then they inject that into the prompt.

00:15:25: The prompt we had before in the naked LLM reference architecture still there?

00:15:30: Now it has a little bit more context but its all static contexts – the AI project can't do anything yet!

00:15:39: It produces even more relevant output with specific individualized outputs.

00:15:48: that we see right now and the most advanced one are AI agents.

00:15:53: They differ by using all of things we've done before, they use a little bit of prompt engineering but on top of it can leverage endpoints in the organization to reach into the enterprise and read additional data real-time data.

00:16:14: so what the customer has done recently the, what he had in the shopping cart just a moment ago.

00:16:21: All this data that would be very hard to get into a RAG database or so is there.

00:16:27: and an addition something we couldn't ever do before it's that the agent now can act.

00:16:33: That means It has Data from the environment And then it can act on this data In its environment and that's typically The digital environment right.

00:16:44: you can for example write something to a database or it can change something in the system.

00:16:50: And of course, because of the link with digital and real world this will have an effect on the real-world.

00:16:56: An agent now go shopping if you would allow that right?

00:17:00: It could basically do payment but also maybe do refunds for customer service agents kind of convinced that the customer has a point there.

00:17:13: It can do every fund, issue a refund and That's something we couldn't do before.

00:17:19: now Maybe it makes sense that we explore in a little bit more detail this reference architecture of the AI agent.

00:17:28: So what is an AI agent right?

00:17:33: And I typically like to explain it by first looking at the characteristics.

00:17:38: If we have a good AI agent, what do we think those agents need to?

00:17:43: So first day they should be somehow intelligent right intelligent.

00:17:49: The second thing is that they should Be autonomous and they should kind of work with their environment.

00:17:56: They shouldn't be isolated from it.

00:17:58: You should interact with your environment And that means they can Have knowledge about this environment real time or near real time and they should kind of do something, act in this environment.

00:18:13: And the third thing is extending on this interacting with the environment.

00:18:18: They should also interact and collaborate With other AI agents because an AI agent Is like a specialist We all know as specialists right?

00:18:29: In our field we can only really get big projects done if we work with other specialists that have other specializations.

00:18:39: So in order for this AI agent, genetic enterprise vision to work out there will be the need for AI agents a part of their work that they have been assigned to, through this other AI agent.

00:18:58: Wait for them to produce the results kind of the intermediary result and then integrate these results back into there overall problem solving.

00:19:08: So we have three things intelligence interacting with the environment And collaboration.

00:19:15: Now, these are just super high-level characteristics.

00:19:18: How do we put this into IT?

00:19:20: how Do We actually get This done when we built an AI agent?

00:19:24: intelligence well easy we do that with AI models and With those LLM technology.

00:19:29: we need to access them.

00:19:31: then how do we Get information about the context The digital context?

00:19:36: Well if you do That via mcp by connecting via the MCP protocol the AI agent with the enterprise systems that we have.

00:19:46: Then for collaboration, there's another protocol.

00:19:49: this is A to a protocol agent-to-agent protocol and it helps you do exactly that find other AI agents know what their specialty is then basically doing the handover of those AI agents.

00:20:05: so I think yeah once you have these three components in place thats where your differentiate in order to build great AI agents for your enterprise.

00:20:17: This is a really great detailed context on the technology involved, so thank you for that.

00:20:26: I've read a lot about this but that's the most distinct detail explanation i've heard.

00:20:31: So very well done.

00:20:33: In the context of that answer do you find That it Is The technical challenges that are the hardest part of implementing kind of an agentic environment, or is it more business friction?

00:20:53: Or maybe something else like getting data in a right place.

00:20:58: Yeah very good point now.

00:21:00: so I will tell you what i see in organizations.

00:21:05: You have this top level management that says build AI agents to the IT leaders in the field and the IT architect, head of IT.

00:21:15: They now have this task of figuring out how do we get this done with AI agents?

00:21:20: So lots of pressure basically on these roles.

00:21:24: And then when I look at what is actually being built and delivered... ...I see that we have cool prototypes being build.

00:21:34: all over everywhere.

00:21:36: people build cool AI agents.

00:21:39: Look the part right until you see hey, this is just a prototype.

00:21:43: We haven't really released that yet.

00:21:45: That's not in production.

00:21:46: The customers can read that Right but in order to forget forgetting those Productivity gains and getting those efficiency gains at top-level management actually wants to have there's no way then also releasing those AI agents into production Getting them in front of customers.

00:22:04: only then they will become effective, right?

00:22:08: So we need to do that but not there yet.

00:22:11: There's this big gap between prototypes and production.

00:22:16: so in prototype land We make cool things In production...we don't!

00:22:21: Why you think that is?

00:22:28: That's a great question.

00:22:33: I'll tell you what they have found out in studies, so Forester McKinsey Gardner has done studies even the MIT, so the NADA report from RIT.

00:22:44: They basically find that people don't trust these agents right?

00:22:48: It is a trust issue!

00:22:50: We can not let those agents run on our data.

00:22:54: you know, who knows what they're going to do with it.

00:22:57: Right?

00:22:58: And also the other thing more technical and operational is well how we connect those agents to our enterprise data.

00:23:07: so there's one overarching conceptual issue and there is one more IT issue that can actually fix but which hasn't been fixed yet So far.

00:23:17: We just need focus on integration.

00:23:20: We need to focus on integrating those AI agents into our enterprise And that basically means focusing on the APIs, on the interfaces.

00:23:29: Focusing on the integration technology and that's something we can fix.

00:23:35: now The trust issue.

00:23:38: That is a very interesting thing to attack.

00:23:42: So how do you actually build trust in AR agents?

00:23:47: Everyone could think about this here In this podcast.

00:23:51: How would what kind of agent would you trust more?

00:23:57: So there are these agents that can run around freely and do whatever they want.

00:24:01: And then, there are agents that have constrained in some form—you've given them guardrails or rules.

00:24:08: You said until here but not further —and for example give access rights to certain things other than just forbidden.

00:24:21: Agent and not with that other agent, right?

00:24:24: So you put really rules in place And that's what we then call governance.

00:24:29: Right if you look at this from a global perspective or from an enterprise perspective There are global rules on What AI agents can do and what they come to.

00:24:39: now there is different places where In the organization We can then enforce these worlds because we don't just want to write a big document or confluence and then it lives there on our wiki.

00:24:52: That's not helpful, we need to operationalize these constraints.

00:24:55: they need to actually be enforced.

00:24:57: that needs a policeman basically in standing their and say yeah you're allowed to pass an unit.

00:25:02: Enforced and verifiable like... You need to be able to see that!

00:25:06: Yeah

00:25:07: so where in our organization?

00:25:09: And maybe even were in architecture would the proper place for us these rules and constraints.

00:25:21: And there are a couple of places, right?

00:25:24: So if you think about... You can of course enforce them all the way on top of every AI agent like when you're building the AI agents-you can put these rules or constraints into the code of this AI agent.

00:25:38: that's one place.

00:25:39: but sometimes maybe those AI agents are built outside the organization..You can't put rules in there!

00:25:44: Maybe there is third party agents That you get and that you might want to leverage.

00:25:50: so then You have another chance of putting some rules in place.

00:25:53: And that's exactly at this interface level, and we've previously looked at those three different Components of AI agents Mm-hmm.

00:26:04: And the agent needs to reach an access every off every component.

00:26:10: So at this place of excess?

00:26:12: That's where we can enforce Those rules and constraints.

00:26:17: So for example, for intelligence that was the first component.

00:26:23: When the AI agent wants to reach an LLM needs to make a network call it needs to Make an API Call typically and LM API call And That's The Place when we can put something at place there that intercepts that call enforces A couple of policy rules and then forwards the call or blocks It.

00:26:45: and that's a typical application of the gateway.

00:26:49: And in API space, we have worked with gateways like forever

00:26:55: right?

00:26:57: The concept has been there We always looked at.

00:27:01: okay There is request coming from outside world to our API.

00:27:05: Now lets authenticate it Lets transform the requests Let us maybe put some quotas or rate limiting in place so servers don't get overloaded.

00:27:15: And exactly this technology at the right place can be injected in all three components of the AI agent.

00:27:24: LLM we've looked at, now if you look that the MCP equally there We would put an MCP gateway in place here and then MCP Gateway Can enforce all these rules?

00:27:36: It could also do a protocol conversion for us.

00:27:41: So if we already have an existing REST API as a backend, then it can automatically transform this protocol into the MCP protocol.

00:27:52: And of course in A to A gateway for third leg of agent enforcing those interactions with other

00:28:00: agents.".

00:28:03: You posted recently that next wave of AI and enterprise won't be defined by who builds most agents?

00:28:10: but by who governs them responsibly at scale.

00:28:13: And I think that's right on point, But it begs the question which i'd like to hear your thought.

00:28:21: Who is responsible for governing agents?

00:28:24: or To phrase in a different way what role and the organization should be?

00:28:29: Responsible for the AI governments and putting in place these guardway?

00:28:33: up to we just discussed

00:28:35: Very good question and I think organizations are trying to figure that out, right?

00:28:41: So and I've talked to organizations.

00:28:45: I see three approaches that organizations right now in different organizations take to answer that question.

00:28:52: the first one is when there is already like a established AI competence center then sometimes this AI competence centre takes on the role of creating MCPN points.

00:29:07: They create the agents, they put constraints in place and they own then an MCP gateway.

00:29:15: The only A to a gateway or an LLM Gateway.

00:29:19: And uh...they are right people in the organization In other organizations where maybe you have already strong integration and API governance team Then take on that role.

00:29:35: Oh, we've done this for the last ten to twenty years.

00:29:39: We know how that works and I think they have a good point right?

00:29:43: And they say MCP is just another protocol!

00:29:46: Right?!

00:29:46: We've done SOAP, we're done GRPC... MCPs are just one of these protocols!

00:29:54: They can then handle big portfolio APIs, MCP agents.

00:30:00: you know everything in one place.

00:30:01: so That's the other approach.

00:30:03: I see a third approach, where in the organization there is this awareness now that we have already people who are good at APIs.

00:30:16: We have the requirements for AI let's just bring them together and then we see new roles where people say i'm head of AI and API governance right so they merge these roles because and also how you handle things in the organization.

00:30:36: How do we actually enforce it?

00:30:37: Because putting that technology into place is one thing, but then getting it accepted by the rest of the organization as a completely other challenge.

00:30:49: We've done good work at API space.

00:30:53: You can apply this best practice Some more soft skills to get this technology accepted And I think they have a point there.

00:31:04: So three different approaches, i cannot say which one is winning right now?

00:31:10: Maybe if we talk again in half-a year...I can tell you from my customer interactions Which ones are the best.

00:31:17: but yeah people try to figure it out.

00:31:19: so very timely question You ask.

00:31:24: The space of governance To me Is always interesting and I Think In the context Of AI & API specifically.

00:31:32: It is a rule that demands both technical expertise and deep understanding the business risk profile because there's a risk profile to governments.

00:31:44: There's an understanding of potentially legal in governmental landscape, as well as the technical implementation on understanding how reliable the technical limitation is –the limitations of it–that sort-of thing.

00:31:59: So its interesting mixed type of role.

00:32:02: So

00:32:04: governance people need to work, it's a multi-dimensional challenge they have right?

00:32:10: They need to worked with legal people and we can't work with marketing.

00:32:15: if you want to work with IT risk security People.

00:32:19: so And off course business Right what?

00:32:22: because when your chat that would you have the risks on one side.

00:32:25: You once say is this a risk worth taking for their business?

00:32:28: We can gain right there.

00:32:30: And this is all questions we've had with API technology to some extent already.

00:32:37: Maybe what's new now, that it's just getting bigger.

00:32:40: the risks are getting bigger and also possible opportunities from these technologies.

00:32:47: so basically makes challenges in this field magnifies them.

00:32:57: If I hear myself talk now, it would basically speak for taking people that already are working in this field of APIs.

00:33:05: For a while and let them apply their knowledge there right?

00:33:11: I wonder how specific industries or even perhaps specific countries will defer in the approach to This challenge over few months or years as well.

00:33:29: Yeah, absolutely so.

00:33:32: I think there is always frontrunner industries maybe those industries that don't have much to lose.

00:33:41: no i mean where the data it's not so critical sure and if you When the APIs came along, it was a social media companies who were typically leading the field and where they first want to try things out publicly.

00:33:55: If you remember like Twitter API in early days right?

00:34:01: And until banks came maybe then eight ten years later after the Social Media Companies have opened up but also produced APIs.

00:34:12: There's just much more risk involved if you have money, right?

00:34:16: For critical data that it just takes a little bit more time than technology matures.

00:34:23: so I think different industries maybe are leading or lagging a little.

00:34:27: but yes and i think that has good reasons.

00:34:33: also um...I'm not too deep into the compliance aspect aspects and which country is kind of a little bit more relaxed about data privacy, in respect to AI.

00:34:49: And what countries are a little restrictive?

00:34:54: Yeah we will see my impression that there's a lot on the cost side.

00:35:04: maybe people can move faster but we will see, especially when first incidents are happening.

00:35:16: There's a couple of incidents already where agents maybe have deleted the database and that informs people then right?

00:35:26: So these first incidents they show what the risk actually is creates awareness.

00:35:31: it's painful for I mean, on us it is basically to learn from those other organizations that have this pain so that doesn't happen in our house.

00:35:44: So when you have incidents like that obviously it erodes trust not just for the organization but actually for the technology and industry as a whole in many cases.

00:35:57: do you have

00:35:57: any suggestions?

00:35:58: because you mentioned early-on of these conversations that trust was kind.

00:36:06: How do we address some of those issues in a responsible way, but that keeps things moving forward?

00:36:15: Right.

00:36:16: That's the delicate balance we have to find.

00:36:19: We want to be on the forefront of innovation which means taking some risks On the other side.

00:36:35: here we should kind of look into best practices, especially when it comes to security or governance and apply what has worked in the past.

00:36:45: So opening up an API without proper security bad idea.

00:36:52: same applies for an MCP endpoint right?

00:36:55: And shouldn't come as a surprise when I say like this with this analogy but due you remember top-level management wants to see results on AI agents.

00:37:06: then sometimes people create prototypes, they cut corners security.

00:37:10: maybe we can just quickly bring something out right.

00:37:13: so that's why these things or how these things are happening and I think there the responsibility of a good engineer is to lift the hand say like not a good idea to bring that out without proper constraints.

00:37:27: Without proper.

00:37:29: There are best practices around securing MCPN points.

00:37:33: It's basically the OAuth two dot one protocol that has been around in the API space, there is a lot of best practice and product support you implementing it right way.

00:37:46: so leverage them on everyone not only responsibility IT security people the CISO and your organization, but no it's every engineer who sees something sure that is potentially risky to lift them.

00:38:03: Lift a hand wave.

00:38:04: The red flag saying well we need to focus on that.

00:38:08: So would you say there's any?

00:38:10: Any either developers or any organizations Who probably shouldn't consider mcp right now?

00:38:18: And on the flip side do you think There's a long-term penalty for organizations that don't really start adopting MCP at this point?

00:38:30: Yeah, so I think with the AI technology everyone should be an innovator and try it out.

00:38:41: And if an organization leans back That can't be good for the long term prospects of that company.

00:38:49: So i think It's on every one to try to figure out how can we use this technology in our environment.

00:38:57: And I think just leaning back and not do anything because we haven't figured out every aspect of it is the wrong approach, right?

00:39:06: Otherwise you know there's speed train of AI will take off and leave some companies behind.

00:39:13: that shouldn't be yours

00:39:15: Right absolutely.

00:39:17: You touched on this before but didn't really discuss.

00:39:20: How do we design APIs that will be chosen by AI agents rather than human developers?

00:39:28: Wow, yeah.

00:39:29: Great question!

00:39:30: So what we have looked at is this classification of different types of API's.

00:39:35: right We have just to recap system APIs business or process APIs and then these context Or experience APIs.

00:39:44: so let's look at these business APIs.

00:39:47: um how are they different than the system APIs?

00:39:52: They typically address a business issue.

00:39:55: You can explain a business or process API to a business person when they understand what that is, if you bring them a system API that just store customer record or something like that, they don't even know what.

00:40:08: it sounds too technical today.

00:40:10: so I would say kind of... If to a business person and they understand, ah that really makes a lot of sense.

00:40:19: And it brings value to us then that is an API that would be valuable also for the agent.

00:40:26: high level APIs right?

00:40:28: Not low-level higher level of abstraction in a business process behind it specific to your organization.

00:40:36: Okay very good how has your approach to API design changed as you've moved into developing MCP and agentic development processes.

00:40:52: Good question, so there are two aspects of how it has changed?

00:40:56: So the first aspect is getting clarity off how MCP in the REST APIs that we have designed for a long time How those tools relate.

00:41:07: And my approach right now.

00:41:09: I say start with the Rest API's as we have been preaching for the last five years or so.

00:41:17: So that means and then move to MCP, right?

00:41:21: What have we said over the past five year?

00:41:23: use the open API specifications specify first design first DAPI in them implemented.

00:41:30: later prototype it an implemented.

00:41:34: That also means you should do a customer centric design Right, so you think about your customer or your client first and who it actually is.

00:41:47: And then design from that insight what they would need as data.

00:41:53: So now It's these AI agents for your API consumers.

00:41:59: right to think about what Dave will probably want to have With humans.

00:42:06: You can always go an invite those potential API consumers to your organization, you can say let's have a workshop and figure out what you need.

00:42:16: And then we are going to design an API exactly for your needs whether that's done in experience api or process api Or combination of those with AI agents?

00:42:25: That's Of course not the case.

00:42:26: You can't invite the agent to come over and tell you What they need.

00:42:30: But there was a couple of best practices.

00:42:33: when you think about it don't design complicated APIs.

00:42:38: Sometimes I see those APIs that have like, fifty fields of input and a hundred for output And so many different parameters and depending on the parameter it behaves differently over here.

00:42:50: Those API's are not good for AI agents.

00:42:53: AI agents want to have very simple clear APIs That do one thing but do that correctly.

00:43:00: So try down it, your API design for the AI agents.

00:43:06: That would be my overarching

00:43:08: advice.".

00:43:10: Okay yeah that makes sense.

00:43:13: so if there's anybody out there not currently leveraging AI agents is there something specific you would suggest to get started with at a starting point?

00:43:24: Yeah good starting point.

00:43:27: um would AI agent?

00:43:32: just to see how all the different parts interact.

00:43:36: There are great frameworks, open-source frameworks commercial frameworks that help you put together an AI agent without a lot of work right.

00:43:45: so try to leverage those.

00:43:47: build an AI Agent on a simple use case that you really just learn used for learning and then go and built your first mcp endpoint again based on this idea.

00:44:00: Now rest endpoint first create or mechanically an mcp end point for that and then maybe a second step Would be try to apply AI technology also on your AI agent.

00:44:15: Or are you're on your API design?

00:44:17: Yeah, right.

00:44:18: So use an AI agent to create an AI Agent Or using AI agent To create your API Design or your MCP design.

00:44:30: So you can, for example right now ask any of those big models to help create an open API specification in a specific use case.

00:44:43: Right?

00:44:43: You give it some constraints and say this is the kind of API I want to build And you could iterate on that.

00:44:51: But we don't wanna lose the basics.

00:44:55: so i think there's still value actually that it is doing.

00:45:02: But then when you go and work on an actual project in real life, You have an intuitive understanding of what it is doing, and that will help you put all the pieces together in a cohesive way.

00:45:25: So yeah apply AI technology on lots of things including your API design.

00:45:31: nice

00:45:31: okay.

00:45:33: so later this year It looks like you've got a number speaking engagements Including api conference in both New York And Berlin.

00:45:41: I see at topic At those events transforming into an agenic enterprise.

00:45:47: Would you like to drop a teaser for what that talk is gonna look like?

00:45:53: Absolutely.

00:45:54: So it's basically, uh... For the people who are in this situation That we've described on this podcast as well.

00:46:01: They get their requests from their management.

00:46:05: The top-level management says build more AI agents Get the organization ready for AI agents.

00:46:12: Now What do We Do And especially for the API People Right?

00:46:17: So what does it mean to have an AI-ready API?

00:46:23: and where would the AI agent, AI agent governance.

00:46:27: Where will that land who would own the topic?

00:46:30: What do we have to do?

00:46:31: And how do we actually enforce all these constraints That we need to put in place To create trust and make this a genetic enterprise vision work?

00:46:40: so All of those topics We'll look at and discuss them In depth.

00:46:46: We will combine it with best practices for API security and API design.

00:46:52: So, um... It's basically going all the way through the stack from AI to MCPE and to API Design underneath.

00:47:00: I'm looking forward these instances.

00:47:03: Yeah that sounds great.

00:47:06: Okay.

00:47:07: so last two questions.

00:47:10: first one What do you think is next in the API space?

00:47:15: or in the MCP space?

00:47:19: Yeah, so I think right now we focus on APIs and MCP.

00:47:23: And in the future once we have a couple of really good AI agents Think about how do these AI agents work together.

00:47:33: So that will be The major big topic i think That we'll Have coming up to the A-to-A protocol Or whatever it's gonna Be.

00:47:41: then there is alot of flux.

00:47:43: might be another Protocol.

00:47:46: How do we actually think about and how do we cut basically what one agent is responsible for tackling?

00:47:54: And another agent, it's doing.

00:47:58: Is it dynamic?

00:48:02: Will there be some lookup in some directory somewhere where all the experts are registered.

00:48:06: It will be an exciting space and I think if, If i think back to how we have built API based digital ecosystems a lot of these technologies might be applicable.

00:48:18: but I'm getting ahead off myself!

00:48:19: I am really excited about this space.

00:48:22: uh But A-to-A protocol will be super super exciting!

00:48:25: Cool cool good deal.

00:48:27: So, what is your number one takeaway that you want to lead the audience with today in this conversation?

00:48:34: The biggest thing You need to make sure right now.

00:48:37: Is that people build trust in AI agents and we have looked at governance as One mechanism To put this Trust a to enforce this trust and to put it into practice.

00:48:55: our technology with gateways, that we know from the API space.

00:49:00: That's exactly the technology that we can leverage at this place as well.

00:49:04: so let us use these expertise and knowledge in technology to get trust in AI agents

00:49:13: Nice.

00:49:15: So leverage Well-established existing technologies To implement guardrails around new technology to help establish trust.

00:49:24: Absolutely

00:49:25: Fantastic.

00:49:26: Fantastic, thank you so much for your time and your insights today.

00:49:29: it's been a great conversation very enlightening.

00:49:33: Thank You my pleasure!