Kong has launched Token Vault for Kong Identity, a product designed to control how AI agents access enterprise systems.
Now generally available, Token Vault brokers downstream credentials at runtime instead of giving agents direct possession of them. This allows AI agents to reach APIs, MCP servers, models, data and other authorised resources without exposing the underlying secrets to the agents themselves.
The release comes as companies give AI agents broader roles across internal systems, applications and data stores. That expansion has raised concerns for security teams, because each system often requires its own authentication method, leaving organisations to manage a growing number of credentials tied to software agents.
This can create credential sprawl and increase the risk of misuse if an agent is compromised, misconfigured or behaves unexpectedly. In that scenario, persistent credentials could let an agent act across multiple systems faster than a human operator.
Under Kong's model, an agent first authenticates using its own identity. Kong Identity then determines what the agent is allowed to access. When the agent sends an authorised request to a downstream system, Token Vault supplies the relevant credential at runtime.
That means the agent never holds the downstream credential directly. Centralising the brokering process is intended to make credential management and revocation easier, reduce credential exposure and avoid the need to build separate credential logic for each new integration.
Access control
Token Vault expands Kong Identity beyond agent identification and authentication into a broader access model that covers identification, authorisation and credential brokering. It can also be used alongside Kong's gateways and policy enforcement tools so organisations can manage agent identification, access decisions, credential brokering, policy enforcement and audit activity within one architecture.
Kong is positioning the launch around a problem facing security and identity teams as AI agents become more common in production environments. Agents may need broad access to do useful work, but granting that access through static credentials can leave businesses with a difficult set of secrets to manage and protect.
The issue becomes more pressing as agents are used to interact with multiple APIs, applications, services and data sources across the enterprise. Each additional system can add another authentication requirement, increasing operational complexity as well as the potential fallout if credentials are exposed.
Reza Shafii, Senior Vice President, Product, Kong, said the distinction between permitting access and handing over credentials is becoming more important as agents take on more tasks inside organisations.
"Enterprises need a way to expand what agents can access without expanding the credentials those agents hold," said Reza Shafii, Senior Vice President, Product, Kong. "Token Vault separates access from credential possession, allowing organisations to give agents the connectivity they need while keeping downstream credentials under centralised control. As agents take on more work across the enterprise, that distinction becomes critical to securing how they interact with the systems and data they rely on."