AI governance at WSO2

Why this conversation

Agents without the right controls either never leave the pilot or leave it and cause trouble. Rania Khalaf is Chief AI Officer at WSO2, which had just released its Agent Manager, and in this conversation she described what that product puts around an agent, from its traffic to its identity and its evals. Her argument: consistent controls are what let a team go faster. The host recorded with her in San Jose on 22 October 2026, the first day of AGNTCon + MCPCon North America. The rest of that day is in AGNTCon + MCPCon North America 2026: day one.

A single platform around the agent

Asked what WSO2 does, she answered: “We are building everything you need for your digital agentic enterprise.” That spans agent management, securing AI traffic and agent identity, down to a company’s APIs and integrations.

The newest piece is the Agent Manager, a product that combines some of WSO2’s capabilities in agent identity and AI gateways. She walked through what it does for an agentic application. First comes the traffic: every interaction the agent has, its calls to LLMs and MCP servers, and everything inbound. Next is the question of who the agent is, what it can reach, and how it is configured. That is digital identity and what comes with it, such as least privilege, and an identity for the agent kept apart from the people who use it.

Then come observability and evals. In her words, “evals are really important here because they let you monitor continuously how your agent is doing.” Based on what they show, a team can decide to stop the agent, shut it down or revoke its tokens, and can tell when it is misbehaving. She calls the result a 360 view: the agent plus its scaffolding, so that running it is easier, quicker and safer. The host liked that it all comes in one platform, since so many projects today each cover only one of these areas.

When software stops being deterministic

The host then asked about evaluation, as the industry moves from a deterministic world to one that is a little more probabilistic. That, she said, is the part she finds most interesting. For many years we have run deterministic systems, and we have the software engineering principles and the architectural best practices to handle them. Gen AI, and AI in general, adds a probabilistic factor. It changes lifecycle management, the meaning of a test or of a version, and the way a drop in performance gets fixed. Evals are her answer here too: they show how well an agent is performing while allowing for that probabilistic behaviour, and for multimodal behaviour as well, when what comes back is natural language or something else.

Start where you are

To get started, WSO2 Agent Manager has a free trial on the website that runs fully as SaaS. The project is also open source, with a GitHub repository to download, set up and try. She returned to the host’s earlier point: it is one platform with one experience, but people arrive in this space at different entry points. Some only need to control the traffic to their LLMs and MCP servers, and can take just the AI gateway. Others only need agent identity, which they can take from WSO2’s identity platform. For the full experience, the place to begin is Agent Manager. “So you can kind of compose as you go and get what you need for where you are in your journey.”

The agent halo

Asked for the biggest use case, she named getting to production faster. Some teams are stuck in pilot: they lack the right controls, and a CISO or someone else will not let their agents go out. Others have already let a lot out, are seeing the problems their agents have, and are nervous about bringing them back under some kind of control. Her answer to both is what she calls the agent halo: everything placed around an agent to make it safer. “Like people think control might slow you down.” She sees it the other way round. WSO2 works across any agent framework and any runtime, and with one consistent way to define controls and guardrails, a team avoids redoing them for every agent and every platform, again and again. That is how it ends up moving faster. The host closed by calling for more halos in the world.

When it comes out

The episode is edited and in the release order. Like every episode it goes out on YouTube first, then on Apple Podcasts, Spotify and Amazon Music.