On September 29, 2026, Postman shipped Fabric Gateway. The largest API platform in the world just bet its future on protocol-agnostic agent governance as a control plane.
Fabric Gateway is a hybrid deployment: Postman manages the control plane; the customer runs the data plane inside their own VPC. It sits between agents and everything they touch—HTTP endpoints, gRPC services, MCP servers, and A2A agents—and enforces policy uniformly across all of them. The unified registry consolidates APIs, CLIs, MCP servers, and agents into a single discoverable surface. Built-in reliability handles failover through circuit breakers and health-aware routing. Immutable audit trails capture every action for compliance.
The credential layer is where the architecture earns its keep. Fabric Gateway brokers upstream credentials transparently—OAuth, AES-256 vault keys, key management—so agents never handle authentication material directly. “If your agents cannot see or securely access your APIs, your business will become irrelevant,” Postman CEO Abhinav Asthana said at the launch. “Organizations need infrastructure that governs what agents can discover, what they can access, and what actions they are authorized to take.”
One endpoint reaches 1,000-plus LLM providers. That is not a feature. That is a distribution play.
What matters here is not that one vendor shipped a gateway. It is that Postman’s launch completes a three-vendor pattern that defines the current infrastructure wave.
Solo.io donated its agentgateway to the Linux Foundation as an open-source, Rust-based binary with native MCP and A2A protocol awareness. It treats MCP servers like microservices: discovery, scoped tool calls, audit trails. TrueFoundry shipped an enterprise MCP gateway with centralized registry management, fine-grained access control, and virtual MCP servers. Postman brings protocol-agnostic governance across HTTP, gRPC, MCP, and A2A with a credential brokering layer and access to 1,000-plus LLMs. Three vendors, three approaches, one architecture: the gateway as the control plane for agentic systems.
The pattern sharpens a distinction this publication has tracked since August. Tool discovery is scaling on momentum. Agent-to-agent governance is stalled. The gap between those two trajectories is where the control-plane products sit. They are not solving the protocol problem—they are solving the governance problem that protocols leave open.
The consequences are straightforward. As agent runtimes commoditize, the competitive moat shifts to whoever owns the policy enforcement, credential brokering, and audit layer between agents and the systems they touch. That is the layer Postman just entered with the biggest distribution footprint in the API economy.
The next test is execution. Governance-as-product requires balancing strict security with the flexibility that agentic development demands. The vendors that figure out that tradeoff fastest will define the control plane of the agent economy. Postman’s bet is that its existing ecosystem reach—millions of developers, 1,000-plus LLMs, the API catalog—makes it the natural owner of that layer.
The governance layer is the product. The runtime is the utility. The biggest API platform just made the call.