Agenda

AI agents as MCP clients and developer tools such as Claude Code, Cursor and GitHub Copilot are rapidly adopting the Model Context Protocol (MCP) to interact with external systems. But how do you connect numerous MCP servers, take your existing APIs and make them ready for this agentic world?

In this lab session, we walk through the full lifecycle of shipping MCP servers for your organization. You will learn how to securely expose remote MCP servers and inbound MCP servers through a centralized MCP Gateway, giving you a single governed entry point for all MCP traffic. We then use the Arazzo specification to transform existing REST APIs into MCP-compatible services without writing custom server code, and show how to build new MCP servers from scratch. All of these are registered in an MCP Hub, a centralized catalog where developers and AI agents alike can discover available tools.

Beyond building, we cover what it takes to run MCP in production: OAuth based security with fine-grained access control and guardrails, real-time analytics on tool usage and token consumption, and full observability through centralized logging. We will demonstrate how agents can consume these governed MCP services end to end.

By the end of this session, you will have the knowledge to prepare your APIs and MCPs for agentic consumption, govern and secure them, and operate them at scale.

Modern integration demands a balance between simplicity and control, where developers want to move fast without giving up the flexibility needed for complex enterprise scenarios. In this hands-on lab at WSO2Con, you will explore how WSO2 Integrator  bridges the gap between low-code simplicity and pro-code flexibility, accelerating real-world integration scenarios while keeping the vibe-coding experience alive that developers love.

Participants will learn how to rapidly design integrations using WSO2’s integration tooling and seamlessly incorporate advanced logic, custom transformations, and enterprise-grade extensibility. Through guided exercises, you will build end-to-end integration flows that connect APIs and systems, implement transformations, handle errors, and apply best practices for deployment.

Through guided exercises, you will:

• Get familiar with WSO2 Integrator and its capabilities
• Explore the key breakthrough features of the WSO2 Integration platform
• Design integrations using WSO2 Integrator
• Implement transformations, validations, and error handling
• Deploy and test integrations on the WSO2 iPaaS

Whether you are an integration developer or an architect, this session will show you how WSO2 Integrator simplifies modern integration while preserving the power required for complex enterprise scenarios.

AI agents are moving beyond demos into real enterprise use: reviewing code, triaging incidents, automating workflows, and interacting with customers. However, most teams focus on the LLM and overlook what actually makes agents work in production.

This lab covers the core building blocks of production-ready agents:

• What defines an agent, including the reasoning–action–observation loop
• Tool and integration design, and why it often matters more than model choice
• The role of memory architectures in complex, multi-step tasks
• Planning and self-correction patterns for reliable execution
• Evaluating quality, reliability, and safety in non-deterministic systems
• Agent security, including risks of autonomous actions, access to sensitive systems, and how to get this right from the start

By the end of this lab, you’ll understand what actually makes AI agents work in enterprise production, beyond just choosing the right model.

As organizations scale LLM adoption, AI traffic quickly becomes both an ungoverned attack surface and an unpredictable cost center. An AI Gateway brings this under control, providing a single control plane for all AI traffic, turning risky LLM usage into transparent and governable. In this lab session, you will work with WSO2 AI Gateway that sits between your applications and LLM service providers, proxying and securing every interaction. We will cover essential and decision making flows such as multi-model routing with intelligent failover so your applications are never tied to a single provider, and key distribution that lets teams consume LLMs without directly holding provider credentials.

On the security front, we explore enterprise-grade guardrails such as prompt validation, PII masking, and content filtering, alongside cost governance through token-level rate limiting, and analytics that give visibility into consumption by usage. We also can apply prompt optimization techniques to reduce redundant calls and enforce consistent behavior across providers.

Finally, we address data sovereignty. The gateway's flexible deployment model allows you to run the data plane on your own infrastructure, ensuring AI traffic and observability data never leave your network boundary.

The shift toward the Agentic Enterprise is redefining how software systems are built, with AI agents evolving into active participants in business workflows. Yet, their real impact depends not just on intelligence, but on integration. Without strong connectivity to enterprise systems, data, and processes, agents remain isolated and limited in value.

This tutorial focuses on building enterprise-ready integration agents by treating integration as the foundation of agentic systems. It explores how modern integration platforms enable agents to interact with APIs, events, and workflows while maintaining context and reliability. Key capabilities such as multi-agent orchestration, real-time data access, and reusable design are covered alongside critical concerns like security, governance, and observability.

Through practical examples, participants will learn how to move beyond isolated AI experiments and build scalable, production-grade agents that deliver real business outcomes—unlocking the true potential of human-AI collaboration.

AI agents don't just plug into your existing architecture, they challenge it. Traditional enterprise patterns built around request-response APIs, static workflows, and human-in-the-loop approvals weren't designed for systems that reason, act autonomously, and call tools on their own.

This lab explores how enterprise architecture must evolve to support agentic workloads at scale:

• Why conventional API gateways, identity models, and integration patterns fall short for agents
• Rethinking identity and access control when the caller is an agent, not a user
• Observability beyond logs and metrics - tracing reasoning chains, tool invocations, and decision paths
• Rethinking quality assurance - why unit tests aren't enough when outputs are non-deterministic, and how evaluation-driven development becomes the primary quality gate for agentic systems
• Governance as architecture - embedding guardrails, cost controls, and policy enforcement into the platform layer
• Patterns for incremental adoption without rearchitecting everything on day one

By the end of this lab, you'll have a practical architectural blueprint for making your enterprise agent-ready - so that when agents move into production, your platform is ready to support, secure, and govern them.

Kubernetes gives you the building blocks, but assembling them into a developer platform that works for both developers and platform engineers is an entirely different challenge.

In this lab, you'll build a working developer platform from scratch using OpenChoreo, a CNCF Sandbox project. Starting with a clean Kubernetes cluster, you'll install OpenChoreo and shape it to match how your organization works by defining component types, setting up traits, configuring observability, and establishing deployment workflows. You'll then deploy services and see everything surface through a Backstage-powered portal, without having to stitch together a dozen tools yourself.

You'll experience firsthand how OpenChoreo introduces higher-level abstractions on top of Kubernetes: how developers get simplified workflows and real-time visibility into their services, while platform engineers retain governance and control over what runs in the cluster.

By the end of this session, you'll have a running developer platform and a concrete sense of what's possible when the right abstractions sit between your developers and Kubernetes.

AI is transforming modern applications—from seamless consumer experiences to autonomous agents acting on behalf of users. This shift introduces new identity challenges: delivering secure authentication for users while maintaining control and trust when AI systems operate independently.

In this hands-on lab, we start by building modern consumer authentication experiences using the WSO2 Identity Platform. Participants will implement passwordless login, MFA, and adaptive authentication to create secure, seamless, and branded user journeys.

We then extend these concepts to AI-driven systems. Using the Asgardeo MCP server, participants will explore how AI tooling can accelerate the design and integration of authentication flows. The session will also dive into how AI agents securely interact with systems using delegated access, scoped permissions, and auditability — a fundamentally different identity challenge from traditional user authentication.

IBy the end of the lab, attendees will have built authentication flows that support both human users and AI-driven interactions, balancing security, usability, and control.

This lab covers:

• Building secure consumer authentication with passwordless login, MFA, and adaptive policies
• Designing seamless and branded login experiences using WSO2
• Accelerating auth flow development with AI tooling and the Asgardeo MCP server
• Securing AI agent access through delegated identity, scoped permissions, and auditability
• Understanding the emerging identity challenges in agentic AI systems

This session is designed for developers and architects with foundational identity knowledge who want hands-on experience bridging consumer authentication and AI-driven identity patterns.

WSO2 Agent Manager is an open control plane for deploying, observing, evaluating, and governing AI agents across an organization, regardless of the framework they are built with.

In this hands-on lab, we will cover the five pillars of enterprise agent management:

• Lifecycle management – onboard, version, and deploy agents from a single control plane
• Observability – inspect real-time traces of LLM calls, tool invocations, and reasoning steps
• Evaluation – use built-in evaluators and continuous monitoring to measure quality, safety, and performance
• Identity – assign verifiable identities and enforce access controls
• Governance – apply policies, guardrails, and cost tracking

By the end of this session, you will understand how enterprise teams can onboard, monitor, evaluate, secure, and govern AI agents with the necessary controls for confident production deployment.

As systems grow in complexity, traditional approaches to software delivery and operations are reaching their limits. AI is driving a new shift, toward platforms that are not just automated, but intelligent and context-aware.

This hands-on workshop explores how AI-native platforms enhance software delivery and runtime operations by embedding intelligence into CI/CD, deployment, and observability. By connecting data across pipelines, infrastructure, and telemetry into a unified context, platforms can enable smarter automation, faster troubleshooting, and more reliable systems.

Using OpenChoreo, a CNCF Sandbox project, the session demonstrates how CI/CD, GitOps, observability, and governance integrate with MCP-powered interfaces, built-in AI agents, and reusable agent skills to support real-world workflows.

By the end of the workshop, participants will understand how to move toward AI-native platforms that improve delivery speed, resilience, and operational efficiency.

AI agents are no longer a future concept. They are actively being deployed across B2B SaaS platforms, automating workflows, serving customer organizations, and operating across complex multi-tenant environments. But as agents take on greater autonomy, the identity and access challenges multiply. Who authorized this agent? Which organization does it belong to? What can it access, and what should it never touch? In B2B contexts, where data boundaries, organizational hierarchies, and partner trust are paramount, securing agentic AI is not just a technical challenge; it is a business imperative.

This hands-on tutorial builds on core B2B IAM foundations with organization modeling, delegated administration, and BYO IdP and extends them into the agentic era. You'll learn how to expose AI agents securely within a SaaS model, ensuring each agent operates within the identity and permission boundaries of its customer or partner organization. We then go deeper into controlling agent access across a multi-tenant B2B platform, where a single SaaS AI agent must interact with organization-scoped resources without ever crossing organizational boundaries.

This tutorial covers:

• Challenges of identity and access management in agentic B2B SaaS applications
• Modeling organization hierarchies, onboarding, and delegated administration with Asgardeo
• Securing AI agents operating within a SaaS model across customer and partner organizations
• Controlling and scoping AI agent access in a multi-organizational B2B platform
• Securely exposing and consuming multi-tenanted MCP servers by AI agents
• Implementing agent-initiated flows with organizational consent and auditability
• Designing branded, secure login experiences for B2B users and their AI agents

In this keynote, Sanjiva will define the agentic enterprise and explain why it represents a new North Star for enterprise software. As AI agents become first-class actors across enterprise systems, organizations need to rethink how they design, operate, and govern their digital platforms.

Hosted by our Chief Product Officer, this session brings together WSO2’s business unit leaders for a rapid update on what’s shipping now and what’s coming next. From APIs, integration, and identity to platform engineering and AI, each leader will share how their product area contributes to building the agentic enterprise, along with key roadmap signals for customers and architects.

In this live podcast-style session, WSO2’s CTO and Chief AI Officer will be joined by customer executives and industry influencers for a candid discussion on what it really takes to lead in the agentic era. The conversation will explore how enterprises are thinking about AI agents, modernization, governance, and the operating changes needed to turn early momentum into lasting business value. Expect a practical discussion grounded in real-world leadership perspectives, not theory.

The rise of the agentic enterprise is reshaping how systems are built and connected. Traditional integration focused on linking applications and data through static workflows. Today, integration must evolve to connect agents, models, APIs, and workflows into intelligent, adaptive systems.

This talk explores how AI-native integration enables organizations to “connect anything” by embedding AI directly into enterprise architecture. Instead of treating AI as a separate layer, intelligent agents can now interact with APIs, data, and services in real time—shifting integration from rule-based orchestration to context-aware, dynamic execution.

We will examine the key architectural patterns needed to build agent-ready systems, including governance, observability, and secure exposure of enterprise capabilities for both humans and AI.

IAM is no exception to other technological domains that are going through a transformation due to the impact of AI. This session explores the duality of AI in the identity landscape: its power as a transformative ally and its role as a sophisticated threat. AI is becoming a force multiplier for technical teams by assisting developers in crafting frictionless user journeys and enabling target system integrations and admins to automate the monotonous tasks of authoring access control policies, approvals and report generations. Simultaneously, we will look at the dark side of AI, which is the emergence of deepfake identities driving account takeovers. This session will be a proactive look at how IAM leaders can architect a platform that is as intelligent as the entities it protects.

Healthcare's workflows, from prior authorization and referral chains to claims adjudication and clinical decision support, are being fundamentally rewritten by AI agents. Yet as autonomy scales, the risks shift from software bugs to critical patient safety events. A misconfigured agent acting on stale context isn't just a technical failure; it's a clinical one. This session introduces the platform layer built for healthcare that enables agents to act with speed and intelligence while remaining governed, auditable, and secure. We explore how conversational prior authorization, where decisions are resolved in real time, becomes possible only by solving the foundational challenges of identity, context, and trust.

In this session we take a pragmatic look at the real-world application of agents and AI across healthcare (for providers, payers, medtech, and life sciences) drawing on examples from both highly regulated markets and emerging digital health ecosystems globally. We explore the intersection of interoperability, standards like FHIR and HL7, agentic enablers such as MCP and context graphs, and foundational constructs like Agent ID, and how they come together to make healthcare AI safe and scalable. We anchor this in the broader regulatory momentum, from CMS-0057-F's prior authorization API mandates in the U.S. to equivalent interoperability and data-sharing directives taking shape across the EU, UK, and Asia-Pacific, and demonstrate why an healthcare native, identity-first approach with scoped context is the only way to scale autonomous AI in healthcare with confidence.

Modern integration is not about choosing between low-code simplicity and pro-code flexibility. It is about combining both to deliver real outcomes.

In this session, we explore how WSO2 Integrator enables a unified development experience where integrations can start with an intuitive visual design and evolve seamlessly into code-driven implementations. You will see how developers can connect APIs and systems, handle real-world complexity, and extend integrations with custom logic without switching tools or rewriting flows.

The focus is on how teams can move naturally between visual and code-driven approaches as requirements grow, while maintaining clarity and control throughout. By the end of the session, you will have a clear understanding of how to build integrations that are easy to start, flexible to extend, and production-ready.

As autonomous AI agents quickly transition into active workforce members, digital assistants, and dynamic application endpoints, they bring about significant security challenges. Existing deployments often suffer from unmanaged credentials and fragmented tool management, treating these intelligent agents as mere service accounts or application clients, or worse, allowing them to operate using borrowed credentials. WSO2 Agent ID introduces a transformative framework designed to establish AI agents as first-class, identity-backed Directory Entities. This enables comprehensive Administration, Authentication, Authorization, and Auditing for AI agents by assigning a centralized Non-Human Identity (NHI). Through this unified model, organizations can effectively govern agents across their various roles as autonomous actors, protected resources, and delegated applications. The result is a system providing bounded delegation, granular access controls, dynamic lifecycle management, and transparent human accountability, allowing modern enterprises to scale autonomous AI with confidence.

Banking modernization has long been a complex, high-stakes marathon—a necessary evolution that often stalls under the weight of legacy technical debt. While the industry is eager to embrace Artificial Intelligence, progress remains largely experimental as banks rightly navigate risks around data privacy and model reliability.

The true breakthrough lies in the middle ground: using AI not just for customer engagement, but as a high-velocity engine for structural modernization.

This session explores how AI-powered co-pilots and autonomous agents can transform the modernization lifecycle. By integrating AI into a governed financial platform, banks can automate the discovery of legacy business logic, accelerate code refactoring, and execute complex migrations at a scale previously impossible. We will discuss how to move AI from a cautious experiment to a mission-critical tool that overcomes legacy stagnation, enabling banks to modernize with unprecedented precision and speed.

The agentic enterprise it's built on integration. An agent becomes truly powerful when it can reach your CRM, trigger workflows, and query your knowledge base and that power comes from integration. The real challenge is connecting agents reliably and securely to the systems, data, and APIs they need to act on.

This talk shows how WSO2 Integrator handles the full agentic lifecycle: writing agent logic with AI assistance in a browser-based editor, wiring into existing APIs and on-prem systems via secure connectivity, exposing capabilities as MCP endpoints for other agents to consume, and shipping to production with enterprise-grade CI/CD, access control, and multi-cloud deployment. We'll explore how RAG tooling, cell-based security, and live traffic observability solve the problems that actually block agents from reaching production.

The agentic enterprise will be won by those who get integration right, and it builds on what WSO2 has been perfecting for over a decade.

ThunderID is WSO2's next-generation identity core, built from the ground up in Go to address the evolving demands of modern access management. This session introduces the project, exploring its architecture and the technical decisions that shaped it. We'll discuss why we chose Go and how ThunderID leverages fast startup times and a minimal memory footprint to deliver low-latency authentication at scale in cloud-native environments. ThunderID looks ahead, with its design shaped by emerging demands like AI agent identities and post-quantum cryptography. We'll also explore the developer experience and what it takes to get started with ThunderID. This session offers a grounded, technical introduction to what ThunderID is, why it was built, how it fits into the broader landscape of modern identity infrastructure, and where WSO2's identity story is heading.

As governments worldwide move beyond experimental AI pilots, the focus has shifted from simple efficiency gains to foundational innovation. This session brings together a global selection of public sector leaders from leading local, state, and national govt. agencies to discuss the reality of building AI-driven public infrastructure. We will explore how AI is being used to bridge the rural healthcare and technology gap, ensure fiscal transparency, promote citizen centric experiences, and drive national digital sovereignty. Join us to discover how these organizations are moving past the hype to build agentic government systems that are inclusive, sovereign, and citizen-centric.

Modern businesses rely on integration to provide AI agents the information they require to operate autonomously; connect systems and automate processes; break down data silos to enable real-time decision making; and build new business functionality combining both new and legacy systems.

The role of integration within a business therefore, has evolved from being a technical necessity into a core strategy that provides the foundation for the business to keep moving forward.

This panel discussion will use real-world examples to delve into how the right integration strategy increases productivity and efficiency, accelerates time to market, enables continuous innovation, and ensures the business keeps moving forward.

Modern enterprises are moving toward an Identity Fabric to unify siloed environments into a single, cohesive control plane. By connecting disparate access management, AI agent identity, and security token services into a consistent policy engine, identity has evolved into the primary security perimeter for the digital business.

However, the transition from legacy silos to a unified fabric involves navigating complex technical hurdles, cultural shifts, and the rapid rise of non-human identities.

This panel discussion features real-world identity practitioners who have successfully woven these components together. We will delve into how a robust identity strategy secures everything from global customers to autonomous AI agents, providing the foundation for a resilient, Zero Trust enterprise that keeps the business moving forward safely.

In today’s digital-first sports and entertainment landscape, seamless and secure customer authentication is critical to delivering frictionless fan experiences. This session explores how Everi leverages WSO2 Identity Server to power authentication across a diverse ecosystem of mobile and web applications spanning professional sports, wagering, and casino platforms.

From Major League Baseball stadiums to NHL and NBA mobile apps, Everi enables millions of users to access digital wallets, ticketing, payments, and in-venue services through a unified authentication framework. By integrating with external identity providers such as Okta and implementing federated single sign-on (SSO), Everi ensures a consistent and secure login experience across platforms while maintaining flexibility for league-specific requirements.

Everi will further explain how they use WSO2 to support:

• High-availability authentication for customer-facing applications in live event environments
• Secure token federation between third-party identity providers and EVERI-managed systems
• Scalable identity services across mobile apps, wagering platforms, and casino ecosystems
• Migration strategies from legacy solutions (e.g., Auth0) to WSO2 without disrupting user experience

This session will also highlight the operational importance of identity resilience, where even brief outages can impact revenue, brand reputation, and real-time fan engagement in cashless stadiums.

Join us to discover how Everi uses WSO2 to deliver secure, scalable, and seamless identity experiences at the heart of modern sports and entertainment platforms.

Architecture diagrams often rely on boxes and arrows to show components, systems, and integrations in a static way. But real systems are shaped not only by structure, but also by behavior: how requests flow, where decisions are made, how failures propagate, and how asynchronous interactions unfold at runtime.

This matters even more today as systems become more distributed and increasingly influenced by AI and agentic patterns. Agent behavior can be adaptive, contextual, probabilistic, and sometimes human-in-the-loop, making static views alone insufficient.

In this BoF, we will discuss what today’s diagrams are missing, how behavior can be represented more effectively, and whether techniques such as sequence diagrams, state diagrams, and domain models can make diagramming a stronger tool for aligning engineering, architecture, and business understanding.

As platform engineering matures, organizations are recognizing that platforms must be treated not just as internal tools, but as products. This shift, from project mindset to product mindset, changes how platforms are designed, operated, and evolved. This Birds of a Feather (BoF) session explores what it means to run platforms as products: defining clear user personas (developers, SREs, platform engineers), focusing on user experience, establishing feedback loops, and continuously iterating based on real usage. It also touches on key challenges such as balancing standardization with flexibility, driving adoption, measuring success, and aligning platform investments with business outcomes.

Through open discussion, participants will share experiences, patterns, and pitfalls in building and operating internal platforms. The goal is to exchange practical insights on how to create platforms that are not only technically sound, but also widely adopted, valuable, and continuously improving.

AI agents are now operating in production environments, executing actions, calling tools, and making autonomous decisions that span multiple enterprise systems. This shift is exposing gaps in how modern platforms were originally designed, particularly in their understanding, control, and governance of agent behavior at runtime.

While new abstractions such as lifecycle management, observability, evaluation, governance, and identity are emerging, there is still little consensus on what is truly required versus what will eventually be absorbed into existing platform layers.

This session brings together practitioners to discuss real-world experiences building and operating agentic systems, including what is working today, what is breaking at scale, and where current thinking around “agent platforms” remains incomplete or evolving.

APIs power modern digital systems. But they were designed for human developers building deterministic applications. Today, those APIs are increasingly consumed by AI-driven and agentic systems that are probabilistic, non-deterministic, and autonomous by nature. This mismatch introduces real risks such as runaway costs, unexpected behavior, security gaps, and brittle integrations.

Making APIs “AI-ready” requires more than adding an OpenAPI description or exposing an endpoint to an LLM. It demands rethinking APIs across multiple dimensions: how they are designed, how they are discovered, and how they are governed at runtime. In this session, we explore why traditional API assumptions break down in AI-driven environments and what architectural changes are required to address them. We’ll examine design patterns for AI-friendly APIs, challenges introduced by agentic consumption, and the critical role of API gateways, policies, and observability in controlling risk.

Platform engineering is entering a new phase, from internal developer platforms that streamline delivery to AI-native platforms that actively participate in operations. Traditional IDPs brought self-service, standardization, and golden paths on top of Kubernetes. Now, platforms are becoming intelligent systems that learn from telemetry and understand system-wide context.

As platforms evolve, they connect data across services, infrastructure, telemetry, and workflows into a context graph, transforming raw signals into structured, relational context. This is critical for AI agents, enabling accurate root cause analysis and better decision-making grounded in real system relationships rather than isolated data.

Using OpenChoreo, a CNCF Sandbox project, as a reference, this talk highlights how modern platforms combine CI/CD, GitOps, observability, and governance with MCP-powered interfaces, built-in AI agents, and reusable agent skills, enabling a shift from human-driven workflows to agent-assisted, adaptive platforms and providing a clear path to AI-native platform engineering.

Enterprises are deploying AI agents at an unprecedented pace, but most are flying blind. The gap between building an agent and running one reliably in production has never been wider. Shadow agents access production APIs without oversight, prototypes are pushed to production without guardrails, and agents operate using shared human credentials with no audit trail.

In this session, we'll introduce the WSO2 Agent Manager - an open-source, framework-agnostic platform for securely running, managing, and governing AI agents, and LLMs at scale. You will learn why Agent Management Platforms (AMPs) are emerging as a critical category in the enterprise AI stack, and how WSO2's approach addresses the core challenges of agent sprawl, operational readiness, and governance.

You'll see the Agent Development Lifecycle (ADLC) in action, learn how zero-code observability powered by OpenTelemetry gives you full visibility into agent behavior, and understand how enforced agent identity ensures agents operate with proper authentication, authorization, and accountability. We'll also draw on real-world incidents to illustrate what goes wrong when agents run without proper management. Whether you're building your first agent or managing dozens across teams, this talk will give you a practical framework for taking AI agents from prototype to production safely.

As API ecosystems expand across cloud, on-prem, and edge, the traditional single-gateway model is no longer sufficient. Organizations are shifting to hybrid architectures with gateways distributed across regions and platforms. While this boosts scalability and reduces latency, it creates significant hurdles in governance and operational consistency. In this talk, we explore the move toward hybrid API architectures and the realities of managing multiple gateways. Drawing from real-world experience, we’ll analyze why these setups emerge and how to tackle their complexity using a control plane driven approach. We’ll dive into separating control and data planes, federating policies, and enabling consistent deployment without centralizing traffic. You will learn how a unified control layer simplifies management while allowing teams to operate independently. Gain practical insights to design a scalable, governed, and future-ready API platform.

Kubernetes gives us powerful primitives, but a collection of primitives does not automatically become a developer platform. Platform teams are often left stitching together CI systems, GitOps, portals, observability stacks, and policy engines, only to expose the resulting complexity to developers.

This talk shares the architectural thinking behind OpenChoreo, a CNCF Sandbox project that sits on top of Kubernetes and other CNCF projects, introducing higher-level abstractions for both developers and platform engineers. I'll walk through how OpenChoreo separates concerns into distinct planes such as experience, control, data, CI, and observability,  and how this approach reduces developer cognitive load while preserving strong governance for platform engineers.

OpenChoreo brings together development workflows, a Backstage-powered portal, CI/CD, GitOps, and observability without turning Kubernetes into a developer-facing API. Through this, you'll see how to design meaningful abstractions, when to hide and when to expose Kubernetes primitives, and how to balance developer experience with platform control.

If you're building an internal developer platform, this talk is for you.

As enterprises shift from AI experimentation to production deployment, managing AI agent lifecycles at scale has become a key challenge. Unlike traditional software, AI agents are nondeterministic, context-driven, and continuously evolving. This shift requires reimagining the software development lifecycle as an Agent Development Lifecycle (ADLC).

This talk explores how organizations can design, build, deploy, and operate AI agents reliably at scale. We will walk through the end-to-end lifecycle, from design and development to deployment and operations, highlighting the core capabilities required to take agents to production. These include evaluation-driven development (EDD) as a foundational engineering practice, deep observability and feedback loops for continuous improvement, guardrails and runtime controls to ensure safe and predictable behavior, and platform thinking, treating agent management as a unified control plane for the enterprise.

AI agents are moving from experimental systems into production: automating workflows, calling external tools, and making autonomous decisions on behalf of users and organizations. This is a fundamentally different kind of software, and it requires infrastructure that has never existed before, not because the existing stack is broken, but because it was built for software that executes predefined logic, not software that decides what to do, chooses which tools to use, and spends money on its own.

In this talk, we lay out the building blocks enterprises need before agents can operate reliably at scale:

• Model infrastructure: access to LLMs that enable reasoning and autonomy, which agents depend on to operate
• Tooling and skills:  exposing enterprise systems as structured, agent-friendly capabilities instead of human-oriented interfaces
• Memory and context: retaining and applying knowledge across tasks so agents can operate with continuity across steps
• Identity and security: agents as first-class identities (not API keys or user credentials), with scoped permissions, authentication, and auditability
• Agent runtime management: deploying, observing, and evaluating agents whose behavior is inherently non-deterministic
• Governance and boundaries: defining and enforcing constraints for systems that act beyond static application rules

Most enterprises are still building agents in isolation. The shift ahead is architectural: building the foundations that make agents reliable, observable, and controllable at scale.

AI is rapidly shifting from an experimental feature to a core product capability delivered through APIs. But unlike traditional APIs, LLM consumption has highly variable costs driven by prompt size, output length, model choice, reasoning depth, retries, tool calls, retrieval, and agent workflows. This session explores how organizations can make AI consumption economically sustainable by moving beyond request-based metrics toward AI-specific metering, cost attribution, governance, and optimization. It examines how costs can be attributed across users, applications, tenants, API products, models, and workflows, and how these insights can inform quota design, model access, policy enforcement, and pricing strategy.

Attendees will learn how to approach AI APIs as measurable, governable, and monetizable products, with practical patterns for optimizing LLM usage and building sustainable AI API business models.

OpenChoreo is a complete, open source developer platform for Kubernetes. It ships with sensible defaults for GitOps, CI/CD, networking, and observability, and it works out of the box. But every enterprise has its own deployment standards, security and compliance requirements, promotion workflows, toolchain preferences, and infrastructure topology. In this talk, I'll walk through OpenChoreo's key extension surfaces and how to apply them. We'll look at ComponentTypes for defining deployment standards, Traits for composing cross-cutting concerns like security and compliance, DeploymentPipelines and Workflows for governed promotion, pluggable modules for integrating with your existing tools, plane topology for scaling across clusters and regions, and extending the Backstage-powered developer portal. You'll walk away with a practical understanding of how each extension point works and when to use it.

Internal Developer Platforms (IDPs) are a necessity for organizations looking to scale. By establishing Golden Paths, platform engineers are abstracting away infrastructure complexity and giving developers the self-service tools they need to ship code faster and more securely.

In this panel, we bring together practitioners to discuss the reality of building and using developer platforms in diverse environments. Our customers will share:

• Real-world wins: How IDPs have tangibly reduced time-to-market and developer cognitive load.
• Balancing standardization with the flexibility developers need.
• Honest insights into the cultural and technical challenges of adopting a platform-first mindset.

This panel discussion will explore the current state of enterprise agents, where they are already delivering value, and the main challenges in taking them into production, including readiness, trust, operational control, and organizational factors such as team structures, responsibilities, and operating models. The panel will also address the role of platforms, lifecycle management, observability, evaluation, and governance, and consider what the next few years may look like for enterprise agents.

Bringing together perspectives from industry leaders, the session will discuss how organizations are approaching these questions in practice and what is required to support broader enterprise adoption.

For decades, software was purely deterministic. There was no "ghost in the machine"—just code executing predefined rules. But as we weave Generative AI into our digital DNA, we are splicing probabilistic, autonomous agents into every system. The results are a dizzying mix where AI achieves superhuman feats one minute, and fails in spectacularly simple ways the next.

The Agentic Enterprise is actively taking shape across two dimensions. First, agents are within the digital fabric. Second, agents are users of every digital application and platform. equipping them with skills, CLIs, and contextual interfaces right from the start.

But to quote Spiderman’s Uncle Ben “With great power comes great responsibility”. The messy reality is that you cannot run a probabilistic agent on infrastructure built for deterministic code. When you put the ghost in the machine, traditional computing platforms break down. What happens when the system is no longer just a set of APIs, but a recursive stack of agents all the way down? What makes them so fundamentally different to build, observe, and run? And why can’t we do that in a silo?

In this keynote, WSO2 Chief AI Officer Rania Khalaf draws on 10+ years of building AI-native platforms to explore what is new, what is different, and what it takes to build an Agentic Enterprise.

Every architectural era is defined not by what it adds, but by what it hides. Client-server abstracted hardware. Cloud-native abstracted infrastructure. Platformless pushed the platform into the background. Each shift hid complexity and freed architects to solve harder problems at a higher level.

The agentic era follows the same pattern. This time, the abstraction target is workflow and decision-making. When agents can plan, reason, and act, the human role moves up the stack to intent.

That requires a new abstraction model where strategy, context, and boundaries are built into the system itself. This session maps the abstraction layers of the agentic enterprise, identifies where enterprise architectures are not ready for autonomous execution, and presents a practical model for designing systems that agents can navigate and humans can still govern.

Integration has become a critical business capability for insurance organizations, directly influencing cost, agility, and scalability. In this session, Pekin Insurance shares its journey beyond migrating to WSO2 and into the next phase of platform maturity.

As a mid‑sized P&C and Life insurer with a highly integration‑heavy landscape, Pekin Insurance successfully established WSO2 as its enterprise integration platform to address rising costs, vendor lock‑in, and scalability constraints. With a stable foundation now in production, the focus has shifted toward maturing the platform through improved architecture consistency, developer experience, CI/CD automation, security, observability, and governance.

Attendees will gain practical insights into Pekin Insurance’s current integration maturity, the prioritized roadmap driving quality, pace, and reusability, and how deliberate platform evolution is delivering measurable business value. This session offers real‑world lessons for organizations evolving integration from middleware to a strategic enterprise platform.

As API‑driven and cloud‑native platforms scale, failures become inevitable. What differentiates resilient digital organizations is their ability to operate complex, distributed systems with visibility, control, and confidence—without increasing operational risk.

Modern platforms scale responsibly when platforms, observability, and resilience align. This session provides an executive perspective on operating large‑scale, multi‑realm digital platforms. It explores how observability and resilience help teams confidently manage complex systems by increasing visibility across APIs and reducing operational risk through resilient design patterns.

Sam Altman recently said “Every company is an API company, whether they like it or not”. And Marc Benioff tweeted that Salesforce is ditching the UI, pivoting to MCP, APIs and CLI.

Headless products are coming up everywhere right now, and not just in our API world. I’ve been building APIs and API tooling for more than 15 years and have never been more excited about the future of our products.

The reason is that software vendors are betting that agents will be the next users of their products, and that this will drive exponential growth in demand and traffic.

In this talk, we’ll explore why APIs are the "atomic unit of product value" and the foundation for every other agentic tool.

You’ll walk out with a checklist on how to prepare your product for agents and what you should be building in the next two quarters so you can succeed in the agent economy.