Hello APISIX community, I am studying a narrow responsibility boundary that appears once an AI agent can invoke APIs that create real business effects.
An AI gateway can already own routing, authentication, rate limiting, model access, and policy enforcement. The downstream business system must still own the final authorization decision for the acting subject and current business state. Between those layers, teams are repeatedly adding operation-level metadata for capability exposure, risk, approval intent, audit sensitivity, and execution constraints. I would value the community's view on one architectural question: Should this metadata be gateway-owned policy, an implementation-neutral declaration consumed by the gateway, or an explicitly separate business-control contract? I maintain ACC, an open experiment in portable capability declarations, and BailingHub, one implementation exploring the execution side. I am mentioning that relationship for disclosure, not asking APISIX to adopt either project. The useful outcome here would be a clearer boundary between AI gateway responsibilities and final business authority. If this topic belongs in a different APISIX forum or proposal process, please point me to the right place. Thank you.
