Istio 1.31 is out, and one line in the release notes says a lot about where API infrastructure is heading. You can now run agentgateway, a proxy built for AI agent and MCP traffic, as a waypoint inside the mesh.

If “waypoint” means nothing to you yet, that’s fine. Here’s the short version, then why it matters if you build APIs.

What changed in 1.31

Istio’s ambient mode splits the mesh in two. A small per-node component handles encryption and basic connectivity. Anything that needs to understand HTTP, like routing, auth policy or rate limits, goes through a separate proxy called a waypoint. You opt services into a waypoint with a label.

An API gateway is a server that sits between clients and backend services, acting as the single entry point through which all API traffic passes. Every request goes through the gateway, which can inspect, modify, authenticate, route, transform, and rate-limit that traffic before it reaches any backend service. For teams running multiple services, an API gateway centralizes concerns that would otherwise be duplicated across every service independently.

Understanding what a gateway provides — and what it does not — is the prerequisite to deciding whether one belongs in your architecture.

Most SaaS APIs are multi-tenant: the same infrastructure serves many customers, each operating in isolation from the others. A user of Tenant A should never see, modify, or even know about the data of Tenant B. This isolation is the foundational guarantee of a multi-tenant system, and it must hold at every layer of the stack — not just at the query level, but at the API design level, the authentication level, and the operational level.

Every API starts with a choice that will shape every decision that follows: what protocol are you building on? REST, GraphQL, and gRPC are the three dominant options in modern API development, and none of them is universally correct. Each reflects a different set of assumptions about who is calling the API, how often, and what they need back.

Understanding the tradeoffs is not optional knowledge for serious API developers. It is the foundation.