# Securing the Autonomous Engineer: Postman's Approach to API Security in the Agentic AI Era

## **The API security crisis no one saw coming until agents arrived.**

 *Why Agentic AI has introduced a new class of risk to the API workflow, and how Postman is securing the autonomous engineer as a result.* There's a version of the AI security story most enterprises are still telling themselves: watch out for hallucinations, double-check the outputs, and keep a human in the loop. It's a reasonable story. It's also about two years out of date. The real threat has shifted. The question is no longer whether an AI model generates false text. It's whether an AI agent takes a false action, autonomously, at machine speed, through an API you forgot you had. ## From text to action: why the threat changed

 When ChatGPT and Claude brought large language models into the mainstream, hallucination dominated the conversation. Models could generate plausible-sounding nonsense, and that was alarming. But hallucinated text, at worst, misleads someone. Hallucinated actions, where agents misinterpret an instruction and run it against a live system, are a categorically different problem. The math compounds quickly. IDC projects full agentic AI deployment across the enterprise by 2027. Gartner estimates 40% of enterprise applications will integrate task-specific agents by year-end, up from less than 5% in 2025. Agents can also be stood up fast, guardrails optional. The blast radius expands before security teams know there's a fire. The financial sector has already seen what happens when it does. In 2024, attackers at a major financial institution didn't breach a firewall; they sent an email. Hidden instructions embedded in the message caused an AI assistant to approve fraudulent wire transfers totaling $2.3 million. The agent did exactly what it was designed to do. The API didn't know the difference. ## The API workflow is the new attack surface

 Here's the core problem: the APIs that agents depend on weren't built for them. They were designed for human-driven applications, systems that assume the implicit judgment a developer exercises when making a call. Agents consume APIs autonomously, at scale, with none of that judgment. The gap is striking. According to Postman's 2025 State of the API Report, 89% of developers use AI in their daily work, but only 24% are designing APIs with agents in mind. They're still assuming traditional consumption patterns. Meanwhile, enterprises now manage thousands of APIs across teams, vendors, and legacy systems, many of which are undocumented and ungoverned. That sprawl was already a growing problem. Agents make it a crisis. When an autonomous agent operates inside an API workflow without clear boundaries, it doesn't just consume data; it acts on it. It can initiate unauthorized payments, modify records, and expose sensitive data, all through a misused endpoint, all before a human has had a chance to notice something went wrong. Unlike a developer who pauses when something looks off, an agent keeps moving at machine speed until something external stops it. This is the defining security risk of the agentic era. It isn't a novel exploit. It's a familiar API surface meeting a new class of consumer that has no instincts, no hesitation, and no context about what it shouldn't do. As Postman CEO Abhinav Asthana put it: "AI is accelerating software production, but speed without context creates risk." ## What makes the agentic API workflow uniquely risky

 To understand how to secure agents in the API workflow, it helps to be precise about where the risks actually live. **Agents operate without institutional memory.** A developer calling an API knows what it connects to, what depends on it, and what a bad outcome looks like. A general-purpose agent has none of that. It infers from available context, and inference is exploitable. Prompt injection, the technique behind the $2.3 million wire transfer incident, works precisely because agents act on instructions without verifying their legitimacy. **API sprawl becomes an active liability.** Every undocumented endpoint is a dark spot. Every overly scoped OAuth token is a loaded weapon. When humans navigated this sprawl, implicit judgment provided a soft guardrail. Agents remove that guardrail entirely. An agent connected to an ungoverned API surface doesn't know which endpoints are sensitive, deprecated, or out of scope. It finds out by calling them. **Mutating actions at machine speed outrun manual review.** The damage from an agent misusing an API doesn't accumulate at human speed. Write operations run autonomously, across hundreds of endpoints, can create compliance exposure, data loss, and system corruption faster than any incident response process can react. The log, if it exists at all, is the only record of what happened. **The supply chain multiplies the risk.** Every model, framework, and third-party integration added to an agentic stack is a potential vector. The more complex the tooling, the harder it is to maintain visibility into what the agent is doing, on whose behalf, and with what credentials. ## How Postman is securing the autonomous engineer

 Postman operates at the center of the API workflow for more than 40 million developers and 500,000 organizations. That position comes with a clear responsibility: as agents become part of engineering teams, the platform they work through has to enforce the guardrails that agents themselves can't. That thinking shaped how we built the AI Engineer, Postman's cloud-native agent for the full API lifecycle. The security architecture isn't a feature layer added on top. It's the foundation the AI Engineer was built on, and it maps directly to the risks described above. **Context eliminates guesswork.** The AI Engineer runs on the Context Graph, an always-on, continuously updated map of the APIs and services across a Postman organization. It captures how APIs were built, changed, and governed over time. This means the agent operates with institutional knowledge rather than inference. It understands dependencies, knows ownership, and doesn't have to guess how services connect. Prompt injection works by exploiting an agent's lack of context. An agent that already holds authoritative context about your API landscape is a much harder target. **Sandboxed execution contains the blast radius.** Every run happens in a fully sandboxed cloud environment. The AI Engineer can pull repositories, run bash commands, run tests, and use Postman's full capability set without ever touching production directly. The explicit architecture decision here is that an agent's actions should never outrun human review. The sandbox is what makes that guarantee possible. **Human approval gates protect write operations.** The AI Engineer can investigate, test, document, and propose. Mutating actions require explicit human sign-off before they run. This isn't a constraint on what the agent can do. It's the checkpoint that makes it trustworthy enough to do more. Every write operation that requires approval is a moment where a human can catch what the agent can't: context about whether this action is actually appropriate, right now, in this system. **The API Catalog defines what's in bounds.** The API Catalog serves as the governance layer for the AI Engineer, the same way it does for human engineers. It defines which APIs exist, who owns them, and what's authorized. The agent doesn't get to decide what's in scope. The catalog does. This is the direct answer to API sprawl as an attack surface: if an endpoint isn't in the catalog, the agent doesn't operate on it. **Verified artifacts create a complete audit trail.** When the AI Engineer completes a task, it returns verifiable artifacts: Collections, test results, specs, run logs, pull requests, and a temporary cloud workspace. This isn't just operational convenience. It's a high-fidelity record of what the agent did, proposed, and had approved. When agents run autonomously at scale, that record is what separates a defensible incident from a compliance failure. ## Securing the platform, not just the agent

 The AI Engineer is one piece of a broader platform security posture. Postman's approach to the agentic era is built on a recognition that governance can't be bolted on after the fact. It has to be embedded in the development workflow, the testing pipeline, and the runtime environment. The API Catalog gives teams a live, authoritative view of their API landscape, the prerequisite for any meaningful governance. Postman Insights surfaces behavioral anomalies before they become incidents. The MCP Server Network, the first curated network of verified MCP servers, extends this governance model to the broader agentic ecosystem, ensuring that the APIs agents connect to externally meet the same standards as the ones they build internally. Together, these aren't security features added alongside the platform. They are the platform, for a world where the API is the security perimeter. When an agent operates inside your environment with legitimate credentials, firewalls don't help. The question is whether the API it's calling enforces the right controls, and whether the platform it runs through was designed for autonomous consumption or retrofitted from a world where a human was always in the loop. ## The principles behind the architecture

 The agentic era doesn't require new security principles. It requires proven ones, implemented at machine speed and machine scale. Know your API surface. Enforce policy, don't just document it. Give agents the minimum access they need to do the task at hand. Log every action in the execution chain. Build human checkpoints into consequential workflows. And build systems where the agent's context comes from an authoritative source, not from inference. What Postman has built reflects those principles applied to an autonomous engineer operating inside real API workflows, at production scale. The guardrails don't limit what the agent can do. They're what makes it trustworthy enough to do more. In a world where the blast radius of a misused API grows faster than any team can manage manually, that trust has to be architectural. ## Resources

- [Postman 2025 State of the API Report](https://www.postman.com/state-of-api/)
- [Postman AI Engineer](https://www.postman.com/product/ai-agent-builder/)
- [Postman API Catalog](https://learning.postman.com/docs/api-governance/api-catalog/api-catalog-overview/)
- [OWASP Top 10 for LLM Applications (Prompt Injection)](https://owasp.org/www-project-top-10-for-large-language-model-applications/)
- [Gartner: AI Agents Predictions](https://www.gartner.com/en/articles/intelligent-agent-in-ai)
- [Postman MCP Server Network](https://www.postman.com/explore/mcp-servers)