In an industry where some companies have been underwriting risk since before the telegraph was invented, API governance presents unique challenges that go far beyond typical enterprise concerns. As someone running the API Governance program at PZU – an over 220-year-old insurance company, I’ve navigated the complex journey of implementing comprehensive API governance while balancing the weight of legacy systems, regulatory compliance, and centuries of established business processes. This session explores our pragmatic approach to API governance that acknowledges both our historical foundation and our digital future. I’ll share the strategic decisions behind our governance framework — why we chose federation over centralization, how we balanced automation with human oversight, and the specific challenges of governing APIs that must serve both traditional enterprise integrations and emerging AI agent consumers. The rise of autonomous AI agents changes how we think about API design and governance. Unlike human developers who read documentation and follow integration guides, AI agents consume APIs through dynamic discovery, make autonomous decisions about usage patterns, and require different approaches to rate limiting, error handling, and schema validation. I’ll demonstrate how we’re adapting our governance policies to accommodate these new “customers” while maintaining the security, compliance, and reliability standards.