To drive a black cab in London, you have to pass the Knowledge.
Three or four years of study.
About 25,000 streets. Every one inside six miles of Charing Cross.
Hundreds of routes. Tens of thousands of places you might be asked to go.
Learned on a moped, in the rain, with a clipboard.
Then recited from memory to an examiner in a small room.
Scientists scanned the brains of cabbies and found the part that handles navigation had physically grown.
That’s what it takes to be trusted with a stranger in the back of your car.
And that’s before the licence. The badge. The plate. The meter. The regulator.
Now think about the new driver in your business.
The driver with no Knowledge
It’s never seen your roads.
It has no licence. No badge. No record of who it is.
It makes up the route as it goes.
Run it twice, it takes two different routes. Run it a thousand times, and a few of them are routes you’d never have allowed.
And you’ve just handed it the keys to your customer data.
That’s an AI agent.
Agents are just software
That’s all they are.
A program that calls other programs. Reads data. Writes data. Triggers things.
But it was written by software.
And it’s non-deterministic. Nobody reviewed that exact sequence of actions. It didn’t exist until a second ago.
When normal software goes wrong, it’s a bug. You read the code. You find the line.
When an agent goes wrong, there’s no line.
There’s a decision. Made at runtime. At machine speed. Possibly a thousand times before anyone looks.
That’s the blast radius.
So every organisation has to answer the same question.
How do I let an agent work without letting it do anything?
We did the Knowledge
For ten years, we’ve worked with highly regulated industries.
Banks. Governments. Airlines. Healthcare.
People who can’t say “we’ll fix it next release”.
Our job is to manage their APIs. Control them. Govern them. Audit them. Secure them.
APIs are most of what moves across the internet. The number people quote is 80%.
A cabbie’s Knowledge took years.
So did ours.
An agent is just another API consumer. A fast one. An odd one. One that never sleeps.
When it touches your systems, it usually does it through an API call.
So the Knowledge still applies.
Who’s calling? Prove it. (The badge.)
Where are they allowed to go? Write it down. (The licence.)
How often? Cap it.
What did they do? Log all of it. (The meter.)
None of that is new.
What’s new is who’s in the driving seat.
Who builds the road
A cabbie doesn’t build the roads. Somebody else does. And somebody else decides where the cameras go.
Most AI gateways are cloud platforms. Your agent traffic goes down somebody else’s road, on somebody else’s land.
For a lot of the people I talk to, that’s a no before the conversation starts.
Their agents touch systems of record. They don’t want the traffic, the credentials or the audit trail leaving the building.
So we do it differently.
Self-managed software. Open standards. You run it on your own systems, next to your own data.
You hold the logs. You decide the rules. You audit it without asking anyone’s permission.
We’re the only vendor, out of the fourteen in the Gartner AI Gateway report, that works this way.
Safe roads. On your land.
The importance of self-hosted AI Gateways
If an agent did something strange tomorrow, could you show exactly what it called, with whose credentials, and who approved it?
If you can’t, you’ve got a gap.
Agents will never do the Knowledge.
They’ll never memorise your roads. They’ll never earn the badge.
So build the roads for them.
Put the lanes in. Put the cameras up. Decide where there’s no road at all.
Then let them drive.
Further reading
- Structuring the AI supply chain (Tyk)
- AI, APIs and the path to AI readiness (Tyk)
- AI agents will only use MCP, so do we still care about traditional APIs? (Tyk)
- Tyk learning centre
- TFL: Guide to Learning the Knowledge of London
- UCL: Changes in London taxi drivers’ brains driven by acquiring ‘the Knowledge’
- Gartner AI Gateways
