Kin Lane on AI and the Future of APIs

Art Anthony · rss · 2026-07-08 source ↗ Reader 🖥️

AI Bubble Debate AI Unit Economics API Products & Sprawl Enterprise AI Adoption & Readiness MCP (Model Context Protocol)Moats & Defensibility Security Research Access to Locked-Down Platforms

Kin Lane argues that AI does not remove or replace the underlying API design, access-control, and data-ownership problems enterprises already had — it accelerates them, concentrating control of data and infrastructure into hyperscaler-owned walled gardens, which means durable API strategy (not chasing AI hype) is what will determine who controls value as the AI cycle inevitably cools.

theoretical · mixed — Primarily an expository interview aimed at understanding where AI/API power dynamics are heading, not a how-to; it also carries clear practical undertones for API strategists (what to budget, what to fear) and uses narrative analogies (AWS EC2 pricing history, the Thriller-dancing robot vs. the autonomous vehicle) to make its points.

Structure

Part	Role
Opening framing and hype-cycle question	context
From Database to API to Agent	evidence
Bigger Gardens with Higher Walls	evidence
Boom, Bubble, or Bust?	evidence
For More on AI and APIs: Attend Nordic APIs Summit (closing exchange)	conclusion

Key terms

walled garden Security Research Access to Locked-Down Platforms
An enterprise SaaS/cloud ecosystem (increasingly owned by Microsoft, Amazon, or Google rather than legacy vendors like Oracle) that restricts data export and steers customers toward its own bundled AI tooling once they are locked into it.
agentic consumption
AI agents, not humans, acting as the primary and growing client of APIs — discovering, parsing, and invoking them autonomously, which changes who developers are actually designing for.
API design problem
Lane's recurring diagnostic move: framing failures commonly blamed on 'AI not understanding the business' as actually pre-existing, unsolved problems of API structure, documentation, and discoverability that agents merely expose faster and more visibly than humans did.
SaaS data lock-in
A compounding effect distinct from ordinary vendor lock-in: because the platform itself controls export mechanisms (e.g., LinkedIn's invite-only API requiring a local proxy to get your own data out), lock-in deepens even for data the customer nominally owns.

Propositions

explicitThe current AI hype cycle is the largest Lane has personally observed, but it is fundamentally the same kind of cycle as AI circa 2012/2013 (Wolfram Alpha, IBM Watson), distinguished mainly by scale of money involved rather than novelty.conf: high
explicitAI does not remove the need for well-structured processes and data access; agents fail to understand a disorganized enterprise's processes just as a human would.conf: high
explicitMost AI/agent platform differences among Microsoft, Google, and AWS ultimately reduce to API design choices rather than fundamentally different AI capability.conf: medium
explicitEnterprise data-control power has historically migrated across control points: from the centrally-controlled database, to the web, and now to API gateways governing what data leaves the enterprise.conf: high
explicitStartups and platforms follow a predictable openness-to-lockdown trajectory tied to funding stage: open APIs at launch, locked down by the time of a Series D round.conf: medium
explicitGetting a genuinely needed API project funded right now often requires relabeling it as an AI project to access budget.conf: medium
explicitEnterprises increasingly live inside curated hyperscaler ecosystems, so their next tooling choice is dictated by their existing primary vendor (Google shop -> Google Cloud, Microsoft shop -> Office 365) rather than by which third-party solution best fits the problem.conf: high
explicitAI infrastructure costs will likely follow the same trajectory as early cloud computing: initial expectations of near-zero cost giving way to AI spend becoming the dominant operating expense.conf: medium
explicitAI/agentic tooling has proven itself in coding contexts, but will encounter significantly more friction (and slow down) as it meets the regulatory and physical-world realities of mainstream industries like healthcare and retail.conf: medium
explicitOrganizational power is shifting back from engineering/developers, who held outsized influence for the last decade, toward business stakeholders who currently control AI-era budgets.conf: medium
explicitcorroboratedThe AI hype curve will slow and LLMs will 'shrink back down' in scope, but APIs will keep growing in strategic importance regardless of where the AI cycle lands, because the underlying driver (venture capital and data-center economics) is not fundamentally technical.conf: high
supports ←Presentation: APIs for Agents: Rethinking API Programs in the MCP Era · p10 — Independent corroboration, from an enterprise-architecture practitioner rather than a developer-tooling commentator, that APIs remain the durable anchor regardless of which agent-protocol hype cycle is current.
implicitRising automation and agentic consumption increase both the frequency and blast radius of API security failures, such as Broken Object-Level Authentication.conf: medium
implicitCompanies building 'agentic tools' are frequently thin wrappers around Claude or ChatGPT rather than independently differentiated products, making them structurally vulnerable to being absorbed or displaced by the underlying platform owners.conf: medium

Arguments

AI adoption does not reduce the importance of rigorous API design — it raises the stakes on it. strength: medium

Explicit premises:

Agents cannot magically understand poorly-structured enterprise processes any more than humans can.
Differences between major AI platform vendors mostly boil down to API design and bundling choices, not fundamentally different AI capability.

Implicit premises:

Agentic systems inherit and amplify whatever weaknesses already exist in an organization's API surface, rather than compensating for them.
'AI-washing' of API budgets (disguising API projects as AI projects) reveals that the real underlying economic driver is still API/data infrastructure, not AI capability itself.

Inferences:

As agentic consumption scales, poorly-designed APIs will produce compounding failures (broken auth, contract violations, runaway request volume) faster and more visibly than under human-driven usage.

Enterprise data and infrastructure control is consolidating into fewer hyperscaler-owned walled gardens, driven jointly by AI-era economics and standard VC-stage dynamics, at the expense of independent third-party APIs. strength: medium

Explicit premises:

Open APIs at launch reliably get locked down by the time a startup reaches a Series D funding round.
Enterprises live in curated ecosystems tied to their primary cloud vendor, so their next solution choice is pre-determined by that relationship.
SaaS data lock-in compounds ordinary vendor lock-in, restricting even export of a customer's own data (e.g., LinkedIn's gated API).

Implicit premises:

Funding stage predicts platform openness more reliably than mission, ideology, or product quality.
Security/compliance anxiety and switching costs push enterprises toward a 'middling' bundled vendor solution over a better-fit third-party API.

Inferences:

Independent API providers face growing existential pressure regardless of product quality.
API projects funded under an 'AI project' label are exposed to cancellation risk if AI budgets contract, since their real justification (API infrastructure) is masked.

AI infrastructure spending will follow cloud computing's cost trajectory: early promises of near-zero cost will give way to AI becoming a business's largest operating expense. strength: low

Explicit premises:

AWS EC2 launched with expectations of near-zero server costs, but cloud bills became a top business cost over time.

Implicit premises:

Infrastructure-as-a-service pricing tends to eventually capture the value/savings it originally promised to eliminate, once dependency is established.

Inferences:

Organizations adopting agentic AI tooling now under low-cost assumptions should expect a cost trajectory resembling the cloud's, once dependency deepens — a cost-lock-in risk parallel to the data-lock-in risk Lane describes elsewhere.

Narratives

AWS EC2's launch, where near-zero server costs were expected but the cloud bill became a top business expense.
→ Analogy supporting the claim that AI costs will similarly move from perceived cheapness to becoming a dominant expense.
LinkedIn's heavily gated, invite-only API, where the only way to extract your own data is via a local proxy.
→ Concrete illustration supporting the proposition that walled gardens increasingly restrict access even to a user's own data.
The quip about disguising an API project as an AI project to secure budget.
→ Illustrates the internal-politics proposition that AI has become the effective budget vehicle for legitimate, otherwise-unfunded API work.
The 2022 Optus data breach, cited as an example of Broken Object-Level Authentication damage.
→ Concretizes and raises the stakes of the security-anxiety proposition about automation/agentic consumption amplifying existing API vulnerabilities.
A robot falling over while dancing to Thriller, contrasted with an autonomous vehicle making an unsafe driving decision.
→ Analogy supporting the proposition that AI's failure tolerance differs sharply between low-stakes/novelty domains and safety-critical, physical-world domains — which is why coding-domain AI success won't generalize smoothly.

Questions addressed

✅ Who controls the data, infrastructure, and APIs that AI increasingly relies on?
Increasingly the hyperscalers (Microsoft, Amazon, Google) via walled gardens and API gateways, displacing older vendors (Oracle) and smaller third-party providers.
✅ Does AI meaningfully change what API practitioners need to do?
No — fundamentals (well-designed, well-documented APIs; 'house in order') remain the same or become more important; agents don't compensate for disorganization any more than humans did.
⭕ Is the current AI hype cycle economically sustainable?
Lane predicts the hype curve will slow and LLMs will 'shrink back down to a certain size' but does not resolve whether current AI investment levels are recoverable or what 'shrinking back down' concretely means for practitioners.
⭕ Will AI's demonstrated success in coding generalize to other, more regulated or physical-world industries (healthcare, retail)?
Lane asserts it will 'slow the roll' when meeting mainstream-industry realities, without explaining the specific regulatory or technical mechanisms, or giving any timeline.

Gaps

incompleteLane repeatedly asserts that AI/agent problems 'boil down to API design problems' but never specifies what concrete design practices make an API 'agent-ready' (e.g., machine-readable documentation, deterministic workflow standards). The article links to a prior Nordic APIs piece on Arazzo (deterministic API workflows) but Lane himself doesn't engage with it in this interview.
Read next: The linked Nordic APIs article on deterministic API workflows/Arazzo, and broader API-first / machine-readable-documentation literature for agentic consumption — to turn Lane's diagnosis into actionable design guidance.
incompleteThe security-risk section raises Broken Object-Level Authentication and cites the Optus breach as a cautionary example, but never connects this to concrete mitigation practices for agent-facing APIs (e.g., OWASP API Security Top 10, authorization models for autonomous/non-human clients) — leaving the reader with anxiety but no path to action. Directly relevant to a telco application-security context.
Read next: OWASP API Security Top 10 and current literature on authorizing and rate-limiting agentic (non-human) API clients.
illogicalThe claim that 'AI is just going to be [cloud costs] on steroids' rests on a single historical analogy (AWS EC2) and doesn't engage with counter-evidence that per-token/per-query LLM inference costs have been falling even as total usage (and thus total spend) rises — conflating a cost-per-unit trend with a total-spend trend.
Read next: Current data and trend analysis on LLM inference cost-per-token over time, to test whether the EC2/cloud-bill analogy actually holds for AI economics.
incompleteThe claim that 'business people' are taking back power from engineering/developers is a significant organizational-leadership claim, but the interview never explores the mechanism — how this shift plays out inside engineering orgs, what it implies for platform/API teams' autonomy and decision rights, or what leaders should do in response.
Read next: Organizational-design and platform-team-autonomy literature (e.g., Team Topologies, John Cutler's writing on product operating models) to unpack what this 'business takeback' means for how engineering leadership should structure teams and decision rights under AI-driven budget shifts.
incompleteModel Context Protocol (MCP) is named prominently in the interviewer's framing as central to the current hype, but Lane's actual answers never substantively engage with MCP's specific tradeoffs, security model, or discovery mechanics — it functions as a hype-marker rather than something analyzed.
Read next: The MCP specification and independent critical analyses of its security/discovery model, given the persona's stance of being a rigorous AI adopter rather than a hype-follower.
closed byPresentation: APIs for Agents: Rethinking API Programs in the MCP Era — MCP is named prominently in that interview's framing but Lane's own answers never substantively engage with MCP's tradeoffs, security model, or discovery mechanics. This talk supplies exactly that missing substance from a practitioner's production deployment: the tools/prompts/resources model, the discovery/invocation/validation cycle, the tool-disambiguation cost problem at scale, and a concrete governance example.

Kin Lane on AI and the Future of APIs

Structure

Key terms

Propositions

Arguments

Narratives

Questions addressed

Gaps

Related documents