Just before Dreamforce 2025, MuleSoft unveiled Agent Fabric, a platform designed to govern, manage, and observe AI agents across enterprise ecosystems based on their experience with API management. Ahyoung An, MuleSoft COO at Salesforce, explains to us how the company is applying its API management expertise to solve one of the biggest challenges in the agentic era: orchestrating and governing agents built across multiple platforms.
As organizations embrace AI agents, they face a rapidly fragmenting landscape. Every SaaS-application is embedding agents, cloudproviders are building agents, partners are building agents, and internal teams are developing their own agentic solutions. This creates new challenges: how do you manage, secure, and observe all these agents working together? How do you keep a clear overview? That is what we talked about with An in the video below.
MuleSoft Agent Fabric positions itself as a neutral orchestration layer that can work across different platforms because it takes the man-in-the-middle position. A significant differentiator from competitors who typically only manage agents built on their own platforms. MuleSoft’s approach mirrors what made the company successful in API management: acting as an interactive middle layer with comprehensive oversight capabilities.
Also read: Salesforce enters ITSM market, will ServiceNow regret its CRM move?
Three pillars of agent governance
The platform is built on three core capabilities: Discover, Broker, and Agent Visualizer. The Discover pillar creates a unified registry for all agents, LLMs, and MCP tools within an organization. The Broker handles orchestration, receiving prompts and determining which agents and tools to engage. What sets MuleSoft apart is its governance-first approach. Every ingress and egress point is protected by default, with additional policy layers available for specific needs, for example PII detection. The Agent Visualizer provides a visual map showing how agents, systems, and LLMs interconnect and perform.
Building on API management foundations
MuleSoft is applying lessons learned from the cloud and their iPaaS experience to the agentic world. Rather than building a completely separate platform, the company uses its industry-leading API gateway and management solutions as a foundation. This approach makes sense because APIs ultimately serve as the actions that empower agents to perform tasks. The platform supports industry standard protocols like MCP (Model Context Protocol) and A2A (Agent-2-Agent), allowing organizations to have agents talking to eachother with MuleSoft in the middle. It also gives the possibility to convert existing APIs into agent-ready tools without extensive rework. This means enterprises can add MuleSoft Agent Fabric to existing implementations without rebuilding their entire architecture.
Domain-driven architecture for better performance
An important insight An shares is the concept of domain-driven brokers. Rather than creating massive agents with unlimited capabilities, MuleSoft recommends limiting agents to approximately 8-10 actions each. This constraint improves performance and accuracy by creating focused and domain-specific agents. If you start with domain specific agents, it’s not that hard, think of employee management, customer service, or other business functions. In most cases that is already limited to 10 actions.
This architecture allows organizations to build specialized agent ecosystems where each component has clear boundaries and responsibilities, making the entire system more manageable and observable.
Looking ahead: user management and access control
When asked about integrating with HR systems and Active Directory for user role management, An acknowledges this is an active area of discussion. As agents take on more responsibilities, access management becomes increasingly critical. The conversation suggests this capability is on MuleSoft’s roadmap as customer conversations continue to emphasize its importance.
Watch the full interview to understand how MuleSoft Agent Fabric addresses the governance gap in AI agent orchestration and why treating security as a forethought rather than an afterthought is essential for enterprise AI success.