Apollo GraphQL introduces GraphOS Agent Services, giving AI Agents governed access to enterprise APIs and systems

New services extend Apollo‘s platform to AI agents, helping companies control what agents can find and do across existing systems; GraphOS MCP Server also gives teams a full suite of agent-ready tools for building and managing the graph.
Intuit is piloting GraphOS Agent Services and joins American Airlines, Block, and Expedia Group at Apollo Summit 2026 to share how Apollo powers their AI agents.

Apollo GraphQL, the graph-based API orchestration leader, introduced Apollo GraphOS® Agent Services, giving AI agents secure, governed and auditable access to an enterprise’s systems and APIs. Built on GraphOS, Apollo’s platform for connecting and orchestrating enterprise APIs, Agent Services extends that infrastructure to AI agents, so companies can control what each agent can access and do. GraphOS today orchestrates more than 2 trillion operations monthly after more than a decade of production use. Apollo also expanded the GraphOS MCP Server into a full suite of agent-ready tools for building and managing the graph. Both were unveiled at Apollo Summit, the world’s largest GraphQL event, in San Francisco.

Why Now: Your APIs Weren’t Built for Agents
Companies adopting AI agents face a common challenge: agents need to call the same APIs that already run the business, but those APIs weren’t built with agents in mind. The rules about what’s safe to return usually live in a developer’s judgement, not in the API itself, and agents don’t have access to that judgement. Those rules need to be made explicit and hold every time, regardless of what the AI model decides. That takes a domain model – a clear, governed map of a company’s systems and APIs, how they relate, and who or what is allowed to see and interact with them.

Most enterprise systems don’t have one domain model built for this purpose today. A single request for a customer’s name or email often returns far more than what was asked for, e.g., sensitive fields like personal information, billing details, or internal notes an agent shouldn’t be able to access. Each extra field adds token cost. And any field that shouldn’t have been exposed is now sitting in a chat window, a log, or a large language model’s (LLM’s) context window, outside anyone’s control.

Most enterprise APIs were built for trusted developers, and that model breaks down with autonomous agents. Agents need their own identity, whether they act on someone’s behalf or operate autonomously, and a permissioning model built specifically for how they access systems.

Gartner® projects that, “through 2028, at least 80% of unauthorized AI agent transactions will be caused by internal violations of enterprise policies concerning information oversharing, unacceptable use or misguided AI behavior rather than from malicious attacks.” If agents can access a given field, they will, and what they’ll do with it can’t be predicted with accuracy. Deterministic access rules are the only way to limit that risk.