Separate the obligations from the mechanisms. The obligations are protocol-independent: every API, whatever it speaks, needs a machine-readable contract in version control, a named owner, a documented security model, a versioning and deprecation policy, an entry in the catalog, and observability. Write those as policy once.
The mechanisms are protocol-specific. OpenAPI and Spectral or Vacuum for HTTP. AsyncAPI for event-driven and messaging. Protocol Buffers and schema linting for gRPC. Schema and query-cost rules for GraphQL. Tool definitions and descriptions for MCP. Each gets its own linting rules, but the rules are implementing the same policies.
The reason this framing matters is that the industry spent fifteen years building management for HTTP APIs — authentication, plans, rate limits, analytics, documentation, discovery — and then let the event-driven estate grow up outside all of it. Backfilling that is real work, and it is much cheaper to do as the estate grows than to retrofit onto a decade of ungoverned Kafka topics.
Practically: one policy register, one catalog covering every protocol, per-protocol rulesets in the pipeline, and one report that tells you coverage across all of them. If your governance dashboard only counts OpenAPI documents, it is measuring a fraction of your surface area and calling it the whole.
