GraphQL & Federation

Data that's ready for the future

Everyone wants to build AI agents, but agents need access to data that is hard to unlock safely. GraphQL is a technology made popular for building user experiences, and is ideally suited to providing a secure, structured and safe way for teams and AI to work with your organisation's data.

Reading time

Around 15 min

Last reviewed

July 2026

Why This Matters Now

AI agents are arriving whether or not your data is ready for them. We build federation solutions with GraphQL which make it safe to connect them to the systems your business runs on.

Your data already lives in separate systems, with separate owners. Master data, product, pricing, orders and customers each have a system and a team behind them. Federation builds on this good governance practice.

AI agents are starting to act, not just answer. They book and process work people still do by hand. To do that safely, they need access to the systems behind those decisions, with permissions limited to the minimum.

The standard offers access without security Model Context Protocol, an open standard released in 2024, is in use globally to allow AI agents to access backend systems. Whilst MCP provides the connection, federation provides the data and the control.

01 · What federation solves

Two problems your business may have

Problem 01

Every system has its version of the truth

Master data, product data, pricing, orders and customers each live in a different system. Each one has its own owner and describes the world in its own words. Anyone who needs a complete picture puts it together by hand, every time.

What federation does

Federation brings those sources together into one interface that your engineering teams work with. Each data owner keeps their system and their way of working. Nothing about their day changes.

The usual alternative

Move everything onto one large platform. SAP, Salesforce and Oracle will each give you a single version of the truth. But you have to change how you work with your data and processes.

Problem 02

AI creates security challenges

An agent that acts on business-critical data needs more than access. It needs data with a clear structure, permissions limited to the minimum, and a way to find out what exists and what it means.

What federation does

Federation provides more than just data. It describes the shape of every field, provides access controls on data and APIs, and lets an agent discover what is available. Publish it once through MCP or an API and every agent gets the same guarantees.

The usual alternative

Build a custom interface for each system, on top of SAP, then Salesforce, then Oracle, and rebuild the safety rules in every one of them.

02 · How federation works

GraphQL: one interface for all your data

In a typical composable stack, commerce, PIM, search, pricing and content systems each describe the world in their own way. One API talks about SKUs, another about articles, a third about catalogue items. When you want to combine that data you often have to write custom code to describe how the relationships and permissions work.

GraphQL is a structured data format which replaces that reconciliation with a Graph. You define a Product, a Price, a Customer, and express the relationships between them as data fields instead of glue code. Every consumer of your data, whether a frontend, a partner integration or an AI agent, negotiates with the GraphQL schema instead of with the teams behind it.

GraphQL has been proven at scale as the technical foundation for user experiences across a broad range of touchpoints. Originally developed for Facebook, it is an open standard trusted by organisations around the world.

Working with GraphQL, each team owns the data, permissions, and processes as a Subgraph and the platform provides the Federation: composing them into a single view of your organisation's data and the actions that can be taken called a Supergraph.

The Supergraph allows teams to own and manage data independently, and consumers see a single, coherent API.

GraphQL

The structured, typed language that represents your data and APIs to consumers such as AI agents.

Subgraph

One team's slice of the graph, owned and deployed by that team.

Supergraph

The composed whole, one schema every consumer talks to.

03 · 3 different approaches

Three routes to building a scalable data platform

The question your teams will need to decide is whether to federate subgraphs into a supergraph, to operate a single central graph, or to keep existing APIs. Which approach you take depends on your systems.

Federated supergraph

Single central graph

Individual APIs

Team autonomy

High, each team owns its subgraph

Low, one team owns the schema

High, but uncoordinated

Single source of truth

One composed, typed schema

Yes, but a bottleneck

No, every client re-stitches it

Change safety

Breaks caught before merge

Manual coordination

Discovered in production

Agent readiness

One typed contract to negotiate

Workable, if it scales

Agents must learn every endpoint

Cost as it grows

Flattens, new consumers are cheap

Rises with the central team

Rises with every integration

Federation is a layer on top of what you already run. REST APIs, SOAP services, custom integrations and legacy backends stay where they are. The work is deciding what to keep, what to refactor, and what to leave alone.

04 · How we work

How we build federated platforms

Federation sits at the core of our composable delivery practice, and it has run in our production work since 2019. Whether that's by enhancing existing platforms with GraphQL, or with our own composable accelerator platform Evolve.

A platform team owns the composed graph and the checks. Product teams own their subgraphs and ship on their own cadence.

Every schema change runs composition and contract checks before merge, so a breaking change is caught in the pull request, not in production.

We have been working for 6 years with platforms such as Apollo GraphOS, WunderGraph Cosmo and The Guild's Hive to provide key additional features such as schema management, security, and observability.

We advise on vendors and platforms independently. We're not a reseller, so the recommendation you get is the one that fits your stack, not the one that pays us.

05 · Further Reading

Learn from our experience

Share this page with anyone you need to convince.

Article

Generating MCP tools from GraphQL schemas

By Leon Graumans

Article

Designing a GraphQL supergraph your AI agents can safely use

By Seb Potter

Article

GraphQL code generation on top of the Amplience REST API

By Kors van Loon

Next steps

See how this fits your business

When you are ready to turn the question into a decision, our Architecture Assessment is the next step. It is a five-day, fixed-scope review of your business, run the way we would review our own.

See the assessment