A Policy Enforcement Point (PEP) is the component that intercepts a request and applies the authorization decision returned by policy logic. It matters because a good decision is useless if it is not enforced consistently at the right point in the request flow.
What is Policy Enforcement Point (PEP)?
A PEP sits in front of or inside a system handling access requests. It gathers context, asks a PDP or policy engine for a decision when needed, and then enforces allow, deny, or constrained outcomes such as masking, filtering, or step-up requirements.
What Policy Enforcement Point (PEP) Commonly Supports
Common placements include API gateways, service proxies, application middleware, workload sidecars, and SaaS authorization layers.
Policy Enforcement Point (PEP) vs. Policy Decision Point (PDP)
A PDP decides what should happen. A PEP applies that decision to the actual request path.
Frequently Asked Questions
Why is a PEP important?
Because consistent enforcement is essential for centralized policy models to work in practice.
Can a system have multiple PEPs?
Yes. Large environments often enforce policy at several layers such as gateways, apps, and service meshes.
Related Cybersecurity Terms
