An API gateway is a central entry point for API requests. In an authorization architecture, it acts as a policy enforcement point (PEP): it validates an incoming request, turns it into a normalized authorization request, asks a policy decision point (PDP) for a decision, and forwards or blocks the call. This central position makes it useful for applying consistent rules across many APIs without placing the same authorization logic in every service. section 11.1 section 11.1.1
A gateway is best suited to north–south traffic: requests entering a service environment from employees, customer applications, or other external systems. It provides a fast rollout path for global rules and consistent logging because many APIs sit behind one control point. It does not, however, observe every east–west service-to-service request inside the infrastructure; a service mesh or per-service proxy can cover those paths. section 11.1.1 section 11.1.4
For each protected request, the gateway can perform a decision flow:
- Validate the presented access token, including its signature, issuer, audience, expiration, scopes, and subject. section 11.2.4
- Construct a PARC request: principal, action, resource, and context. Identity may come from the token; action from the API method; resource from the path or body; and context from scopes, tenant, or attribution. section 11.2.4
- Send the normalized request to Cedar or another PDP, then enforce allow by forwarding the API call or deny by blocking it, commonly with 403 Forbidden. section 11.1.1 section 11.2.4
Department-scoped salary access
A Manager Dashboard calls an HR API for a manager requesting view_salaries for a department. The gateway receives verified information about the manager, builds a request containing the principal, action, department resource, and calling-service context, then sends it to Cedar. A manager viewing their own department is allowed; a request for another department is blocked before it reaches the HR API. section 11.1.1
Token validation and policy evaluation serve different purposes. OAuth tokens bring a user or integration to the API boundary without sharing passwords; Cedar decides what that principal may do to a particular resource in the current context. This permits delegated user access and machine-to-machine integrations while retaining fine-grained resource policy. section 11.0 section 11.2.4
Figure 11.1 API Gateway as a centralized enforcement point. Carol’s request moves through the Manager Dashboard to the HR API. The API Gateway functions as the PEP, forwarding a normalized PARC request to the Cedar engine (PDP). The HR API receives the call only if Cedar returns an allow decision.
Trace the gateway’s role as the PEP between an internal dashboard, the Cedar PDP, and the protected HR API. section 11.1.1
A gateway can also enforce governance before requests reach downstream or third-party services. In layered deployments, it may verify identity and device context, enforce global policies such as tenant isolation or data residency, record an audit decision, and then forward permitted requests to a tenant-level enforcement layer. This creates a shared control point without requiring a complete redesign of every backend. section 13.4.3 section 19.6
