A policy decision point (PDP) evaluates access rules and returns permit or deny. A policy enforcement point (PEP) sits in front of the action and applies that answer before releasing data or doing the work. Splitting them lets many services share one rule set, but the enforcing side still carries the responsibility.
The vocabulary in one table
The OWASP Authorization Patterns Cheat Sheet uses these terms, and OpenID AuthZEN defines an interface between the first two.
| Term | Role | Everyday example |
|---|---|---|
| PEP, enforcement point | Protects an operation and applies the decision | Middleware or handler that refuses the request |
| PDP, decision point | Evaluates the applicable policy | Rule engine, library or service |
| PAP, administration point | Manages and publishes the rules | Repo or console where policy is edited |
| PIP, information point | Supplies attributes the rules need | User directory, resource metadata |
You can have all four in one process. A small app that checks if user.is_owner(doc) in a handler is its own PEP and PDP. The terms matter when you split them.
Where the PEP should live
The cheat sheet recommends keeping enforcement close to the protected resource so it can check the requested action, object and tenant. A gateway can enforce coarse rules and reject early, but it often lacks the object context. Object-level and business-specific checks belong in the service.
It also warns that a gateway does not give complete coverage on its own. You must restrict direct access to services and cover internal calls and alternate endpoints. Envoy's external authorization filter is cited as an example of delegating to a PDP, with a note that routing changes after authorization can invalidate an earlier check.
Where the PDP can live
Deployment is a separate choice from the access model. The cheat sheet lists three modes.
| Mode | Benefit | Required control |
|---|---|---|
| Embedded library | Works without a remote connection | Keep policy and data current |
| Local sidecar or daemon | Shared logic near the service | Restrict its API, handle process failure |
| Remote service | Central administration | Authenticate PEPs, protect responses, deny when no decision |
Open Policy Agent, for example, supports HTTP, library and WebAssembly integration, so a product name does not tell you the deployment mode.
The part people get wrong
Separating decision from enforcement does not move the duty to enforce. The PEP must apply the result on every entry point. If one route skips the call, that route is open, however good the rules are.
A second mistake is trusting input to the PDP. The PEP should send verified subject context and authoritative resource attributes, not values copied from the request. A client claiming its own privileges is not an input to trust.
How to decide whether to split
- One service, simple rules: keep policy in code, centralized in one authorization layer.
- Several services needing consistent rules: separate the PDP and review policy on its own cadence.
- Need early rejection: add gateway checks, but keep service-level enforcement.
- Always: log the decision with enough policy version context to investigate, without exposing sensitive attributes.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how a policy is evaluated at one point and enforced at another, the same split as a PDP and PEP.
Safeguard offers policies, gates and guardrails, plus dependency scanning for the libraries that implement your enforcement. Try the free scan at gold.safeguard.sh/scan.
Quick check
Is a gateway a PEP or a PDP?
Usually a PEP, and sometimes it calls out to a PDP. It rarely has object-level context, so services still need their own checks.
Does a central PDP mean one runtime for everyone?
No. Central policy ownership does not require a single central runtime. The decision engine can be embedded or local while policy is managed in one place.
Sources
- OWASP Authorization Patterns Cheat Sheet
- OWASP Authorization Decisions and Output Handling Cheat Sheet
Last reviewed: 19 October 2026.
