All IAM glossary termsAuthorization · glossary
PEP (Policy Enforcement Point)
Also known as: Policy Enforcement Point
Definition
A PEP (Policy Enforcement Point) is the component that intercepts a request, asks the Policy Decision Point (PDP) whether to allow it, and enforces the decision.
In more depth
In an externalized authorization architecture, the PEP sits in front of (or inside) an application. It collects information about the request (user, action, resource), queries the PDP, and returns the decision (allow / deny / additional-conditions).
Common implementations: API gateways (Kong, Apigee), service-mesh sidecars (Istio Envoy), or in-app middleware. The PEP is essentially the "where" — where the policy is enforced.
Want the work, not just the definition?