Policy Enforcement Point
A logical position in security architecture responsible for enforcing access-control policies. It determines at which abstraction layer requests are intercepted and evaluated, and is a core component of zero-trust security architectures.
Timeline (last 90 days)
The control point for access control should be located on the request path between the agent and the tools, not in the prompt, system message, or policy document.
In engineering practice, the control point is usually called the Policy Enforcement Point (PEP), paired with the Policy Decision Point (PDP); the PEP sits on the link between the agent and the tools (such as a tool gateway, an MCP server proxy, or unified tool-call middleware) and is responsible for asking the PDP whether a call is allowed before each call is issued and allowing or denying it accordingly.
The key significance of putting the decision in the PEP rather than the prompt is that a 'policy' in the prompt is advice for the model to read, which the model may ignore, misunderstand, or be bypassed into via injection, whereas the PEP is a mandatory checkpoint on the code path that the model cannot bypass.
The three dimensions of identity, tool scope, and task context must be passed in at the PEP as structured fields, transferring the judgment from the model to a policy engine rather than letting the model judge on its own.
The core value of an external policy layer lies in its non-bypassability — even if the agent code is tampered with or subjected to a prompt injection attack, it can still serve as the last line of defense.
All Facts (5)
The control point for access control should be located on the request path between the agent and the tools, not in the prompt, system message, or policy document.
60%UnverifiedIn engineering practice, the control point is usually called the Policy Enforcement Point (PEP), paired with the Policy Decision Point (PDP); the PEP sits on the link between the agent and the tools (such as a tool gateway, an MCP server proxy, or unified tool-call middleware) and is responsible for asking the PDP whether a call is allowed before each call is issued and allowing or denying it accordingly.
50%UnverifiedThe key significance of putting the decision in the PEP rather than the prompt is that a 'policy' in the prompt is advice for the model to read, which the model may ignore, misunderstand, or be bypassed into via injection, whereas the PEP is a mandatory checkpoint on the code path that the model cannot bypass.
50%UnverifiedThe three dimensions of identity, tool scope, and task context must be passed in at the PEP as structured fields, transferring the judgment from the model to a policy engine rather than letting the model judge on its own.
50%UnverifiedThe core value of an external policy layer lies in its non-bypassability — even if the agent code is tampered with or subjected to a prompt injection attack, it can still serve as the last line of defense.
50%