# API policies and gateway enforcement

*MuleSoft Developer II Study Guide · Expose production-ready Anypoint Platform-managed APIs from Mule applications · Last updated November 7, 2026 · https://www.certifyforce.com/study-guide/mulesoft-developer-ii/expose-production-ready-anypoint-platform-managed-apis-from-mule-applications/api-policies-and-gateway-enforcement*

Choose, apply and order Mule Gateway policies while separating runtime enforcement from platform management. Account for resource matching, automation, distributed quotas and cached policy artifacts.

- Certification: Salesforce MuleSoft Developer II
- Exam section: Expose production-ready Anypoint Platform-managed APIs from Mule applications
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-developer-ii

**Official exam objective:**

> Configure custom or out-of-the-box (OOTB) API policies.

## What the exam expects

- Match a security, traffic or transformation requirement to a policy capability.
- Apply included or published custom policies without changing implementation code.
- Distinguish environment automation, API-level ordering and resource filtering.
- Explain online enforcement, offline limitations and cached artifact cleanup.
- Relate an SLA quota's distribution to the actual runtime topology.

**Policy** means an enforced API rule; **automated policy** is configured for APIs in an environment; **resource-level policy** matches selected requests; **SLA contract** links a registered client application to allowed consumption; **policy artifact** contains executable logic and configuration metadata ([Policy types](https://docs.mulesoft.com/mule-gateway/policies-policy-types), [Resource scope](https://docs.mulesoft.com/mule-gateway/policies-resource-level-overview), [SLA policy](https://docs.mulesoft.com/mule-gateway/policies-included-rate-limiting-sla), [Policy architecture](https://docs.mulesoft.com/mule-gateway/policies-policy-overview)).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Runtime enforcement | Injected policies execute without a per-request API Manager call. | [Architecture](https://docs.mulesoft.com/mule-gateway/policies-policy-overview) |
| Online custom application | Publish the policy to Exchange, then apply through API Manager. | [Custom policies](https://docs.mulesoft.com/mule-gateway/policies-custom-overview) |
| Publication classifier | Mule Maven Plugin identifies the policy with `mule-policy`. | [Maven publishing](https://docs.mulesoft.com/exchange/to-publish-assets-maven) |
| Fixed precedence | CORS precedes automated policies and API-level policies. | [Ordering](https://docs.mulesoft.com/mule-gateway/policies-reorder) |
| Automation conflict | The automated configuration prevails over the same API-level type. | [Automation](https://docs.mulesoft.com/mule-gateway/policies-automated-overview) |
| Resource matching | Use Java regex against real path values and selected methods. | [Resource policies](https://docs.mulesoft.com/mule-gateway/policies-resource-level-overview) |
| Duplicate allowlists | A request must satisfy both applied allowlists. | [Duplicates](https://docs.mulesoft.com/mule-gateway/policies-reorder) |
| Distributed quota | Mule runtime quota sharing requires HA cluster mode. | [SLA policy](https://docs.mulesoft.com/mule-gateway/policies-included-rate-limiting-sla) |
| Offline limitations | No startup gatekeeper protection or client credentials validation. | [Policy types](https://docs.mulesoft.com/mule-gateway/policies-policy-types) |
| Artifact cleanup | Enable the startup cleanup property rather than assuming unapply deletes files. | [Policy cache](https://docs.mulesoft.com/mule-gateway/policies-policy-overview) |

## Check yourself

- Why might otherwise similar policies differ in download size?
- When is an automated external-identity-provider policy enforced on a particular API?
- What enables Preview Resource Matching for documented endpoints?

## Sources

- [Mule Gateway Policies Overview](https://docs.mulesoft.com/mule-gateway/policies-policy-overview)
- [Policy Types](https://docs.mulesoft.com/mule-gateway/policies-policy-types)
- [Apply a Policy](https://docs.mulesoft.com/mule-gateway/policies-included-apply)
- [Reordering Policies](https://docs.mulesoft.com/mule-gateway/policies-reorder)
- [Automated Policies](https://docs.mulesoft.com/mule-gateway/policies-automated-overview)
- [Resource-Level Policies](https://docs.mulesoft.com/mule-gateway/policies-resource-level-overview)
- [Rate Limiting SLA-Based Policy](https://docs.mulesoft.com/mule-gateway/policies-included-rate-limiting-sla)
- [Custom Policies](https://docs.mulesoft.com/mule-gateway/policies-custom-overview)
- [Publishing Assets Using Maven](https://docs.mulesoft.com/exchange/to-publish-assets-maven)
- [Included Policies Directory](https://docs.mulesoft.com/mule-gateway/policies-included-directory)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 9 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Developer II pack (USD $19): https://www.certifyforce.com/practice-exams