# Security Policy Selection and Enforcement

*MuleSoft Platform Architect Study Guide · Governing web APIs on Anypoint Platform · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/mulesoft-platform-architect/governing-web-apis-on-anypoint-platform/security-policy-selection-and-enforcement*

Match security policies to credential types, provider relationships and enforcement requirements, including token freshness, directory search, trusted network identity and rotating verification keys.

- Certification: Salesforce MuleSoft Platform Architect
- Exam section: Governing web APIs on Anypoint Platform
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-platform-architect

**Official exam objective:**

> Select appropriate API policies to enforce non-functional security constraints on web API invocations.

## What the exam expects

- Match token enforcement to the configured identity provider and token representation.
- Separate token freshness, application contracts and downstream metadata exposure.
- Choose directory authentication and the search scope required by the user population.
- Configure network restrictions for the verified client address and intended operations.
- Retrieve rotating JWT verification keys without confusing keys with claims.

An **enforcement policy** checks requests rather than issuing credentials; **introspection** obtains token-validation information; **JWKS** supplies verification keys; an **LDAP search scope** bounds directory traversal; an **IP expression** selects the address being evaluated ([OIDC enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-openid-token-enforcement), [JWT Validation](https://docs.mulesoft.com/mule-gateway/policies-included-jwt-validation), [LDAP](https://docs.mulesoft.com/mule-gateway/policies-included-basic-auth-ldap), [IP Allowlist](https://docs.mulesoft.com/mule-gateway/policies-included-ip-allowlist)).

## Key facts

| Fact | Detail | Source |
| --- | --- | --- |
| Mule provider policy | Its validation endpoint does not make it compatible with unrelated providers. | [Mule OAuth enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-oauth-access-token-enforcement) |
| OIDC enforcement | Validates tokens; does not issue them. | [OIDC enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-openid-token-enforcement) |
| Cache disabled | Startup cache capacity zero disables token caching. | [OIDC enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-openid-token-enforcement) |
| Metadata exposure | Expose Headers governs forwarding user properties to the backend. | [OIDC enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-openid-token-enforcement) |
| Directory identity | LDAP checks supplied user credentials in the configured directory context. | [LDAP](https://docs.mulesoft.com/mule-gateway/policies-included-basic-auth-ldap) |
| Search traversal | Subtree includes base and descendants; one level excludes the base and deeper descendants. | [LDAP](https://docs.mulesoft.com/mule-gateway/policies-included-basic-auth-ldap) |
| Network restriction | IP expression and method/resource conditions configure different dimensions. | [IP Allowlist](https://docs.mulesoft.com/mule-gateway/policies-included-ip-allowlist) |
| Rotating keys | JWKS URL and cache lifetime govern retrieving the published set again. | [JWT Validation](https://docs.mulesoft.com/mule-gateway/policies-included-jwt-validation) |

## Check yourself

- When Basic Authentication: Simple rejects credentials on a WSDL SOAP 1.1 API, which status does its reference list?
- When the OIDC policy caches validated OAuth tokens, where are those tokens stored?
- Why does an allowlist not require entering every complete host address separately?

## Sources

- [OAuth 2.0 Access Token Enforcement Using Mule OAuth Provider](https://docs.mulesoft.com/mule-gateway/policies-included-oauth-access-token-enforcement)
- [OpenID Connect OAuth 2.0 Token Enforcement Policy](https://docs.mulesoft.com/mule-gateway/policies-included-openid-token-enforcement)
- [Basic Authentication: LDAP Policy](https://docs.mulesoft.com/mule-gateway/policies-included-basic-auth-ldap)
- [Basic Authentication: Simple Policy](https://docs.mulesoft.com/mule-gateway/policies-included-basic-auth-simple)
- [IP Allowlist Policy](https://docs.mulesoft.com/mule-gateway/policies-included-ip-allowlist)
- [JWT Validation Policy](https://docs.mulesoft.com/mule-gateway/policies-included-jwt-validation)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 7 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Platform Architect pack (USD $19): https://www.certifyforce.com/practice-exams