API keys authenticate software. Policy objects decide what that software is allowed to do.

The previous post in this series ended on a question asked in a meeting room: who actually decided we're allowed to do this? The argument was that the answer has to exist before a gateway can enforce anything, and that the gateway's job is to make the answer repeatable.

This post is about what that answer looks like when it stops being a decision and becomes an object.

For decades, credentials have answered one question: who are you? Passwords identified people. API keys identified software. OAuth scopes added delegation because identity alone could not express that an application should act on a user's behalf within limits. Each step added context, because the decisions around access kept getting more nuanced.

Enterprise AI adds a question those credentials were never built to answer. Two applications can both authenticate successfully, and still one should be limited to inexpensive models while the other is cleared for frontier reasoning. One has a generous experimentation budget; the other has hard cost controls. One may invoke sensitive MCP tools, the other should never see that they exist.