PEP (Policy Enforcement Point)

A Policy Enforcement Point (PEP) is where a policy decision is acted on. It sits directly in the path of an agent’s action: it intercepts the call, asks the policy engine for a verdict, and then enforces that verdict — allowing the action, blocking it, or routing it for human approval.

The PEP is the reason governance is enforcement rather than advice. Because it’s in the path, no action can reach a resource — sending mail, moving money, hitting an MCP server — without first being checked. There’s no path around it, even if the agent is confused, jailbroken, or prompted by someone hostile.

A typical action lifecycle: the agent makes a call → the PEP intercepts it → it asks the PDP (Policy Decision Point) for a decision → it enforces the answer → the result is written to the audit trail.

In a HiveKey-style agent control plane, the gateway is the PEP. Keeping it distinct from the decision-making PDP is what lets you change a policy centrally and have every enforcement point apply it instantly — no agent redeploy. The terms come from the XACML access-control model and are core to zero-trust architectures (NIST 800-207), applied here to AI agents.