---
schema_version: "1"
id: c4ea5014bb59b1cebb3a4f440849471d058d3dcc9d13e725df9eca7a6944754e
title: Inbound Policies Directory
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.12/policies-included-directory.md
canonical_url: https://docs.mulesoft.com/gateway/1.12/policies-included-directory
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 1cc0a4d2db6eb60fa4def909e07eab4380d4112bef2ca859a0796d60819a1f8a
description: MuleSoft Documentation Site
release: "1.12"
latest: false
---
---
product: Omni Gateway
version: 1.12
---

# Inbound Policies Directory

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

## Inbound Policies Included in Flex Gateway

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Policy</th><th>Category</th><th>Summary</th></tr></thead><tbody><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-a2a-agent-card">A2A Agent Card</a></p></td><td><p>A2A</p></td><td><p>Rewrites the Agent Card URL to match the server instance public URL</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-a2a-pii-detector">A2A PII Detector</a></p></td><td><p>A2A</p></td><td><p>Detects personally identifiable information (PII) in requests sent to the agent</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-a2a-prompt-decorator">A2A Prompt Decorator</a></p></td><td><p>A2A</p></td><td><p>Decorates prompts with context information</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-a2a-schema-validation">A2A Schema Validation</a></p></td><td><p>A2A</p></td><td><p>Validates Agent requests to ensure they conform to the A2A specification</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-a2a-token-rate-limit">A2A Token Based Rate Limit</a></p></td><td><p>A2A</p></td><td><p>Limits API usage based on the number of GPT-4o-mini tokens consumed by the agents</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-llm-token-rate-limit">LLM Token Based Rate Limit</a></p></td><td><p>LLM</p></td><td><p>Limits Model Proxy usage based on the number of tokens consumed (OpenAI-format APIs)</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-agent-connection-telemetry">Agent Connection Telemetry</a></p></td><td><p>A2A and MCP</p></td><td><p>Tracks the number of requests made to agent or MCP server instances</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-basic-auth-ldap">Basic Authentication: LDAP</a></p></td><td><p>Security</p></td><td><p>Allows access based on the basic authorization mechanism, with user-password defined on LDAP</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-basic-auth-simple">Basic Authentication: Simple</a></p></td><td><p>Security</p></td><td><p>Allows access based on the basic authorization mechanism, with a single user-password</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-client-id-enforcement">Client ID Enforcement</a></p></td><td><p>Compliance</p></td><td><p>Allows access only to authorized client applications</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-cors">Cross-Origin Resource Sharing (CORS)</a></p></td><td><p>Compliance</p></td><td><p>Enables access to resources residing in external domains</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-dataweave-body-transformation">DataWeave Body Transformation</a></p></td><td><p>Transformation</p></td><td><p>Transforms request or response body content with a DataWeave script</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-dataweave-headers-transformation">DataWeave Headers Transformation</a></p></td><td><p>Transformation</p></td><td><p>Transforms request or response headers with a DataWeave script</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-dataweave-request-filter">DataWeave Request Filter</a></p></td><td><p>Transformation</p></td><td><p>Filters requests by using a DataWeave script</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-external-authorization">External Authorization</a></p></td><td><p>Security</p></td><td><p>Authenticates requests with an external gRPC or HTTP authorization service</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-external-processing">External Processing</a></p></td><td><p>Transformation</p></td><td><p>Sends the incoming HTTP requests or outgoing HTTP responses to an external gRPC service for additional processing</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-header-injection">Header Injection</a></p></td><td><p>Transformation</p></td><td><p>Adds headers to a request or a response</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-header-removal">Header Removal</a></p></td><td><p>Transformation</p></td><td><p>Removes headers from a request or a response</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-health-check">Health Check</a></p></td><td><p>Quality of Service</p></td><td><p>Monitors API upstream health at specific intervals</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-http-caching">HTTP Caching</a></p></td><td><p>Quality of Service</p></td><td><p>Caches HTTP responses from an API implementation</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-injection-protection">Injection Protection</a></p></td><td><p>Security</p></td><td><p>Scans request headers, path, query, and body to protect against SQL, XSS, and custom injection attacks in incoming requests</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-ip-allowlist">IP Allowlist</a></p></td><td><p>Security</p></td><td><p>Allows a list or range of specified IP addresses to request access</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-ip-blocklist">IP Blocklist</a></p></td><td><p>Security</p></td><td><p>Blocks a single IP address or a range of IP addresses from accessing an API endpoint</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-json-threat-protection">JSON Threat Protection</a></p></td><td><p>Security</p></td><td><p>Protects against malicious JSON in API requests</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-jwt-validation">JWT Validation</a></p></td><td><p>Security</p></td><td><p>Validates a JWT</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-mcp-attribute-access-control">MCP Attribute-Based Access Control</a></p></td><td><p>MCP</p></td><td><p>Controls access to tools, resources, and prompts based on user information such as Tiers, IP, Headers, or Claims</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-mcp-global-access">MCP Global Access</a></p></td><td><p>MCP</p></td><td><p>Restricts which MCP tools are exposed by defining Allow and Block rules</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-mcp-pii-detector">MCP PII Detector</a></p></td><td><p>MCP</p></td><td><p>Blocks elicitation responses containing personally identifiable information (PII) from reaching MCP servers</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-mcp-payload-optimization">MCP Payload Optimization</a></p></td><td><p>MCP</p></td><td><p>Optimizes MCP tool responses for token consumption by transforming HTML to Markdown and removing unnecessary data</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-mcp-schema-validation">MCP Schema Validation</a></p></td><td><p>MCP</p></td><td><p>Validates MCP requests to ensure they conform to the MCP specification</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-mcp-support">MCP Support</a></p></td><td><p>MCP</p></td><td><p>Adds MCP support to a Flex Gateway MCP server instance. This policy is required for your MCP server instance to function properly.</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-mcp-tool-mapping">MCP Tool Mapping</a></p></td><td><p>MCP</p></td><td><p>Redefines tool names and descriptions to reduce prompt complexity and improve LLM comprehension</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-message-logging">Message Logging</a></p></td><td><p>Troubleshooting</p></td><td><p>Logs custom messages using information from incoming requests, responses from the backend, or information from other policies applied to the same API endpoint</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-oauth-token-introspection">OAuth 2.0 Token Introspection</a></p></td><td><p>Security</p></td><td><p>Allows access only to authorized client applications</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-openid-token-enforcement">OpenID Connect OAuth 2.0 Access Token Enforcement</a></p></td><td><p>Security</p></td><td><p>Allows access only to authorized client applications</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-rate-limiting">Rate Limiting</a></p></td><td><p>Quality of Service</p></td><td><p>Monitors access to an API by defining the maximum number of requests processed within a period of time</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-rate-limiting-sla">Rate Limiting: SLA-based</a></p></td><td><p>Quality of Service</p></td><td><p>Monitors access to an API by defining the maximum number of requests processed within a timespan, based on SLAs</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-regex-prompt-guard">Regex Prompt Guard</a></p></td><td><p>LLM</p></td><td><p>Blocks LLM requests that match deny-list regex patterns</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-response-timeout">Response Idle Timeout</a></p></td><td><p>Quality of Service</p></td><td><p>Set a maximum duration Flex Gateway waits for a response from an upstream service</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-schema-validation">Schema Validation</a></p></td><td><p>Security</p></td><td><p>Validates incoming traffic against a supplied OAS3 schema</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-soap-schema-validation">SOAP Schema Validation</a></p></td><td><p>Security</p></td><td><p>Validates incoming traffic against a specified WSDL schema</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-spike-control">Spike Control</a></p></td><td><p>Quality of Service</p></td><td><p>Regulates API traffic</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-sse-logging">SSE Logging</a></p></td><td><p>SSE</p></td><td><p>Logs every SSE event while streaming</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-stream-idle-timeout">Stream Idle Timeout</a></p></td><td><p>Quality of Service</p></td><td><p>Set a maximum duration a stream can remain idle without receiving a request or response</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-tracing">Tracing</a></p></td><td><p>Troubleshooting</p></td><td><p>Configure OpenTelemetry distributed tracing for an API</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-traffic-management-route">Traffic Management for Multiple Upstream Services</a></p></td><td><p>Quality of Service</p></td><td><p>Manages API instance traffic to multiple upstream services from a single consumer endpoint</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-traffic-management">Traffic Management for Multiple Upstream Services (Weighted)</a></p></td><td><p>Quality of Service</p></td><td><p>Manages API instance traffic to multiple upstream services from a single consumer endpoint, using weighted percentages</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-tls">Transport Layer Security (TLS) - Inbound</a></p></td><td><p>Security</p></td><td><p>Enables authentication between a client and the API proxy</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.12/policies-included-xml-threat-protection">XML Threat Protection</a></p></td><td><p>Security</p></td><td><p>Protects against malicious XML in API requests</p></td></tr></tbody></table>

## See Also

- [Policy Availability by Gateway](https://docs.mulesoft.com/gateway-home/#policy-availability-by-gateway)