---
schema_version: "1"
id: a01bb6e0e29a80ea436a1c6ceae54fbbeaa905043f84c48c9b3d51be77dcfcaf
title: Inbound Policies Directory
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.9/policies-included-directory.md
canonical_url: https://docs.mulesoft.com/gateway/1.9/policies-included-directory
source_site: docs.mulesoft.com
content_type: documentation
content_hash: ac6785a8f7d2c4d328971552fe3306c925590454aa8917202b5ee632b012fdd8
description: MuleSoft Documentation Site
release: "1.9"
latest: false
---
---
product: Omni Gateway
version: 1.9
---

# Inbound Policies Directory

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

## Inbound Policies Included in Flex Gateway

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Policy</th><th>Category</th><th>Summary</th></tr></thead><tbody><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-a2a-agent-card">A2A Agent Card</a></p></td><td><p>A2A</p></td><td><p>Rewrites the Agent Card URL to match the server instance public URL</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-a2a-pii-detector">A2A PII Detector</a></p></td><td><p>A2A</p></td><td><p>Detects personally identifiable information (PII) in requests sent to the agent</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-a2a-prompt-decorator">A2A Prompt Decorator</a></p></td><td><p>A2A</p></td><td><p>Decorates prompts with context information</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-a2a-schema-validation">A2A Schema Validation</a></p></td><td><p>A2A</p></td><td><p>Validates Agent requests to ensure they conform to the A2A specification</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-basic-auth-ldap">Basic Authentication: LDAP</a></p></td><td><p>Security</p></td><td><p>Allows access based on the basic authorization mechanism, with user-password defined on LDAP</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-basic-auth-simple">Basic Authentication: Simple</a></p></td><td><p>Security</p></td><td><p>Allows access based on the basic authorization mechanism, with a single user-password</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-client-id-enforcement">Client ID Enforcement</a></p></td><td><p>Compliance</p></td><td><p>Allows access only to authorized client applications</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-cors">Cross-Origin Resource Sharing (CORS)</a></p></td><td><p>Compliance</p></td><td><p>Enables access to resources residing in external domains</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-external-authorization">External Authorization</a></p></td><td><p>Security</p></td><td><p>Authenticates requests with an external gRPC or HTTP authorization service</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-external-processing">External Processing</a></p></td><td><p>Transformation</p></td><td><p>Sends the incoming HTTP requests or outgoing HTTP responses to an external gRPC service for additional processing</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-header-injection">Header Injection</a></p></td><td><p>Transformation</p></td><td><p>Adds headers to a request or a response</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-header-removal">Header Removal</a></p></td><td><p>Transformation</p></td><td><p>Removes headers from a request or a response</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-health-check">Health Check</a></p></td><td><p>Quality of Service</p></td><td><p>Monitors API upstream health at specific intervals</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-http-caching">HTTP Caching</a></p></td><td><p>Quality of Service</p></td><td><p>Caches HTTP responses from an API implementation</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-ip-allowlist">IP Allowlist</a></p></td><td><p>Security</p></td><td><p>Allows a list or range of specified IP addresses to request access</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-ip-blocklist">IP Blocklist</a></p></td><td><p>Security</p></td><td><p>Blocks a single IP address or a range of IP addresses from accessing an API endpoint</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-json-threat-protection">JSON Threat Protection</a></p></td><td><p>Security</p></td><td><p>Protects against malicious JSON in API requests</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-jwt-validation">JWT Validation</a></p></td><td><p>Security</p></td><td><p>Validates a JWT</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-mcp-attribute-access-control">MCP Attribute-Based Access Control</a></p></td><td><p>MCP</p></td><td><p>Controls access to tools, resources, and prompts based on user information such as Tiers, IP, Headers, or Claims</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-mcp-schema-validation">MCP Schema Validation</a></p></td><td><p>MCP</p></td><td><p>Validates MCP requests to ensure they conform to the MCP specification</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-mcp-support">MCP Support</a></p></td><td><p>MCP</p></td><td><p>Adds MCP support to a Flex Gateway MCP server instance. This policy is required for your MCP server instance to function properly.</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-message-logging">Message Logging</a></p></td><td><p>Troubleshooting</p></td><td><p>Logs custom messages using information from incoming requests, responses from the backend, or information from other policies applied to the same API endpoint</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-oauth-token-introspection">OAuth 2.0 Token Introspection</a></p></td><td><p>Security</p></td><td><p>Allows access only to authorized client applications</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-openid-token-enforcement">OpenID Connect OAuth 2.0 Access Token Enforcement</a></p></td><td><p>Security</p></td><td><p>Allows access only to authorized client applications</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-rate-limiting">Rate Limiting</a></p></td><td><p>Quality of Service</p></td><td><p>Monitors access to an API by defining the maximum number of requests processed within a period of time</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-rate-limiting-sla">Rate Limiting: SLA-based</a></p></td><td><p>Quality of Service</p></td><td><p>Monitors access to an API by defining the maximum number of requests processed within a timespan, based on SLAs</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-response-timeout">Response Idle Timeout</a></p></td><td><p>Quality of Service</p></td><td><p>Set a maximum duration Flex Gateway waits for a response from an upstream service</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-schema-validation">Schema Validation</a></p></td><td><p>Security</p></td><td><p>Validates incoming traffic against a supplied OAS3 schema</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-spike-control">Spike Control</a></p></td><td><p>Quality of Service</p></td><td><p>Regulates API traffic</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-sse-logging">SSE Logging</a></p></td><td><p>SSE</p></td><td><p>Logs every SSE event while streaming</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-stream-idle-timeout">Stream Idle Timeout</a></p></td><td><p>Quality of Service</p></td><td><p>Set a maximum duration a stream can remain idle without receiving a request or response</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-traffic-management-route">Traffic Management for Multiple Upstream Services</a></p></td><td><p>Quality of Service</p></td><td><p>Manages API instance traffic to multiple upstream services from a single consumer endpoint</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-traffic-management">Traffic Management for Multiple Upstream Services (Weighted)</a></p></td><td><p>Quality of Service</p></td><td><p>Manages API instance traffic to multiple upstream services from a single consumer endpoint, using weighted percentages</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-tls">Transport Layer Security (TLS) - Inbound</a></p></td><td><p>Security</p></td><td><p>Enables authentication between a client and the API proxy</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/gateway/1.9/policies-included-tls-outbound">Transport Layer Security (TLS) - Outbound</a></p></td><td><p>Security</p></td><td><p>Enables two-way authentication between the API proxy and an upstream service</p></td></tr></tbody></table>

## See Also

- [Policy Availability by Gateway](https://docs.mulesoft.com/gateway-home/#policy-availability-by-gateway)