---
schema_version: "1"
id: 577f7b9d05d436c42d761895de9e58e41778ea50b804dd916927c36ae0a30c6a
title: Included Mule Gateway Policies
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/mule-gateway/policies-included-overview.md
canonical_url: https://docs.mulesoft.com/mule-gateway/policies-included-overview
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 3fe15876d4623fbc93d674cb537254e1f6eeaa3da8079936612a25256d77cb52
description: MuleSoft Documentation Site
latest: true
---
---
product: Mule Gateway
---

# Included Mule Gateway Policies

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

See the [Included Policies Directory](https://docs.mulesoft.com/mule-gateway/policies-included-directory) for descriptions of all included
policies.

Policies applied to APIs are the same as those in the earlier release with a few exceptions.

Classloader isolation exists between the application, the runtime and connectors, and policies. To
fulfill the isolation requirement, policies are self-contained and packaged to include libraries
needed for execution, similar to an application.

Policies are non-blocking. You can order all policies except CORS which takes precedence over all
other policies.

MEL expressions are replaced by DataWeave.

## Policy Management and Mule 4

In Mule 4, classloader isolation exists between application, runtime, connectors and policies.

Other changes to policies are:

- All policies are non-blocking, which is described in Mule 4 documentation.

- All policies except CORS, which is executed first, can be ordered.

- Resource level policy support, which was restricted to RAML-based APIs, is extended to any HTTP
  API.

- You can distribute policies outside of the runtime, which simplifies upgrades.

Mule 4 introduces changes to the packaging, size and scope of a policy.

## Provided Policies and Mule 4

Notable changes to policies for governing APIs are:

- API Manager now provides two HTTP Basic Authentication policies, one based on the simplest
  technique for enforcing access control to web resources and the other on the LDAP configuration.

  If you upgrade APIs from the Jul 2017 to Nov 2017, the security manager setup information is no
  longer required. The policy incorporates the information.

- Header propagation no longer occurs by default. You can configure header propagation for token
  enforcement and rate limiting policies by checking the Expose Headers checkbox.

- You can configure the rate limiting policy to share the quota among the cluster nodes (default) or
  not.

## See Also

- [Apply a Policy](https://docs.mulesoft.com/mule-gateway/policies-included-apply)

- [Reordering Policies](https://docs.mulesoft.com/mule-gateway/policies-reorder)