---
schema_version: "1"
id: ac9ab1a1a454513e91861060d1f6970b9408299e8a9096231baab791690bb051
title: Policy Types
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/mule-gateway/policies-policy-types.md
canonical_url: https://docs.mulesoft.com/mule-gateway/policies-policy-types
source_site: docs.mulesoft.com
content_type: documentation
content_hash: cb644db561b091fe0c74c94e078ea0ed60a049ab26551edc30a9b70580c69643
description: MuleSoft Documentation Site
latest: true
---
---
product: Mule Gateway
keywords: policy, custom, ootb, offline
---

# Policy Types

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

You can create included, custom, or automated policies, each with its own scope, management, and
usability. You can uniformly apply a policy to all APIs, or you can apply _resource-level policies_
to select APIs based on specified criteria.

## Included Mule Gateway Policies

MuleSoft provides several ready-to-use policies for areas such as authentication, security
management, threat protection, and tokenization. Using the API Manager from Anypoint Platform, you
can apply any of these policies to any of your API endpoints.

After you apply a policy, its complete lifecycle is managed by API Manager. You can apply a default
policy to a specific API. To automatically apply a policy to all APIs in your environment, you must
configure it as an automated policy.

## Automated Policies

You can apply any default or a custom policy to all the APIs in your environment, making that policy
an _automated policy_. However, you require specific access, such as API Manager Environment
Administrator, to create automated policies.

## Custom Policies

Although MuleSoft provides you with several ready-to-use included policies, you might want to create
a custom policy to meet your specific business needs. You can either customize an existing policy,
or you can create an entirely new custom policy. These policies are categorized as either online or
offline.

### Online Custom Policies

Online Custom policies are applied and managed by API Manager, which is the default and recommended
way to apply policies. Online policies enable you to manage the policy lifecycle by leveraging
Anypoint Platform. This way, the applied policies are always in sync with API Manager, and are
protected by the gatekeeper mechanism at startup.

### Offline Custom Policies

Offline custom policies are applied directly to the runtime and managed manually. Because they can
easily become out of sync with API Manager, using this type of policy is not recommended.

Offline custom policies are not protected by the Gatekeeper mechanism at startup. Additionally,
client credentials validation is also not supported in offline policies.

## See Also

- [Included Policies](https://docs.mulesoft.com/mule-gateway/policies-included-overview)

- [Custom Policies](https://docs.mulesoft.com/mule-gateway/policies-custom-overview)

- [Automated Policies](https://docs.mulesoft.com/mule-gateway/policies-automated-overview)

- [Resource-Level Policies](https://docs.mulesoft.com/mule-gateway/policies-resource-level-overview)