API keys authenticate software. Policy objects decide what that software is allowed to do. The previous post in this series ended on a question asked in a meeting room: who actually decided we're allowed to do this? The argument was that the answer has to exist before a gateway can enforce anything, and that the gateway's job is to make the answer repeatable. This post is about what that answer looks like when it stops being a decision and becomes an object. For decades, credentials ...