To define my terms…in the ABAC model a Policy Enforcement Point (PEP) is invoked by an application (which is or controls resources, such as files) before a particular kind of access request is allowed. The PEP asks a Policy Decision Point (PDP) whether the access should be allowed. This is authorization, not authentication. So I have a PDP I want to test and I need an app that can act as a PEP and contact my PDP. It is not clear from searches I have done what apps have this functionality. GitLab, for example, says it can use an external authorizing entity for some kinds of authorization: External authorization control | GitLab, however, it looks like the kind of information the PDP can use to make a decision is very limited and it looks like the interface between GitLab and the PDP is non-standard. Does anyone have a suggestion for a COTS app that incorporates a general PEP? I suppose I could make use of an API gateway (maybe Ping Gateway) in front of GitLab (exposed as a set of APIs) and then have the API Gateway act as a more general PEP.