A
PEP enforces access control decisions made by a Policy Decision Point (PDP) — validating requests and permitting or denying access based on policy.
Zero trust architecture separates the decision (PDP/Policy Engine) from the enforcement (PEP). PEP = firewall, proxy, API gateway. PDP = identity provider, policy engine. Separating them enables dynamic, context-aware access decisions.