one Policy engine behind every API request written once, tested like code, logged with a reason