From 89029c5236c1e43264cabfcc8bf2f9b7bc96c48a Mon Sep 17 00:00:00 2001 From: Luana Dos Santos Date: Fri, 10 Jul 2026 00:06:11 -0300 Subject: [PATCH 01/28] W-23392787 docs: add third-party provider governance experience topics Add six new experience topics for third-party API provider governance: - exp-governance-setup-third-party-providers.adoc: Connect to Provider wizard with connection setup, scanner auto-creation, API discovery, and Akamai correlation policy auto-application - exp-governance-govern-third-party-apis.adoc: End-to-end workflow for connecting providers, verifying discovered APIs, creating governance strategies with Gateway/Provider filter, monitoring conformance, and exporting reports - exp-governance-policy-library-apply.adoc: Policy Library wizard with policy categories (Universal, Access and Security, Performance and Cost, Data Privacy and Integrity, Compliance and Observability) and targeted/supplemental application workflow - exp-governance-create-profiles-gateway-provider-filter.adoc: Gateway/Provider filter for governance scope, with provider selection and All Runtimes option - exp-governance-monitor-cross-gateway-conformance.adoc: Cross-gateway conformance monitoring with provider/gateway column filtering and Read-Only policy status indicator - exp-governance-cross-gateway-policy-audit-export.adoc: CSV export for SOC 2 / GDPR compliance audits with full schema including Organization ID, API ID, Gateway/Provider, Applied policies, Policy Application Status, Conformance status, and Timestamp Co-Authored-By: Claude Sonnet 4.5 --- ...eate-profiles-gateway-provider-filter.adoc | 73 +++++++++++ ...nce-cross-gateway-policy-audit-export.adoc | 108 ++++++++++++++++ ...xp-governance-govern-third-party-apis.adoc | 85 ++++++++++++ ...nce-monitor-cross-gateway-conformance.adoc | 80 ++++++++++++ .../exp-governance-policy-library-apply.adoc | 121 ++++++++++++++++++ ...overnance-setup-third-party-providers.adoc | 99 ++++++++++++++ 6 files changed, 566 insertions(+) create mode 100644 modules/ROOT/pages/exp-governance-create-profiles-gateway-provider-filter.adoc create mode 100644 modules/ROOT/pages/exp-governance-cross-gateway-policy-audit-export.adoc create mode 100644 modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc create mode 100644 modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc create mode 100644 modules/ROOT/pages/exp-governance-policy-library-apply.adoc create mode 100644 modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc diff --git a/modules/ROOT/pages/exp-governance-create-profiles-gateway-provider-filter.adoc b/modules/ROOT/pages/exp-governance-create-profiles-gateway-provider-filter.adoc new file mode 100644 index 000000000..af6518c16 --- /dev/null +++ b/modules/ROOT/pages/exp-governance-create-profiles-gateway-provider-filter.adoc @@ -0,0 +1,73 @@ += Filter Governance Scope by Gateway or Provider +:keywords: gateway filter, provider filter, governance scope, cross-gateway governance, third-party providers + +When creating a governance strategy, use the *Gateway/Provider* filter to target specific API gateway platforms or third-party providers. This filter enables unified governance across Anypoint Platform gateways and connected third-party provider platforms such as Akamai. + +== When the Gateway/Provider Filter Appears + +The *Gateway/Provider* filter appears in the governance strategy scope configuration step when: + +* Your organization has connected one or more third-party API gateway providers through *Platform* > *Providers*. +* The connected providers have discovered APIs that are registered in the portfolio. + +If no providers are connected, the filter does not appear and the strategy applies only to Anypoint Platform-hosted APIs. + +== Before You Begin + +Before using the Gateway/Provider filter: + +* xref:exp-governance-setup-third-party-providers.adoc[Connect to one or more third-party providers] to enable cross-gateway governance. +* Verify that the connected providers have discovered APIs by checking *Portfolio Overview* for entries with the provider name in the *Gateway/Provider* column. + +== Select Gateway or Provider + +In the governance strategy creation workflow: + +. Navigate to the *Define Governance Scope* step. +. Expand the *Gateway/Provider* filter. +. Select one or more options: ++ +-- +** *All Runtimes*: The strategy applies to all APIs across Anypoint Platform gateways and all connected third-party providers. +** *Anypoint Platform*: The strategy applies only to APIs hosted on Anypoint Platform gateways (Flex Gateway, Mule Gateway). +** *Third-Party Provider Names*: Select specific providers (such as *Akamai*) to limit the strategy to APIs hosted on those platforms. +-- + +You can select multiple providers to govern APIs across a subset of platforms without including all runtimes. + +== How the Filter Works + +The *Gateway/Provider* filter narrows the governance scope to APIs hosted on the selected platforms: + +* APIs that do not match the selected gateway or provider are excluded from the strategy, even if they match other scope criteria (such as tags or categories). +* If you select multiple providers, the strategy applies to APIs hosted on any of the selected platforms (OR logic). +* Combining the *Gateway/Provider* filter with other filters (Service Type, Tags, Categories) narrows the scope further. All selected filters must match (AND logic). + +== Example: Govern Only Akamai APIs + +To create a governance strategy that applies only to APIs discovered from Akamai: + +. In the *Define Governance Scope* step, expand the *Gateway/Provider* filter. +. Select *Akamai* from the provider list. +. Configure other scope filters as needed (such as *Tags* or *Service Type*). +. Proceed through the strategy creation workflow. + +The resulting strategy applies only to APIs hosted on Akamai, as indicated in the *Gateway/Provider* column on the governance strategy dashboard. + +== Example: Govern All Runtimes + +To create a governance strategy that applies across all gateway platforms: + +. In the *Define Governance Scope* step, expand the *Gateway/Provider* filter. +. Select *All Runtimes*. +. Configure other scope filters as needed. +. Proceed through the strategy creation workflow. + +The strategy applies to all APIs across Anypoint Platform and all connected third-party providers. + +== Related Topics + +* xref:exp-governance-create-strategy.adoc[Create Governance Strategies] +* xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] +* xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs] +* xref:exp-providers-manage.adoc[Manage API Gateway Providers] diff --git a/modules/ROOT/pages/exp-governance-cross-gateway-policy-audit-export.adoc b/modules/ROOT/pages/exp-governance-cross-gateway-policy-audit-export.adoc new file mode 100644 index 000000000..ca4e28f13 --- /dev/null +++ b/modules/ROOT/pages/exp-governance-cross-gateway-policy-audit-export.adoc @@ -0,0 +1,108 @@ += Export Cross-Gateway Policy Audit Reports +:keywords: policy audit, cross-gateway reports, compliance reports, csv export, governance audit, soc 2, gdpr + +Export governance strategy data to CSV to support compliance audits, stakeholder reviews, and regulatory reporting. The export includes policy application status, conformance data, and gateway/provider information for all APIs targeted by the strategy. + +== Use Cases + +Export cross-gateway policy audit reports to: + +* *SOC 2 Compliance Audits*: Demonstrate that policies are consistently applied and enforced across all gateway platforms. +* *GDPR Compliance Reporting*: Provide evidence that data privacy policies (such as PII masking) are applied to APIs across your organization. +* *Stakeholder Reviews*: Share governance posture with executives, compliance teams, or external auditors. +* *Trend Analysis*: Track policy application and conformance over time by exporting reports at regular intervals. +* *Incident Response*: Identify which APIs have policies in read-only mode during security or compliance incidents. + +== Before You Begin + +Before exporting a report: + +* xref:exp-governance-create-strategy.adoc[Create a governance strategy] that targets the APIs you want to report on. +* Verify that the strategy is active and has evaluated the targeted APIs. +* For cross-gateway reports, ensure that xref:exp-governance-setup-third-party-providers.adoc[third-party providers are connected] and have discovered APIs. + +== Export a Governance Strategy Report + +. Log in and go to *Governance* > *Governance Strategies*. +. Select the governance strategy you want to report on. +. Select *Export to CSV*. +. The CSV file downloads to your local machine. + +The export includes all APIs targeted by the selected strategy, along with their conformance status and policy application details. + +== CSV Report Schema + +The exported CSV includes the following columns: + +[cols="1,3"] +|=== +|Column |Description + +|*Organization ID* +|The unique identifier for your Anypoint Platform organization. + +|*API ID* +|The unique identifier for the API. + +|*API Version* +|The version of the API instance. + +|*Gateway/Provider* +|The platform hosting the API (such as *Anypoint Platform*, *Akamai*, or other connected providers). + +|*Applied Policies* +|A list of policies applied to the API instance. + +|*Policy Application Status* +|The enforcement state of each policy: + +* *Enabled*: The policy is actively enforced on the gateway. +* *Read-Only*: The policy is applied in monitoring mode only. + +|*Conformance Status* +|Whether the API complies with the governance strategy's control rules or automated policies: + +* *Compliant*: The API meets all requirements. +* *Non-Compliant*: The API fails one or more requirements. + +|*Timestamp* +|The date and time when the strategy last evaluated the API. +|=== + +== Understanding Read-Only Entries + +If the *Policy Application Status* column shows *Read-Only*: + +* The provider connection uses credentials with read-only permissions. +* Policies are applied in monitoring mode and do not enforce requirements on the provider gateway. +* Conformance data is available, but policy violations are not automatically remediated. + +*How to Remediate*: xref:exp-governance-setup-third-party-providers.adoc#update-credentials[Update provider credentials] to grant write-enabled permissions. After updating credentials, re-export the report to verify that policies transition to *Enabled* status. + +== Analyze Exported Data + +Use the exported CSV to: + +* *Identify Read-Only Policies*: Filter the *Policy Application Status* column for *Read-Only* entries to find APIs where policies are not fully enforced. +* *Compare Providers*: Group by the *Gateway/Provider* column to compare conformance across Anypoint Platform and third-party providers. +* *Track Non-Compliant APIs*: Filter by *Conformance Status* to identify APIs that fail compliance checks. +* *Audit Policy Coverage*: Review the *Applied Policies* column to verify that required policies are applied to all targeted APIs. + +Import the CSV into spreadsheet software, BI tools, or compliance management platforms for deeper analysis. + +== Schedule Regular Exports + +For ongoing compliance tracking: + +* Export reports at regular intervals (such as monthly or quarterly). +* Compare exports over time to track conformance improvements or regressions. +* Share reports with compliance teams as part of your organization's governance review process. + +Regular exports help you maintain audit readiness and demonstrate continuous compliance. + +== Related Topics + +* xref:exp-governance-monitor-cross-gateway-conformance.adoc[Monitor Cross-Gateway Conformance] +* xref:exp-governance-create-strategy.adoc[Create Governance Strategies] +* xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] +* xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs] diff --git a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc new file mode 100644 index 000000000..ee3e50d44 --- /dev/null +++ b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc @@ -0,0 +1,85 @@ += Govern Third-Party Provider APIs +:keywords: third-party apis, cross-gateway governance, provider governance, api compliance, policy enforcement + +After connecting to a third-party API gateway provider, you can govern discovered APIs through the same governance workflow used for Anypoint Platform APIs. This enables unified governance across multiple gateway platforms. + +== End-to-End Workflow + +Follow these steps to govern APIs from third-party providers: + +. *Connect to Provider*: Use the xref:exp-governance-setup-third-party-providers.adoc[provider connection wizard] to establish a connection to your third-party API gateway (such as Akamai). The system creates a scanner and begins discovering APIs. + +. *Verify Discovered APIs*: Go to *Portfolio Overview* and verify that discovered APIs appear with the provider name in the *Gateway/Provider* column. APIs are automatically added to the portfolio as they are discovered. + +. *Create Governance Strategy*: Create a xref:exp-governance-create-strategy.adoc[governance strategy] with the *Gateway/Provider* filter to target specific third-party providers or all runtimes. Select the control rules or automated policies to apply. + +. *Monitor Conformance*: Track conformance status for provider-hosted APIs through the governance strategy dashboard. Filter by specific providers to focus on a subset of your cross-gateway environment. + +. *Apply Policies*: For targeted or supplemental policy application, use xref:exp-governance-policy-library-apply.adoc[Policy Library] to select and apply policies directly to provider-hosted API instances. + +. *Export Reports*: Export cross-gateway policy and conformance reports to CSV for compliance audits and stakeholder reviews. + +== Gateway/Provider Filter + +When creating a governance strategy, use the *Gateway/Provider* filter to target third-party provider APIs: + +. In the governance strategy creation workflow, expand the *Gateway/Provider* filter. +. Select one or more connected providers from the list (such as *Akamai*), or select *All Runtimes* to include both Anypoint Platform and third-party provider APIs. + +The strategy applies only to APIs hosted on the selected providers. + +== Cross-Gateway Conformance Monitoring + +Monitor conformance across multiple gateway platforms: + +. Go to *Governance* > *Governance Strategies*. +. Select an active strategy that targets multiple providers or *All Runtimes*. +. Review the conformance summary. The *Gateway/Provider* column shows which platform hosts each API. +. Use the *Gateway/Provider* filter to focus on conformance for a specific provider. + +*Read-Only Policy Status*: If a policy shows *Read-Only* status, the provider connection uses read-only credentials. To enable policy writes, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update credentials] with write-enabled permissions. + +== Policy Library for Third-Party APIs + +xref:exp-governance-policy-library-apply.adoc[Policy Library] provides a targeted way to apply individual policies to third-party provider services: + +. Go to *Governance* > *Governance Strategies* > *Policy Library*. +. Complete the 4-step wizard: ++ +-- +** *Select Policy*: Choose from Universal, Access and Security, Performance and Cost, Data Privacy and Integrity, or Compliance and Observability categories. +** *Configure Policy*: Set policy parameters. +** *Select Instances*: Choose API instances hosted on third-party providers. +** *Review & Apply*: Confirm and apply the policy. +-- + +Use Policy Library when you need supplemental or one-off policy application outside of governance strategies. + +== Export Cross-Gateway Reports + +Export policy and conformance data for compliance audits: + +. Go to *Governance* > *Governance Strategies*. +. Select the strategy you want to report on. +. Select *Export to CSV*. + +The CSV includes: + +* Organization ID +* API ID +* API Version +* Gateway/Provider +* Applied policies +* Policy Application Status (Enabled or Read-Only) +* Conformance status +* Timestamp + +Read-Only entries indicate that policies are applied in monitoring mode only. To enable write access, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update provider credentials]. + +== Related Topics + +* xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] +* xref:exp-governance-create-strategy.adoc[Create Governance Strategies] +* xref:exp-governance-policy-library-apply.adoc[Apply Policies via Policy Library] +* xref:exp-governance-monitor-cross-gateway-conformance.adoc[Monitor Cross-Gateway Conformance] +* xref:exp-governance-cross-gateway-policy-audit-export.adoc[Export Cross-Gateway Policy Audit Reports] diff --git a/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc new file mode 100644 index 000000000..707912cb2 --- /dev/null +++ b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc @@ -0,0 +1,80 @@ += Monitor Cross-Gateway Conformance +:keywords: cross-gateway conformance, provider conformance, governance monitoring, compliance tracking, multi-gateway governance + +After creating governance strategies that target multiple gateway platforms or third-party providers, monitor conformance across your entire API ecosystem through a unified dashboard. The conformance summary shows compliance status for APIs hosted on Anypoint Platform gateways and connected third-party providers. + +== Before You Begin + +Before monitoring cross-gateway conformance: + +* xref:exp-governance-setup-third-party-providers.adoc[Connect to one or more third-party providers] to enable cross-gateway governance. +* xref:exp-governance-create-strategy.adoc[Create a governance strategy] that targets multiple providers or *All Runtimes* using the xref:exp-governance-create-profiles-gateway-provider-filter.adoc[Gateway/Provider filter]. +* Verify that the strategy is active and has evaluated the targeted APIs. + +== View Cross-Gateway Conformance + +. Log in and go to *Governance* > *Governance Strategies*. +. Select an active strategy that targets multiple providers or *All Runtimes*. +. Review the conformance summary dashboard. + +The dashboard displays: + +* *Conformance Status*: The percentage of targeted APIs that comply with the strategy's control rules or automated policies. +* *Gateway/Provider Column*: Shows which platform hosts each API (such as *Anypoint Platform*, *Akamai*, or other connected providers). +* *Compliant vs Non-Compliant APIs*: A breakdown of APIs that meet or fail the strategy's requirements. +* *Policy Application Status*: Indicates whether policies are *Enabled* (actively enforced) or *Read-Only* (monitoring mode only). + +== Filter by Specific Provider + +To focus on conformance for a specific provider: + +. In the conformance dashboard, locate the *Gateway/Provider* filter. +. Select one or more providers from the list (such as *Akamai*). +. The dashboard updates to show only APIs hosted on the selected platforms. + +Use this filter to: + +* Compare conformance across providers. +* Identify provider-specific compliance gaps. +* Focus on a subset of your multi-gateway environment during reviews or audits. + +== Understanding Read-Only Policy Status + +If a policy shows *Read-Only* status in the conformance dashboard: + +* The provider connection uses credentials with read-only permissions. +* Policies are applied in monitoring mode only and do not enforce requirements on the provider gateway. +* The system can track conformance but cannot automatically remediate violations. + +*How to Remediate*: xref:exp-governance-setup-third-party-providers.adoc#update-credentials[Update provider credentials] to grant write-enabled permissions. After updating credentials, policies transition from *Read-Only* to *Enabled* status and can enforce requirements on the provider gateway. + +== Monitor Conformance Over Time + +Track conformance trends to identify improvements or regressions: + +. Select a governance strategy from the dashboard. +. Review the *Conformance History* chart (if available) to see how compliance has changed over time. +. Use the *Gateway/Provider* filter to compare trends across platforms. + +Regular monitoring helps you: + +* Identify APIs that consistently fail compliance checks. +* Measure the impact of policy changes or governance strategy adjustments. +* Demonstrate compliance improvements to stakeholders during audits. + +== Export Conformance Reports + +To share conformance data with stakeholders or include it in compliance audits: + +. From the governance strategy dashboard, select *Export to CSV*. +. The CSV includes conformance status, Gateway/Provider, applied policies, and policy application status for each API. + +For more information about the CSV schema and how to use exported reports, see xref:exp-governance-cross-gateway-policy-audit-export.adoc[Export Cross-Gateway Policy Audit Reports]. + +== Related Topics + +* xref:exp-governance-create-strategy.adoc[Create Governance Strategies] +* xref:exp-governance-create-profiles-gateway-provider-filter.adoc[Filter Governance Scope by Gateway or Provider] +* xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] +* xref:exp-governance-cross-gateway-policy-audit-export.adoc[Export Cross-Gateway Policy Audit Reports] +* xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs] diff --git a/modules/ROOT/pages/exp-governance-policy-library-apply.adoc b/modules/ROOT/pages/exp-governance-policy-library-apply.adoc new file mode 100644 index 000000000..45c6faa23 --- /dev/null +++ b/modules/ROOT/pages/exp-governance-policy-library-apply.adoc @@ -0,0 +1,121 @@ += Apply Policies via Policy Library +:keywords: policy library, apply policies, policy enforcement, targeted policies, governance policies + +Policy Library provides a wizard-driven workflow to apply individual policies directly to selected API instances. Use Policy Library for targeted or supplemental policy application when you need more control than governance strategies provide. + +== When to Use Policy Library + +Use Policy Library instead of governance strategies when you need to: + +* Apply a policy to a specific set of API instances without creating a governance strategy. +* Add supplemental policies to instances that are already governed by strategies. +* Apply policies to third-party provider services hosted on platforms such as Akamai. +* Test policy behavior on a limited scope before broader rollout. + +For comprehensive, scope-driven governance across multiple services, use xref:exp-governance-create-strategy.adoc[governance strategies] instead. + +== Before You Begin + +Before getting started, make sure you have: + +* An Anypoint Platform account. +* Any of these permissions: ++ +-- +** API Governance: Governance Administrator +** API Manager: Manage Policies +-- ++ +For more information, see xref:exp-home-start.adoc#permissions[Enhanced Experience Permissions]. + +* API instances registered in the portfolio. For third-party provider services, ensure the xref:exp-governance-setup-third-party-providers.adoc[provider connection] is established. + +== Open Policy Library + +. Log in and go to *Governance* > *Governance Strategies* > *Policy Library*. +. Select *Apply Policy* to start the policy application wizard. + +The wizard guides you through policy selection, configuration, instance selection, and review. + +== Select Policy + +Choose the policy you want to apply from these categories: + +*Universal*:: +Policies that apply across all gateway types and service types, such as message logging or header injection. + +*Access and Security*:: +Authentication and authorization policies, including OAuth 2.0, JWT validation, IP filtering, and rate limiting. + +*Performance and Cost*:: +Policies that manage API performance and cost, such as caching, spike arrest, and request throttling. + +*Data Privacy and Integrity*:: +Policies that protect data privacy and ensure data integrity, such as PII masking, data encryption, and payload validation. + +*Compliance and Observability*:: +Policies that enable compliance tracking and observability, such as audit logging, correlation ID injection, and OpenTelemetry tracing. + +Select the policy you want to apply and select *Next*. + +== Configure Policy + +Enter configuration parameters for your selected policy. Required and optional fields vary by policy type. + +Common configuration fields include: + +* *Policy Name*: A descriptive name for this policy application. +* *Enforcement Mode*: Whether to enforce the policy or monitor violations only (if supported). +* *Parameters*: Policy-specific settings such as rate limits, authentication providers, or transformation rules. + +Configure the policy parameters according to your requirements and select *Next*. + +== Select Instances + +Choose the API instances where the policy will be applied: + +. Review the list of available API instances. The list includes instances from Anypoint Platform and connected third-party providers. +. Use filters to narrow the list by: ++ +-- +** *Gateway/Provider*: Filter by specific providers (such as Akamai) or Anypoint Platform gateways. +** *Service Type*: Filter by service type (such as REST API or GraphQL). +** *Tags*: Filter by tags assigned to services. +-- + +. Select one or more instances where you want to apply the policy. +. Select *Next*. + +== Review and Apply + +Review the policy application summary: + +* *Policy*: The selected policy and its configuration. +* *Instances*: The list of instances where the policy will be applied. +* *Expected Outcome*: A summary of what will happen when the policy is applied. + +*Read-Only Mode*: If any selected instances belong to a provider connection with read-only credentials, those instances will receive the policy in monitoring mode only. To enable write access, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update provider credentials]. + +Select *Apply* to apply the policy to the selected instances. + +== Verify Policy Application + +After applying the policy: + +. Go to *Portfolio Overview* and navigate to the affected API instance. +. Review the *Applied Policies* tab to verify the policy appears in the list. +. Check the *Policy Application Status*: ++ +-- +** *Enabled*: The policy is actively enforced on the gateway. +** *Read-Only*: The policy is applied in monitoring mode only (typically due to read-only provider credentials). +-- + +If the policy is in read-only mode and you need enforcement, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update provider credentials] to grant write access. + +== Related Topics + +* xref:exp-governance-create-strategy.adoc[Create Governance Strategies] +* xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] +* xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs] +* xref:exp-services-view-details.adoc[View Service Details] diff --git a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc new file mode 100644 index 000000000..e7630fa8d --- /dev/null +++ b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc @@ -0,0 +1,99 @@ += Connect to Third-Party API Providers +:keywords: third-party providers, akamai, api discovery, provider connection, scanner, api governance + +Connect to third-party API gateway providers such as Akamai to automatically discover and govern APIs hosted on those platforms. When you connect to a supported provider, the system creates scanners, discovers APIs, and applies correlation policies to enable cross-gateway governance. + +== Before You Begin + +Before getting started, make sure you have: + +* An Anypoint Platform account. +* Any of these permissions: ++ +-- +** API Governance: Governance Administrator +** Platform: Manage Providers +-- ++ +For more information, see xref:exp-home-start.adoc#permissions[Enhanced Experience Permissions]. + +* Provider credentials with appropriate API access permissions. + +== Connect to a Provider + +. Log in and go to *Platform* > *Providers*. +. Select *Add Provider* to start the connection wizard. + +The wizard guides you through provider selection, connection setup, and credential configuration. + +=== Choose Provider + +Select the third-party API gateway provider you want to connect to: + +* *Akamai* - Connect to Akamai API Gateway to discover and govern APIs hosted on Akamai infrastructure. +* Additional providers may appear as support is added. + +Select your provider and select *Next*. + +=== Connect to Provider + +Enter the connection details for your selected provider: + +*Provider Name*:: +A descriptive name to identify this provider connection in the platform. + +*Base URL*:: +The API endpoint URL for your provider instance (for example, `https://api.akamai.com`). + +*Region*:: +The geographic region where your provider instance is hosted (if applicable). + +Select *Next* to proceed to credential configuration. + +=== Connection Setup + +Configure authentication credentials to enable API access: + +*Authentication Method*:: +Select the authentication method supported by your provider (API Key, OAuth, or Client Credentials). + +*Credentials*:: +Enter the required authentication credentials for your provider account. The specific fields depend on your selected authentication method: ++ +-- +** *API Key*: Enter your API key and secret. +** *OAuth*: Provide client ID, client secret, and authorization URL. +** *Client Credentials*: Enter client ID and client secret. +-- + +*Read-Only Access*:: +If your credentials have read-only permissions, the system can discover APIs and monitor conformance but cannot apply policies directly to the provider gateway. You can use xref:exp-governance-policy-library-apply.adoc[Policy Library] to apply policies in read-only mode, or update credentials later to enable write access. + +Select *Connect* to establish the connection. + +== What Happens Next + +After you connect to a provider: + +* *Scanner Auto-Creation*: The system automatically creates a scanner for the connected provider to enable API discovery. +* *API Discovery*: The scanner begins discovering APIs hosted on the provider platform. Discovered APIs appear in *Portfolio Overview* with the provider name in the Gateway/Provider column. +* *Akamai Correlation Policy*: For Akamai providers, the system automatically applies a correlation policy to discovered APIs to enable cross-gateway observability and governance. + +== Update Credentials + +If your initial credentials were read-only and you need to enable policy application: + +. Go to *Platform* > *Providers*. +. Locate your provider connection and select *Edit*. +. Select *Update Credentials*. +. Enter credentials with write permissions. +. Select *Save*. + +After updating to write-enabled credentials, you can apply policies directly to APIs on the provider gateway through governance strategies or xref:exp-governance-policy-library-apply.adoc[Policy Library]. + +== Related Topics + +* xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs] +* xref:exp-governance-create-strategy.adoc[Create Governance Strategies] +* xref:exp-providers-manage.adoc[Manage API Gateway Providers] +* xref:exp-scanners-manage.adoc[Manage API Scanners] From bbbe05ad10eb47b121212cee3d082d39d3807dc2 Mon Sep 17 00:00:00 2001 From: Luana Dos Santos Date: Fri, 10 Jul 2026 00:32:08 -0300 Subject: [PATCH 02/28] docs: add policy drift detection topic for third-party providers Add exp-governance-third-party-policy-drift.adoc to document policy drift detection and remediation for third-party API gateway instances (Kong, Apigee, AWS API Gateway, and Akamai). Content includes: - What policy drift is and common causes (manual gateway changes, credential issues, policy application failures) - How to detect drift via conformance dashboard with drift indicators (Missing Policy, Extra Policy, Configuration Mismatch) - Remediation workflow using Policy Library to apply or update policies - Updating scanner credentials to enable write access and programmatic policy application - Monitoring policy drift over time with CSV exports and trend analysis - Best practices to prevent drift (restrict gateway access, document governance-managed policies, use write-enabled credentials) This topic provides the linkable target for docs-api-governance-documentation repo's "Find Policy Drift on Third-Party API Instances" section. Co-Authored-By: Claude Sonnet 4.5 --- ...p-governance-third-party-policy-drift.adoc | 117 ++++++++++++++++++ 1 file changed, 117 insertions(+) create mode 100644 modules/ROOT/pages/exp-governance-third-party-policy-drift.adoc diff --git a/modules/ROOT/pages/exp-governance-third-party-policy-drift.adoc b/modules/ROOT/pages/exp-governance-third-party-policy-drift.adoc new file mode 100644 index 000000000..f84dff90d --- /dev/null +++ b/modules/ROOT/pages/exp-governance-third-party-policy-drift.adoc @@ -0,0 +1,117 @@ += Find and Fix Policy Drift on Third-Party API Instances +:keywords: policy drift, third-party apis, conformance, policy detection, governance drift, provider compliance + +Policy drift occurs when the policies applied on a third-party API gateway instance differ from the policies defined in your governance strategy. API Governance detects policy drift for APIs hosted on Kong, Apigee, AWS API Gateway, and Akamai, enabling you to identify and remediate configuration inconsistencies across your multi-gateway environment. + +== What Is Policy Drift? + +Policy drift happens when: + +* A policy defined in your governance strategy is not applied to a third-party gateway instance. +* A policy applied on the gateway has been modified or removed outside of API Governance. +* Policy parameters on the gateway instance do not match the configuration defined in your governance strategy. + +Policy drift can occur due to: + +* Manual changes made directly on the third-party gateway console. +* Automated configuration management tools modifying gateway policies. +* Policy application failures that were not detected or remediated. +* Credential or permission issues preventing API Governance from applying policies. + +Detecting and fixing policy drift ensures that your governance policies are consistently enforced across all gateway platforms. + +== Before You Begin + +Before detecting policy drift: + +* xref:exp-governance-setup-third-party-providers.adoc[Connect to one or more third-party providers] to enable cross-gateway governance. +* xref:exp-governance-create-strategy.adoc[Create a governance strategy] that targets third-party provider APIs using the xref:exp-governance-create-profiles-gateway-provider-filter.adoc[Gateway/Provider filter]. +* Verify that the strategy is active and has evaluated the targeted APIs. + +== Detect Policy Drift + +. Log in and go to *Governance* > *Governance Strategies*. +. Select an active strategy that targets third-party provider APIs. +. Review the conformance dashboard for APIs with *Non-Compliant* status. +. Select a non-compliant API to view details. + +The API detail view shows: + +* *Expected Policies*: Policies defined in the governance strategy that should be applied to the instance. +* *Applied Policies*: Policies currently applied on the third-party gateway instance. +* *Drift Indicators*: Highlights where expected and applied policies differ. + +Drift indicators include: + +* *Missing Policy*: A policy defined in the strategy is not applied on the gateway. +* *Extra Policy*: A policy applied on the gateway is not defined in the strategy. +* *Configuration Mismatch*: A policy is applied but its parameters differ from the strategy definition. + +== Fix Policy Drift Using Policy Library + +To remediate policy drift, use xref:exp-governance-policy-library-apply.adoc[Policy Library] to apply or update policies directly on third-party gateway instances: + +. Go to *Governance* > *Governance Strategies* > *Policy Library*. +. Select *Apply Policy* to start the policy application wizard. +. In the *Select Policy* step, choose the policy that is missing or misconfigured on the gateway. +. In the *Configure Policy* step, enter the correct policy parameters to match your governance strategy definition. +. In the *Select Instances* step, choose the third-party API instances where policy drift was detected. +. Review the summary and select *Apply*. + +After applying the policy, return to the conformance dashboard to verify that the API transitions to *Compliant* status. + +== Update Scanner Credentials for Programmatic Policy Application + +If policy drift persists or you see *Read-Only* status indicators, your provider connection may use read-only credentials that prevent programmatic policy application. + +To enable write access: + +. Go to *Platform* > *Providers*. +. Locate the provider connection for your third-party gateway. +. Select *Edit* > *Update Credentials*. +. Enter credentials with write-enabled permissions for the gateway API. +. Select *Save*. + +After updating credentials: + +* Policies transition from *Read-Only* to *Enabled* status. +* API Governance can programmatically apply and update policies on the gateway. +* Policy drift detection continues, but remediation becomes automated through governance strategies. + +== Monitor Policy Drift Over Time + +To track policy drift trends: + +. xref:exp-governance-monitor-cross-gateway-conformance.adoc[Monitor cross-gateway conformance] regularly to identify APIs with recurring drift. +. xref:exp-governance-cross-gateway-policy-audit-export.adoc[Export conformance reports to CSV] at regular intervals to track drift patterns over time. +. Compare exports to identify: ++ +-- +** APIs with frequent policy drift (potential for manual gateway changes). +** Providers with higher drift rates (may indicate integration or credential issues). +** Policy types that commonly drift (may require additional controls or documentation). +-- + +Regular monitoring helps you: + +* Identify root causes of policy drift (such as manual changes by gateway admins). +* Implement preventive controls (such as restricting direct gateway access or documenting governance-managed policies). +* Demonstrate governance effectiveness during compliance audits. + +== Prevent Policy Drift + +To reduce policy drift: + +* *Restrict Direct Gateway Access*: Limit who can modify policies directly on third-party gateway consoles. +* *Document Governance-Managed Policies*: Clearly communicate which policies are managed by API Governance to prevent manual changes. +* *Use Write-Enabled Credentials*: Ensure provider connections use credentials with write permissions to enable automated policy application and updates. +* *Enable Automated Policy Strategies*: Use xref:exp-governance-create-strategy.adoc[Automated Policy strategies] to enforce policies at runtime rather than relying on manual application. +* *Schedule Regular Conformance Reviews*: Review conformance dashboards regularly to detect and remediate drift before it becomes widespread. + +== Related Topics + +* xref:exp-governance-monitor-cross-gateway-conformance.adoc[Monitor Cross-Gateway Conformance] +* xref:exp-governance-policy-library-apply.adoc[Apply Policies via Policy Library] +* xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] +* xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs] +* xref:exp-governance-create-strategy.adoc[Create Governance Strategies] From b2ca127ec196d775c0c7cc1afe03e94c68511881 Mon Sep 17 00:00:00 2001 From: Luana Dos Santos Date: Mon, 13 Jul 2026 13:00:39 -0300 Subject: [PATCH 03/28] first automatic review --- ...eate-profiles-gateway-provider-filter.adoc | 8 +++--- ...nce-cross-gateway-policy-audit-export.adoc | 10 +++---- ...xp-governance-govern-third-party-apis.adoc | 10 +++---- ...nce-monitor-cross-gateway-conformance.adoc | 9 +++--- .../exp-governance-policy-library-apply.adoc | 24 ++++++++-------- ...overnance-setup-third-party-providers.adoc | 12 ++++---- ...p-governance-third-party-policy-drift.adoc | 28 +++++++++---------- 7 files changed, 51 insertions(+), 50 deletions(-) diff --git a/modules/ROOT/pages/exp-governance-create-profiles-gateway-provider-filter.adoc b/modules/ROOT/pages/exp-governance-create-profiles-gateway-provider-filter.adoc index af6518c16..6288894c0 100644 --- a/modules/ROOT/pages/exp-governance-create-profiles-gateway-provider-filter.adoc +++ b/modules/ROOT/pages/exp-governance-create-profiles-gateway-provider-filter.adoc @@ -10,7 +10,7 @@ The *Gateway/Provider* filter appears in the governance strategy scope configura * Your organization has connected one or more third-party API gateway providers through *Platform* > *Providers*. * The connected providers have discovered APIs that are registered in the portfolio. -If no providers are connected, the filter does not appear and the strategy applies only to Anypoint Platform-hosted APIs. +If no providers are connected, the filter doesn't appear, and the strategy applies only to Anypoint Platform-hosted APIs. == Before You Begin @@ -23,7 +23,7 @@ Before using the Gateway/Provider filter: In the governance strategy creation workflow: -. Navigate to the *Define Governance Scope* step. +. Go to the *Define Governance Scope* step. . Expand the *Gateway/Provider* filter. . Select one or more options: + @@ -39,9 +39,9 @@ You can select multiple providers to govern APIs across a subset of platforms wi The *Gateway/Provider* filter narrows the governance scope to APIs hosted on the selected platforms: -* APIs that do not match the selected gateway or provider are excluded from the strategy, even if they match other scope criteria (such as tags or categories). +* APIs that don't match the selected gateway or provider are excluded from the strategy, even if they match other scope criteria (such as tags or categories). * If you select multiple providers, the strategy applies to APIs hosted on any of the selected platforms (OR logic). -* Combining the *Gateway/Provider* filter with other filters (Service Type, Tags, Categories) narrows the scope further. All selected filters must match (AND logic). +* Combining the *Gateway/Provider* filter with other filters (Service Type, Tags, Categories) narrows the scope further. An API matches only when it satisfies all selected filters (AND logic). == Example: Govern Only Akamai APIs diff --git a/modules/ROOT/pages/exp-governance-cross-gateway-policy-audit-export.adoc b/modules/ROOT/pages/exp-governance-cross-gateway-policy-audit-export.adoc index ca4e28f13..dbc95a552 100644 --- a/modules/ROOT/pages/exp-governance-cross-gateway-policy-audit-export.adoc +++ b/modules/ROOT/pages/exp-governance-cross-gateway-policy-audit-export.adoc @@ -19,7 +19,7 @@ Before exporting a report: * xref:exp-governance-create-strategy.adoc[Create a governance strategy] that targets the APIs you want to report on. * Verify that the strategy is active and has evaluated the targeted APIs. -* For cross-gateway reports, ensure that xref:exp-governance-setup-third-party-providers.adoc[third-party providers are connected] and have discovered APIs. +* For cross-gateway reports, make sure that xref:exp-governance-setup-third-party-providers.adoc[third-party providers are connected] and have discovered APIs. == Export a Governance Strategy Report @@ -32,7 +32,7 @@ The export includes all APIs targeted by the selected strategy, along with their == CSV Report Schema -The exported CSV includes the following columns: +The exported CSV includes these columns: [cols="1,3"] |=== @@ -74,8 +74,8 @@ The exported CSV includes the following columns: If the *Policy Application Status* column shows *Read-Only*: * The provider connection uses credentials with read-only permissions. -* Policies are applied in monitoring mode and do not enforce requirements on the provider gateway. -* Conformance data is available, but policy violations are not automatically remediated. +* Policies are applied in monitoring mode and don't enforce requirements on the provider gateway. +* Conformance data is available, but policy violations aren't automatically remediated. *How to Remediate*: xref:exp-governance-setup-third-party-providers.adoc#update-credentials[Update provider credentials] to grant write-enabled permissions. After updating credentials, re-export the report to verify that policies transition to *Enabled* status. @@ -83,7 +83,7 @@ If the *Policy Application Status* column shows *Read-Only*: Use the exported CSV to: -* *Identify Read-Only Policies*: Filter the *Policy Application Status* column for *Read-Only* entries to find APIs where policies are not fully enforced. +* *Identify Read-Only Policies*: Filter the *Policy Application Status* column for *Read-Only* entries to find APIs where policies aren't fully enforced. * *Compare Providers*: Group by the *Gateway/Provider* column to compare conformance across Anypoint Platform and third-party providers. * *Track Non-Compliant APIs*: Filter by *Conformance Status* to identify APIs that fail compliance checks. * *Audit Policy Coverage*: Review the *Applied Policies* column to verify that required policies are applied to all targeted APIs. diff --git a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc index ee3e50d44..735b06b5e 100644 --- a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc +++ b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc @@ -11,7 +11,7 @@ Follow these steps to govern APIs from third-party providers: . *Verify Discovered APIs*: Go to *Portfolio Overview* and verify that discovered APIs appear with the provider name in the *Gateway/Provider* column. APIs are automatically added to the portfolio as they are discovered. -. *Create Governance Strategy*: Create a xref:exp-governance-create-strategy.adoc[governance strategy] with the *Gateway/Provider* filter to target specific third-party providers or all runtimes. Select the control rules or automated policies to apply. +. *Create Governance Strategy*: Create a xref:exp-governance-create-strategy.adoc[governance strategy] with the *Gateway/Provider* filter to target specific third-party providers or *All Runtimes*. Select the control rules or automated policies to apply. . *Monitor Conformance*: Track conformance status for provider-hosted APIs through the governance strategy dashboard. Filter by specific providers to focus on a subset of your cross-gateway environment. @@ -37,14 +37,14 @@ Monitor conformance across multiple gateway platforms: . Review the conformance summary. The *Gateway/Provider* column shows which platform hosts each API. . Use the *Gateway/Provider* filter to focus on conformance for a specific provider. -*Read-Only Policy Status*: If a policy shows *Read-Only* status, the provider connection uses read-only credentials. To enable policy writes, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update credentials] with write-enabled permissions. +*Read-Only Policy Status*: If a policy shows *Read-Only* status, the provider connection uses read-only credentials. To enable policy writes, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update the credentials] with write-enabled permissions. == Policy Library for Third-Party APIs -xref:exp-governance-policy-library-apply.adoc[Policy Library] provides a targeted way to apply individual policies to third-party provider services: +The xref:exp-governance-policy-library-apply.adoc[Policy Library] provides a targeted way to apply individual policies to third-party provider services: . Go to *Governance* > *Governance Strategies* > *Policy Library*. -. Complete the 4-step wizard: +. Complete the four-step wizard: + -- ** *Select Policy*: Choose from Universal, Access and Security, Performance and Cost, Data Privacy and Integrity, or Compliance and Observability categories. @@ -53,7 +53,7 @@ xref:exp-governance-policy-library-apply.adoc[Policy Library] provides a targete ** *Review & Apply*: Confirm and apply the policy. -- -Use Policy Library when you need supplemental or one-off policy application outside of governance strategies. +Use the Policy Library when you need supplemental or one-off policy application outside governance strategies. == Export Cross-Gateway Reports diff --git a/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc index 707912cb2..3b597b453 100644 --- a/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc +++ b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc @@ -21,7 +21,7 @@ The dashboard displays: * *Conformance Status*: The percentage of targeted APIs that comply with the strategy's control rules or automated policies. * *Gateway/Provider Column*: Shows which platform hosts each API (such as *Anypoint Platform*, *Akamai*, or other connected providers). -* *Compliant vs Non-Compliant APIs*: A breakdown of APIs that meet or fail the strategy's requirements. +* *Compliant vs. Non-Compliant APIs*: A breakdown of APIs that meet or fail the strategy's requirements. * *Policy Application Status*: Indicates whether policies are *Enabled* (actively enforced) or *Read-Only* (monitoring mode only). == Filter by Specific Provider @@ -30,7 +30,8 @@ To focus on conformance for a specific provider: . In the conformance dashboard, locate the *Gateway/Provider* filter. . Select one or more providers from the list (such as *Akamai*). -. The dashboard updates to show only APIs hosted on the selected platforms. + +The dashboard updates to show only APIs hosted on the selected platforms. Use this filter to: @@ -43,8 +44,8 @@ Use this filter to: If a policy shows *Read-Only* status in the conformance dashboard: * The provider connection uses credentials with read-only permissions. -* Policies are applied in monitoring mode only and do not enforce requirements on the provider gateway. -* The system can track conformance but cannot automatically remediate violations. +* Policies are applied in monitoring mode only and don't enforce requirements on the provider gateway. +* The system can track conformance but can't automatically remediate violations. *How to Remediate*: xref:exp-governance-setup-third-party-providers.adoc#update-credentials[Update provider credentials] to grant write-enabled permissions. After updating credentials, policies transition from *Read-Only* to *Enabled* status and can enforce requirements on the provider gateway. diff --git a/modules/ROOT/pages/exp-governance-policy-library-apply.adoc b/modules/ROOT/pages/exp-governance-policy-library-apply.adoc index 45c6faa23..db8b1412c 100644 --- a/modules/ROOT/pages/exp-governance-policy-library-apply.adoc +++ b/modules/ROOT/pages/exp-governance-policy-library-apply.adoc @@ -1,16 +1,16 @@ = Apply Policies via Policy Library :keywords: policy library, apply policies, policy enforcement, targeted policies, governance policies -Policy Library provides a wizard-driven workflow to apply individual policies directly to selected API instances. Use Policy Library for targeted or supplemental policy application when you need more control than governance strategies provide. +The Policy Library provides a wizard-driven workflow to apply individual policies directly to selected API instances. Use the Policy Library for targeted or supplemental policy application when you want more control than governance strategies provide. -== When to Use Policy Library +== When to Use the Policy Library -Use Policy Library instead of governance strategies when you need to: +Use the Policy Library instead of governance strategies when you want to: * Apply a policy to a specific set of API instances without creating a governance strategy. * Add supplemental policies to instances that are already governed by strategies. * Apply policies to third-party provider services hosted on platforms such as Akamai. -* Test policy behavior on a limited scope before broader rollout. +* Test policy behavior on a limited scope before a broader rollout. For comprehensive, scope-driven governance across multiple services, use xref:exp-governance-create-strategy.adoc[governance strategies] instead. @@ -28,9 +28,9 @@ Before getting started, make sure you have: + For more information, see xref:exp-home-start.adoc#permissions[Enhanced Experience Permissions]. -* API instances registered in the portfolio. For third-party provider services, ensure the xref:exp-governance-setup-third-party-providers.adoc[provider connection] is established. +* API instances registered in the portfolio. For third-party provider services, make sure that the xref:exp-governance-setup-third-party-providers.adoc[provider connection] is established. -== Open Policy Library +== Open the Policy Library . Log in and go to *Governance* > *Governance Strategies* > *Policy Library*. . Select *Apply Policy* to start the policy application wizard. @@ -72,7 +72,7 @@ Configure the policy parameters according to your requirements and select *Next* == Select Instances -Choose the API instances where the policy will be applied: +Choose the API instances where you want to apply the policy: . Review the list of available API instances. The list includes instances from Anypoint Platform and connected third-party providers. . Use filters to narrow the list by: @@ -91,10 +91,10 @@ Choose the API instances where the policy will be applied: Review the policy application summary: * *Policy*: The selected policy and its configuration. -* *Instances*: The list of instances where the policy will be applied. -* *Expected Outcome*: A summary of what will happen when the policy is applied. +* *Instances*: The list of instances where the policy is applied. +* *Expected Outcome*: A summary of what happens when you apply the policy. -*Read-Only Mode*: If any selected instances belong to a provider connection with read-only credentials, those instances will receive the policy in monitoring mode only. To enable write access, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update provider credentials]. +*Read-Only Mode*: If any selected instances belong to a provider connection with read-only credentials, those instances receive the policy in monitoring mode only. To enable write access, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update provider credentials]. Select *Apply* to apply the policy to the selected instances. @@ -102,7 +102,7 @@ Select *Apply* to apply the policy to the selected instances. After applying the policy: -. Go to *Portfolio Overview* and navigate to the affected API instance. +. Go to *Portfolio Overview* and open the affected API instance. . Review the *Applied Policies* tab to verify the policy appears in the list. . Check the *Policy Application Status*: + @@ -111,7 +111,7 @@ After applying the policy: ** *Read-Only*: The policy is applied in monitoring mode only (typically due to read-only provider credentials). -- -If the policy is in read-only mode and you need enforcement, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update provider credentials] to grant write access. +If the policy is in read-only mode and you want enforcement, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update provider credentials] to grant write access. == Related Topics diff --git a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc index e7630fa8d..da40fe39a 100644 --- a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc +++ b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc @@ -30,8 +30,8 @@ The wizard guides you through provider selection, connection setup, and credenti Select the third-party API gateway provider you want to connect to: -* *Akamai* - Connect to Akamai API Gateway to discover and govern APIs hosted on Akamai infrastructure. -* Additional providers may appear as support is added. +* *Akamai*—Connect to Akamai API Gateway to discover and govern APIs hosted on Akamai infrastructure. +* Additional providers appear as support is added. Select your provider and select *Next*. @@ -67,7 +67,7 @@ Enter the required authentication credentials for your provider account. The spe -- *Read-Only Access*:: -If your credentials have read-only permissions, the system can discover APIs and monitor conformance but cannot apply policies directly to the provider gateway. You can use xref:exp-governance-policy-library-apply.adoc[Policy Library] to apply policies in read-only mode, or update credentials later to enable write access. +If your credentials have read-only permissions, the system can discover APIs and monitor conformance but can't apply policies directly to the provider gateway. Use xref:exp-governance-policy-library-apply.adoc[Policy Library] to apply policies in read-only mode, or update credentials later to enable write access. Select *Connect* to establish the connection. @@ -76,12 +76,12 @@ Select *Connect* to establish the connection. After you connect to a provider: * *Scanner Auto-Creation*: The system automatically creates a scanner for the connected provider to enable API discovery. -* *API Discovery*: The scanner begins discovering APIs hosted on the provider platform. Discovered APIs appear in *Portfolio Overview* with the provider name in the Gateway/Provider column. +* *API Discovery*: The scanner begins discovering APIs hosted on the provider platform. Discovered APIs appear in *Portfolio Overview* with the provider name in the *Gateway/Provider* column. * *Akamai Correlation Policy*: For Akamai providers, the system automatically applies a correlation policy to discovered APIs to enable cross-gateway observability and governance. == Update Credentials -If your initial credentials were read-only and you need to enable policy application: +If your initial credentials were read-only and you want to enable policy application: . Go to *Platform* > *Providers*. . Locate your provider connection and select *Edit*. @@ -89,7 +89,7 @@ If your initial credentials were read-only and you need to enable policy applica . Enter credentials with write permissions. . Select *Save*. -After updating to write-enabled credentials, you can apply policies directly to APIs on the provider gateway through governance strategies or xref:exp-governance-policy-library-apply.adoc[Policy Library]. +After updating to write-enabled credentials, you can apply policies directly to APIs on the provider gateway through governance strategies or the xref:exp-governance-policy-library-apply.adoc[Policy Library]. == Related Topics diff --git a/modules/ROOT/pages/exp-governance-third-party-policy-drift.adoc b/modules/ROOT/pages/exp-governance-third-party-policy-drift.adoc index f84dff90d..84ef184fd 100644 --- a/modules/ROOT/pages/exp-governance-third-party-policy-drift.adoc +++ b/modules/ROOT/pages/exp-governance-third-party-policy-drift.adoc @@ -1,24 +1,24 @@ = Find and Fix Policy Drift on Third-Party API Instances :keywords: policy drift, third-party apis, conformance, policy detection, governance drift, provider compliance -Policy drift occurs when the policies applied on a third-party API gateway instance differ from the policies defined in your governance strategy. API Governance detects policy drift for APIs hosted on Kong, Apigee, AWS API Gateway, and Akamai, enabling you to identify and remediate configuration inconsistencies across your multi-gateway environment. +Policy drift occurs when the policies applied on a third-party API gateway instance differ from the policies defined in your governance strategy. API Governance detects policy drift for APIs hosted on Kong, Apigee, AWS API Gateway, and Akamai so that you can identify and remediate configuration inconsistencies across your multi-gateway environment. == What Is Policy Drift? Policy drift happens when: -* A policy defined in your governance strategy is not applied to a third-party gateway instance. -* A policy applied on the gateway has been modified or removed outside of API Governance. -* Policy parameters on the gateway instance do not match the configuration defined in your governance strategy. +* A policy defined in your governance strategy isn't applied to a third-party gateway instance. +* A policy applied on the gateway is modified or removed outside API Governance. +* Policy parameters on the gateway instance don't match the configuration defined in your governance strategy. Policy drift can occur due to: * Manual changes made directly on the third-party gateway console. -* Automated configuration management tools modifying gateway policies. -* Policy application failures that were not detected or remediated. -* Credential or permission issues preventing API Governance from applying policies. +* Automated configuration management tools that modify gateway policies. +* Policy application failures that aren't detected or remediated. +* Credential or permission issues that prevent API Governance from applying policies. -Detecting and fixing policy drift ensures that your governance policies are consistently enforced across all gateway platforms. +Detecting and fixing policy drift keeps your governance policies consistently enforced across all gateway platforms. == Before You Begin @@ -37,13 +37,13 @@ Before detecting policy drift: The API detail view shows: -* *Expected Policies*: Policies defined in the governance strategy that should be applied to the instance. +* *Expected Policies*: Policies defined in the governance strategy to apply to the instance. * *Applied Policies*: Policies currently applied on the third-party gateway instance. * *Drift Indicators*: Highlights where expected and applied policies differ. Drift indicators include: -* *Missing Policy*: A policy defined in the strategy is not applied on the gateway. +* *Missing Policy*: A policy defined in the strategy isn't applied on the gateway. * *Extra Policy*: A policy applied on the gateway is not defined in the strategy. * *Configuration Mismatch*: A policy is applied but its parameters differ from the strategy definition. @@ -62,7 +62,7 @@ After applying the policy, return to the conformance dashboard to verify that th == Update Scanner Credentials for Programmatic Policy Application -If policy drift persists or you see *Read-Only* status indicators, your provider connection may use read-only credentials that prevent programmatic policy application. +If policy drift persists or you see *Read-Only* status indicators, your provider connection might use read-only credentials that prevent programmatic policy application. To enable write access: @@ -88,8 +88,8 @@ To track policy drift trends: + -- ** APIs with frequent policy drift (potential for manual gateway changes). -** Providers with higher drift rates (may indicate integration or credential issues). -** Policy types that commonly drift (may require additional controls or documentation). +** Providers with higher drift rates (a sign of integration or credential issues). +** Policy types that commonly drift (a sign that additional controls or documentation are needed). -- Regular monitoring helps you: @@ -104,7 +104,7 @@ To reduce policy drift: * *Restrict Direct Gateway Access*: Limit who can modify policies directly on third-party gateway consoles. * *Document Governance-Managed Policies*: Clearly communicate which policies are managed by API Governance to prevent manual changes. -* *Use Write-Enabled Credentials*: Ensure provider connections use credentials with write permissions to enable automated policy application and updates. +* *Use Write-Enabled Credentials*: Make sure that provider connections use credentials with write permissions to enable automated policy application and updates. * *Enable Automated Policy Strategies*: Use xref:exp-governance-create-strategy.adoc[Automated Policy strategies] to enforce policies at runtime rather than relying on manual application. * *Schedule Regular Conformance Reviews*: Review conformance dashboards regularly to detect and remediate drift before it becomes widespread. From 1b9af1cdb576a7dfd0c2d400cd244c960e3a28ad Mon Sep 17 00:00:00 2001 From: Luana Dos Santos Date: Mon, 13 Jul 2026 17:38:46 -0300 Subject: [PATCH 04/28] docs: align third-party governance topics with code and PRD scope Restructure the third-party provider governance topics so they match what ships in the code and the Jul 16 Policy Read GA scope: - Remove the policy-drift topic (not in code or PRD scope) - Comment out policy-write (Aug 13) content behind flags: Policy Library apply, read-only/credential-update flows, Policy Application Status - Fix conformance terminology (Conformant/Non-Conformant, not Compliant) - Flag the Gateway/Provider filter topic for PM scope confirmation Co-Authored-By: Claude Opus 4.8 --- ...eate-profiles-gateway-provider-filter.adoc | 14 ++- ...nce-cross-gateway-policy-audit-export.adoc | 91 ++++++++------ ...xp-governance-govern-third-party-apis.adoc | 49 ++++---- ...nce-monitor-cross-gateway-conformance.adoc | 35 +++--- .../exp-governance-policy-library-apply.adoc | 3 + ...overnance-setup-third-party-providers.adoc | 28 +++-- ...p-governance-third-party-policy-drift.adoc | 117 ------------------ 7 files changed, 127 insertions(+), 210 deletions(-) delete mode 100644 modules/ROOT/pages/exp-governance-third-party-policy-drift.adoc diff --git a/modules/ROOT/pages/exp-governance-create-profiles-gateway-provider-filter.adoc b/modules/ROOT/pages/exp-governance-create-profiles-gateway-provider-filter.adoc index 6288894c0..b51e4ede4 100644 --- a/modules/ROOT/pages/exp-governance-create-profiles-gateway-provider-filter.adoc +++ b/modules/ROOT/pages/exp-governance-create-profiles-gateway-provider-filter.adoc @@ -1,6 +1,8 @@ = Filter Governance Scope by Gateway or Provider :keywords: gateway filter, provider filter, governance scope, cross-gateway governance, third-party providers +// FLAG: SCOPE REVIEW NEEDED — PM confirmation before publishing. The Jul 16 PRD (policy read scope) scopes governance strategies by `environment` and `applied_at_level`, and STRIKES THROUGH `source_gateway` ("scope rulesets to specific providers"). The omni-app code confirms a Gateway/Provider *column* (conformance findings are attributed per gateway) but does NOT confirm a Gateway/Provider *filter* as a strategy-scoping control. This topic may describe a control that isn't in Jul 16 scope. Confirm with the PM whether provider-level strategy scoping ships for Jul 16; if not, hold or reframe this topic (the Gateway/Provider column content used elsewhere remains valid). + When creating a governance strategy, use the *Gateway/Provider* filter to target specific API gateway platforms or third-party providers. This filter enables unified governance across Anypoint Platform gateways and connected third-party provider platforms such as Akamai. == When the Gateway/Provider Filter Appears @@ -10,7 +12,7 @@ The *Gateway/Provider* filter appears in the governance strategy scope configura * Your organization has connected one or more third-party API gateway providers through *Platform* > *Providers*. * The connected providers have discovered APIs that are registered in the portfolio. -If no providers are connected, the filter doesn't appear, and the strategy applies only to Anypoint Platform-hosted APIs. +The filter appears only if you connect providers. Otherwise, the strategy applies only to Anypoint Platform-hosted APIs. == Before You Begin @@ -30,7 +32,7 @@ In the governance strategy creation workflow: -- ** *All Runtimes*: The strategy applies to all APIs across Anypoint Platform gateways and all connected third-party providers. ** *Anypoint Platform*: The strategy applies only to APIs hosted on Anypoint Platform gateways (Flex Gateway, Mule Gateway). -** *Third-Party Provider Names*: Select specific providers (such as *Akamai*) to limit the strategy to APIs hosted on those platforms. +** Individual provider: Select specific providers to limit the strategy to APIs hosted on those platforms. -- You can select multiple providers to govern APIs across a subset of platforms without including all runtimes. @@ -39,9 +41,9 @@ You can select multiple providers to govern APIs across a subset of platforms wi The *Gateway/Provider* filter narrows the governance scope to APIs hosted on the selected platforms: -* APIs that don't match the selected gateway or provider are excluded from the strategy, even if they match other scope criteria (such as tags or categories). +* APIs that don't match the selected gateway or provider are excluded from the strategy, even if they match other scope criteria, such as tags or categories. * If you select multiple providers, the strategy applies to APIs hosted on any of the selected platforms (OR logic). -* Combining the *Gateway/Provider* filter with other filters (Service Type, Tags, Categories) narrows the scope further. An API matches only when it satisfies all selected filters (AND logic). +* Combining the *Gateway/Provider* filter with other filters narrows the scope further. An API matches only when it satisfies all selected filters (AND logic). == Example: Govern Only Akamai APIs @@ -49,7 +51,7 @@ To create a governance strategy that applies only to APIs discovered from Akamai . In the *Define Governance Scope* step, expand the *Gateway/Provider* filter. . Select *Akamai* from the provider list. -. Configure other scope filters as needed (such as *Tags* or *Service Type*). +. Configure other scope filters as needed, such as *Tags* or *Service Type*. . Proceed through the strategy creation workflow. The resulting strategy applies only to APIs hosted on Akamai, as indicated in the *Gateway/Provider* column on the governance strategy dashboard. @@ -65,7 +67,7 @@ To create a governance strategy that applies across all gateway platforms: The strategy applies to all APIs across Anypoint Platform and all connected third-party providers. -== Related Topics +== See Also * xref:exp-governance-create-strategy.adoc[Create Governance Strategies] * xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] diff --git a/modules/ROOT/pages/exp-governance-cross-gateway-policy-audit-export.adoc b/modules/ROOT/pages/exp-governance-cross-gateway-policy-audit-export.adoc index dbc95a552..f6a7a5f98 100644 --- a/modules/ROOT/pages/exp-governance-cross-gateway-policy-audit-export.adoc +++ b/modules/ROOT/pages/exp-governance-cross-gateway-policy-audit-export.adoc @@ -1,17 +1,26 @@ = Export Cross-Gateway Policy Audit Reports :keywords: policy audit, cross-gateway reports, compliance reports, csv export, governance audit, soc 2, gdpr -Export governance strategy data to CSV to support compliance audits, stakeholder reviews, and regulatory reporting. The export includes policy application status, conformance data, and gateway/provider information for all APIs targeted by the strategy. +Export governance strategy data to CSV to support compliance audits, stakeholder reviews, and regulatory reporting. The export includes conformance data and gateway/provider information for all APIs targeted by the strategy. == Use Cases Export cross-gateway policy audit reports to: -* *SOC 2 Compliance Audits*: Demonstrate that policies are consistently applied and enforced across all gateway platforms. -* *GDPR Compliance Reporting*: Provide evidence that data privacy policies (such as PII masking) are applied to APIs across your organization. -* *Stakeholder Reviews*: Share governance posture with executives, compliance teams, or external auditors. -* *Trend Analysis*: Track policy application and conformance over time by exporting reports at regular intervals. -* *Incident Response*: Identify which APIs have policies in read-only mode during security or compliance incidents. +SOC 2 compliance audits:: +Demonstrate that policies are consistently applied and enforced across all gateway platforms. + +GDPR compliance reporting:: +Provide evidence that data privacy policies, such as PII masking, are applied to APIs across your organization. + +Stakeholder reviews:: +Share governance posture with executives, compliance teams, or external auditors. + +Trend analysis:: +Track policy application and conformance over time by exporting reports at regular intervals. + +Incident response:: +Identify which APIs are non-conformant during security or compliance incidents. == Before You Begin @@ -38,55 +47,65 @@ The exported CSV includes these columns: |=== |Column |Description -|*Organization ID* +|Organization ID |The unique identifier for your Anypoint Platform organization. -|*API ID* +|API ID |The unique identifier for the API. -|*API Version* +|API Version |The version of the API instance. -|*Gateway/Provider* -|The platform hosting the API (such as *Anypoint Platform*, *Akamai*, or other connected providers). +|Gateway/Provider +|The platform hosting the API (such as Anypoint Platform, Akamai, or other connected providers). -|*Applied Policies* +|Applied Policies |A list of policies applied to the API instance. -|*Policy Application Status* -|The enforcement state of each policy: - -* *Enabled*: The policy is actively enforced on the gateway. -* *Read-Only*: The policy is applied in monitoring mode only. +// FLAG: Aug 13 release (policy write scope). The "Policy Application Status" column (Enabled/Read-Only enforcement state) reflects policy enforcement, which is Policy Write — GA Aug 13. Uncomment when the Aug 13 write release is documented. +// |Policy Application Status +// |The enforcement state of each policy: +// +// * *Enabled*: The policy is actively enforced on the gateway. +// * *Read-Only*: The policy is applied in monitoring mode only. -|*Conformance Status* -|Whether the API complies with the governance strategy's control rules or automated policies: +|Conformance Status +|Whether the API conforms to the governance strategy's control rules or automated policies: -* *Compliant*: The API meets all requirements. -* *Non-Compliant*: The API fails one or more requirements. +* *Conformant*: The API meets all requirements. +* *Non-Conformant*: The API fails one or more requirements. -|*Timestamp* +|Timestamp |The date and time when the strategy last evaluated the API. |=== -== Understanding Read-Only Entries +// FLAG: Aug 13 release (policy write scope). The entire "Understanding Read-Only Entries" section describes policy enforcement state and credential-based write access, which is Policy Write — GA Aug 13. Uncomment when the Aug 13 write release is documented. +// == Understanding Read-Only Entries +// +// If the Policy Application Status column shows *Read-Only*: +// +// * The provider connection uses credentials with read-only permissions. +// * Policies are applied in monitoring mode and don't enforce requirements on the provider gateway. +// * Conformance data is available, but policy violations aren't automatically remediated. +// +// To enforce these policies on the provider gateway, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update provider credentials] to grant write-enabled permissions. After updating credentials, re-export the report to verify that policies transition to *Enabled* status. -If the *Policy Application Status* column shows *Read-Only*: +== Analyze Exported Data -* The provider connection uses credentials with read-only permissions. -* Policies are applied in monitoring mode and don't enforce requirements on the provider gateway. -* Conformance data is available, but policy violations aren't automatically remediated. +Use the exported CSV to: -*How to Remediate*: xref:exp-governance-setup-third-party-providers.adoc#update-credentials[Update provider credentials] to grant write-enabled permissions. After updating credentials, re-export the report to verify that policies transition to *Enabled* status. +// FLAG: Aug 13 release (policy write scope). "Identify read-only policies" depends on the Policy Application Status enforcement column, which is Policy Write — GA Aug 13. Uncomment when the Aug 13 write release is documented. +// Identify read-only policies:: +// Filter the Policy Application Status column for *Read-Only* entries to find APIs where policies aren't fully enforced. -== Analyze Exported Data +Compare providers:: +Group by the Gateway/Provider column to compare conformance across Anypoint Platform and third-party providers. -Use the exported CSV to: +Track non-conformant APIs:: +Filter by Conformance Status to identify APIs that fail conformance checks. -* *Identify Read-Only Policies*: Filter the *Policy Application Status* column for *Read-Only* entries to find APIs where policies aren't fully enforced. -* *Compare Providers*: Group by the *Gateway/Provider* column to compare conformance across Anypoint Platform and third-party providers. -* *Track Non-Compliant APIs*: Filter by *Conformance Status* to identify APIs that fail compliance checks. -* *Audit Policy Coverage*: Review the *Applied Policies* column to verify that required policies are applied to all targeted APIs. +Audit policy coverage:: +Review the Applied Policies column to verify that required policies are applied to all targeted APIs. Import the CSV into spreadsheet software, BI tools, or compliance management platforms for deeper analysis. @@ -94,13 +113,13 @@ Import the CSV into spreadsheet software, BI tools, or compliance management pla For ongoing compliance tracking: -* Export reports at regular intervals (such as monthly or quarterly). +* Export reports at regular intervals, such as monthly or quarterly. * Compare exports over time to track conformance improvements or regressions. * Share reports with compliance teams as part of your organization's governance review process. Regular exports help you maintain audit readiness and demonstrate continuous compliance. -== Related Topics +== See ALso * xref:exp-governance-monitor-cross-gateway-conformance.adoc[Monitor Cross-Gateway Conformance] * xref:exp-governance-create-strategy.adoc[Create Governance Strategies] diff --git a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc index 735b06b5e..96c5f2d31 100644 --- a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc +++ b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc @@ -15,7 +15,8 @@ Follow these steps to govern APIs from third-party providers: . *Monitor Conformance*: Track conformance status for provider-hosted APIs through the governance strategy dashboard. Filter by specific providers to focus on a subset of your cross-gateway environment. -. *Apply Policies*: For targeted or supplemental policy application, use xref:exp-governance-policy-library-apply.adoc[Policy Library] to select and apply policies directly to provider-hosted API instances. +// FLAG: Aug 13 release (policy write scope). The "Apply Policies" workflow step applies policies directly to provider-hosted instances, which is Policy Write (GA Aug 13). The Jul 16 release governs third-party APIs in read/conformance mode only. Uncomment when the Aug 13 write release is documented. +// . *Apply Policies*: For targeted or supplemental policy application, use xref:exp-governance-policy-library-apply.adoc[Policy Library] to select and apply policies directly to provider-hosted API instances. . *Export Reports*: Export cross-gateway policy and conformance reports to CSV for compliance audits and stakeholder reviews. @@ -37,23 +38,25 @@ Monitor conformance across multiple gateway platforms: . Review the conformance summary. The *Gateway/Provider* column shows which platform hosts each API. . Use the *Gateway/Provider* filter to focus on conformance for a specific provider. -*Read-Only Policy Status*: If a policy shows *Read-Only* status, the provider connection uses read-only credentials. To enable policy writes, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update the credentials] with write-enabled permissions. - -== Policy Library for Third-Party APIs - -The xref:exp-governance-policy-library-apply.adoc[Policy Library] provides a targeted way to apply individual policies to third-party provider services: - -. Go to *Governance* > *Governance Strategies* > *Policy Library*. -. Complete the four-step wizard: -+ --- -** *Select Policy*: Choose from Universal, Access and Security, Performance and Cost, Data Privacy and Integrity, or Compliance and Observability categories. -** *Configure Policy*: Set policy parameters. -** *Select Instances*: Choose API instances hosted on third-party providers. -** *Review & Apply*: Confirm and apply the policy. --- - -Use the Policy Library when you need supplemental or one-off policy application outside governance strategies. +// FLAG: Aug 13 release (policy write scope). "Read-Only Policy Status" and the credential-update-to-enable-writes flow describe Policy Write (GA Aug 13). Uncomment when the Aug 13 write release is documented. +// *Read-Only Policy Status*: If a policy shows *Read-Only* status, the provider connection uses read-only credentials. To enable policy writes, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update the credentials] with write-enabled permissions. + +// FLAG: Aug 13 release (policy write scope). The entire "Policy Library for Third-Party APIs" section applies policies to provider instances, which is Policy Write (GA Aug 13), not Jul 16 Policy Read. Uncomment when the Aug 13 write release is documented. +// == Policy Library for Third-Party APIs +// +// The xref:exp-governance-policy-library-apply.adoc[Policy Library] provides a targeted way to apply individual policies to third-party provider services: +// +// . Go to *Governance* > *Governance Strategies* > *Policy Library*. +// . Complete the four-step wizard: +// + +// -- +// ** *Select Policy*: Choose from Universal, Access and Security, Performance and Cost, Data Privacy and Integrity, or Compliance and Observability categories. +// ** *Configure Policy*: Set policy parameters. +// ** *Select Instances*: Choose API instances hosted on third-party providers. +// ** *Review & Apply*: Confirm and apply the policy. +// -- +// +// Use the Policy Library when you need supplemental or one-off policy application outside governance strategies. == Export Cross-Gateway Reports @@ -70,16 +73,18 @@ The CSV includes: * API Version * Gateway/Provider * Applied policies -* Policy Application Status (Enabled or Read-Only) * Conformance status * Timestamp - -Read-Only entries indicate that policies are applied in monitoring mode only. To enable write access, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update provider credentials]. +// FLAG: Aug 13 release (policy write scope). The "Policy Application Status (Enabled or Read-Only)" column and the read-only/write-access note describe policy enforcement state, which is Policy Write (GA Aug 13). Uncomment when the Aug 13 write release is documented. +// * Policy Application Status (Enabled or Read-Only) +// +// Read-Only entries indicate that policies are applied in monitoring mode only. To enable write access, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update provider credentials]. == Related Topics * xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] * xref:exp-governance-create-strategy.adoc[Create Governance Strategies] -* xref:exp-governance-policy-library-apply.adoc[Apply Policies via Policy Library] +// FLAG: Aug 13 release (policy write scope). Link to the Policy Library apply topic, which is commented out until the Aug 13 write release. Uncomment together with that topic. +// * xref:exp-governance-policy-library-apply.adoc[Apply Policies via Policy Library] * xref:exp-governance-monitor-cross-gateway-conformance.adoc[Monitor Cross-Gateway Conformance] * xref:exp-governance-cross-gateway-policy-audit-export.adoc[Export Cross-Gateway Policy Audit Reports] diff --git a/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc index 3b597b453..2b50d592c 100644 --- a/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc +++ b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc @@ -1,7 +1,7 @@ = Monitor Cross-Gateway Conformance :keywords: cross-gateway conformance, provider conformance, governance monitoring, compliance tracking, multi-gateway governance -After creating governance strategies that target multiple gateway platforms or third-party providers, monitor conformance across your entire API ecosystem through a unified dashboard. The conformance summary shows compliance status for APIs hosted on Anypoint Platform gateways and connected third-party providers. +After creating governance strategies that target multiple gateway platforms or third-party providers, monitor conformance across your entire API ecosystem through a unified dashboard. The conformance summary shows conformance status for APIs hosted on Anypoint Platform gateways and connected third-party providers. == Before You Begin @@ -19,10 +19,11 @@ Before monitoring cross-gateway conformance: The dashboard displays: -* *Conformance Status*: The percentage of targeted APIs that comply with the strategy's control rules or automated policies. -* *Gateway/Provider Column*: Shows which platform hosts each API (such as *Anypoint Platform*, *Akamai*, or other connected providers). -* *Compliant vs. Non-Compliant APIs*: A breakdown of APIs that meet or fail the strategy's requirements. -* *Policy Application Status*: Indicates whether policies are *Enabled* (actively enforced) or *Read-Only* (monitoring mode only). +* *Conformance Status*: The percentage of targeted APIs that conform to the strategy's control rules or automated policies. +* Gateway/Provider column: Shows which platform hosts each API (such as Anypoint Platform, Akamai, or other connected providers). +* Conformant vs. Non-Conformant APIs: A breakdown of APIs that meet or fail the strategy's requirements. +// FLAG: Aug 13 release (policy write scope). "Policy Application Status" (Enabled/Read-Only enforcement state) reflects policy enforcement, which is Policy Write — GA Aug 13. Uncomment when the Aug 13 write release is documented. +// * *Policy Application Status*: Indicates whether policies are *Enabled* (actively enforced) or *Read-Only* (monitoring mode only). == Filter by Specific Provider @@ -39,22 +40,23 @@ Use this filter to: * Identify provider-specific compliance gaps. * Focus on a subset of your multi-gateway environment during reviews or audits. -== Understanding Read-Only Policy Status - -If a policy shows *Read-Only* status in the conformance dashboard: - -* The provider connection uses credentials with read-only permissions. -* Policies are applied in monitoring mode only and don't enforce requirements on the provider gateway. -* The system can track conformance but can't automatically remediate violations. - -*How to Remediate*: xref:exp-governance-setup-third-party-providers.adoc#update-credentials[Update provider credentials] to grant write-enabled permissions. After updating credentials, policies transition from *Read-Only* to *Enabled* status and can enforce requirements on the provider gateway. +// FLAG: Aug 13 release (policy write scope). The entire "Understanding Read-Only Policy Status" section describes policy enforcement and credential-based write access, which is Policy Write — GA Aug 13. The Jul 16 Policy Read GA monitors conformance in read-only mode only. Uncomment when the Aug 13 write release is documented. +// == Understanding Read-Only Policy Status +// +// If a policy shows *Read-Only* status in the conformance dashboard: +// +// * The provider connection uses credentials with read-only permissions. +// * Policies are applied in monitoring mode only and don't enforce requirements on the provider gateway. +// * The system can track conformance but can't automatically remediate violations. +// +// *How to Remediate*: xref:exp-governance-setup-third-party-providers.adoc#update-credentials[Update provider credentials] to grant write-enabled permissions. After updating credentials, policies transition from *Read-Only* to *Enabled* status and can enforce requirements on the provider gateway. == Monitor Conformance Over Time Track conformance trends to identify improvements or regressions: . Select a governance strategy from the dashboard. -. Review the *Conformance History* chart (if available) to see how compliance has changed over time. +. Review the *Conformance History* chart (if available) to see how conformance has changed over time. . Use the *Gateway/Provider* filter to compare trends across platforms. Regular monitoring helps you: @@ -68,7 +70,8 @@ Regular monitoring helps you: To share conformance data with stakeholders or include it in compliance audits: . From the governance strategy dashboard, select *Export to CSV*. -. The CSV includes conformance status, Gateway/Provider, applied policies, and policy application status for each API. +// FLAG: Aug 13 release (policy write scope). "policy application status" reflects enforcement state (Enabled/Read-Only), which is Policy Write — GA Aug 13. For Jul 16, the CSV covers read/conformance data only. Restore the fuller list when the Aug 13 write release is documented. +. The CSV includes conformance status, Gateway/Provider, and applied policies for each API. For more information about the CSV schema and how to use exported reports, see xref:exp-governance-cross-gateway-policy-audit-export.adoc[Export Cross-Gateway Policy Audit Reports]. diff --git a/modules/ROOT/pages/exp-governance-policy-library-apply.adoc b/modules/ROOT/pages/exp-governance-policy-library-apply.adoc index db8b1412c..60598496e 100644 --- a/modules/ROOT/pages/exp-governance-policy-library-apply.adoc +++ b/modules/ROOT/pages/exp-governance-policy-library-apply.adoc @@ -1,6 +1,8 @@ = Apply Policies via Policy Library :keywords: policy library, apply policies, policy enforcement, targeted policies, governance policies +// FLAG: Aug 13 release (policy write scope). This entire topic documents applying policies to API instances (including third-party provider instances), which is Policy Write — GA Aug 13. It is out of scope for the Jul 16 Policy Read GA. The topic body is commented out below; uncomment when the Aug 13 write release is documented. Note: for MuleSoft-native and Kong instances, policy application already ships, but cross-gateway apply as described here aligns with the Aug 13 milestone — confirm scope with the PM before publishing. +//// The Policy Library provides a wizard-driven workflow to apply individual policies directly to selected API instances. Use the Policy Library for targeted or supplemental policy application when you want more control than governance strategies provide. == When to Use the Policy Library @@ -119,3 +121,4 @@ If the policy is in read-only mode and you want enforcement, xref:exp-governance * xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] * xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs] * xref:exp-services-view-details.adoc[View Service Details] +//// diff --git a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc index da40fe39a..5dbf87268 100644 --- a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc +++ b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc @@ -66,8 +66,9 @@ Enter the required authentication credentials for your provider account. The spe ** *Client Credentials*: Enter client ID and client secret. -- -*Read-Only Access*:: -If your credentials have read-only permissions, the system can discover APIs and monitor conformance but can't apply policies directly to the provider gateway. Use xref:exp-governance-policy-library-apply.adoc[Policy Library] to apply policies in read-only mode, or update credentials later to enable write access. +// FLAG: Aug 13 release (policy write scope). This "Read-Only Access" note describes applying policies to a provider gateway, which is Policy Write (GA Aug 13), not Jul 16 Policy Read. Uncomment when the Aug 13 write release is documented. +// *Read-Only Access*:: +// If your credentials have read-only permissions, the system can discover APIs and monitor conformance but can't apply policies directly to the provider gateway. Use xref:exp-governance-policy-library-apply.adoc[Policy Library] to apply policies in read-only mode, or update credentials later to enable write access. Select *Connect* to establish the connection. @@ -79,17 +80,18 @@ After you connect to a provider: * *API Discovery*: The scanner begins discovering APIs hosted on the provider platform. Discovered APIs appear in *Portfolio Overview* with the provider name in the *Gateway/Provider* column. * *Akamai Correlation Policy*: For Akamai providers, the system automatically applies a correlation policy to discovered APIs to enable cross-gateway observability and governance. -== Update Credentials - -If your initial credentials were read-only and you want to enable policy application: - -. Go to *Platform* > *Providers*. -. Locate your provider connection and select *Edit*. -. Select *Update Credentials*. -. Enter credentials with write permissions. -. Select *Save*. - -After updating to write-enabled credentials, you can apply policies directly to APIs on the provider gateway through governance strategies or the xref:exp-governance-policy-library-apply.adoc[Policy Library]. +// FLAG: Aug 13 release (policy write scope). This "Update Credentials" section describes enabling write-enabled credentials to apply policies to a provider gateway. Policy Write is GA Aug 13; the Jul 16 release is read/conformance only (except Kong, which already ships read+apply). Uncomment when the Aug 13 write release is documented. +// == Update Credentials +// +// If your initial credentials were read-only and you want to enable policy application: +// +// . Go to *Platform* > *Providers*. +// . Locate your provider connection and select *Edit*. +// . Select *Update Credentials*. +// . Enter credentials with write permissions. +// . Select *Save*. +// +// After updating to write-enabled credentials, you can apply policies directly to APIs on the provider gateway through governance strategies or the xref:exp-governance-policy-library-apply.adoc[Policy Library]. == Related Topics diff --git a/modules/ROOT/pages/exp-governance-third-party-policy-drift.adoc b/modules/ROOT/pages/exp-governance-third-party-policy-drift.adoc deleted file mode 100644 index 84ef184fd..000000000 --- a/modules/ROOT/pages/exp-governance-third-party-policy-drift.adoc +++ /dev/null @@ -1,117 +0,0 @@ -= Find and Fix Policy Drift on Third-Party API Instances -:keywords: policy drift, third-party apis, conformance, policy detection, governance drift, provider compliance - -Policy drift occurs when the policies applied on a third-party API gateway instance differ from the policies defined in your governance strategy. API Governance detects policy drift for APIs hosted on Kong, Apigee, AWS API Gateway, and Akamai so that you can identify and remediate configuration inconsistencies across your multi-gateway environment. - -== What Is Policy Drift? - -Policy drift happens when: - -* A policy defined in your governance strategy isn't applied to a third-party gateway instance. -* A policy applied on the gateway is modified or removed outside API Governance. -* Policy parameters on the gateway instance don't match the configuration defined in your governance strategy. - -Policy drift can occur due to: - -* Manual changes made directly on the third-party gateway console. -* Automated configuration management tools that modify gateway policies. -* Policy application failures that aren't detected or remediated. -* Credential or permission issues that prevent API Governance from applying policies. - -Detecting and fixing policy drift keeps your governance policies consistently enforced across all gateway platforms. - -== Before You Begin - -Before detecting policy drift: - -* xref:exp-governance-setup-third-party-providers.adoc[Connect to one or more third-party providers] to enable cross-gateway governance. -* xref:exp-governance-create-strategy.adoc[Create a governance strategy] that targets third-party provider APIs using the xref:exp-governance-create-profiles-gateway-provider-filter.adoc[Gateway/Provider filter]. -* Verify that the strategy is active and has evaluated the targeted APIs. - -== Detect Policy Drift - -. Log in and go to *Governance* > *Governance Strategies*. -. Select an active strategy that targets third-party provider APIs. -. Review the conformance dashboard for APIs with *Non-Compliant* status. -. Select a non-compliant API to view details. - -The API detail view shows: - -* *Expected Policies*: Policies defined in the governance strategy to apply to the instance. -* *Applied Policies*: Policies currently applied on the third-party gateway instance. -* *Drift Indicators*: Highlights where expected and applied policies differ. - -Drift indicators include: - -* *Missing Policy*: A policy defined in the strategy isn't applied on the gateway. -* *Extra Policy*: A policy applied on the gateway is not defined in the strategy. -* *Configuration Mismatch*: A policy is applied but its parameters differ from the strategy definition. - -== Fix Policy Drift Using Policy Library - -To remediate policy drift, use xref:exp-governance-policy-library-apply.adoc[Policy Library] to apply or update policies directly on third-party gateway instances: - -. Go to *Governance* > *Governance Strategies* > *Policy Library*. -. Select *Apply Policy* to start the policy application wizard. -. In the *Select Policy* step, choose the policy that is missing or misconfigured on the gateway. -. In the *Configure Policy* step, enter the correct policy parameters to match your governance strategy definition. -. In the *Select Instances* step, choose the third-party API instances where policy drift was detected. -. Review the summary and select *Apply*. - -After applying the policy, return to the conformance dashboard to verify that the API transitions to *Compliant* status. - -== Update Scanner Credentials for Programmatic Policy Application - -If policy drift persists or you see *Read-Only* status indicators, your provider connection might use read-only credentials that prevent programmatic policy application. - -To enable write access: - -. Go to *Platform* > *Providers*. -. Locate the provider connection for your third-party gateway. -. Select *Edit* > *Update Credentials*. -. Enter credentials with write-enabled permissions for the gateway API. -. Select *Save*. - -After updating credentials: - -* Policies transition from *Read-Only* to *Enabled* status. -* API Governance can programmatically apply and update policies on the gateway. -* Policy drift detection continues, but remediation becomes automated through governance strategies. - -== Monitor Policy Drift Over Time - -To track policy drift trends: - -. xref:exp-governance-monitor-cross-gateway-conformance.adoc[Monitor cross-gateway conformance] regularly to identify APIs with recurring drift. -. xref:exp-governance-cross-gateway-policy-audit-export.adoc[Export conformance reports to CSV] at regular intervals to track drift patterns over time. -. Compare exports to identify: -+ --- -** APIs with frequent policy drift (potential for manual gateway changes). -** Providers with higher drift rates (a sign of integration or credential issues). -** Policy types that commonly drift (a sign that additional controls or documentation are needed). --- - -Regular monitoring helps you: - -* Identify root causes of policy drift (such as manual changes by gateway admins). -* Implement preventive controls (such as restricting direct gateway access or documenting governance-managed policies). -* Demonstrate governance effectiveness during compliance audits. - -== Prevent Policy Drift - -To reduce policy drift: - -* *Restrict Direct Gateway Access*: Limit who can modify policies directly on third-party gateway consoles. -* *Document Governance-Managed Policies*: Clearly communicate which policies are managed by API Governance to prevent manual changes. -* *Use Write-Enabled Credentials*: Make sure that provider connections use credentials with write permissions to enable automated policy application and updates. -* *Enable Automated Policy Strategies*: Use xref:exp-governance-create-strategy.adoc[Automated Policy strategies] to enforce policies at runtime rather than relying on manual application. -* *Schedule Regular Conformance Reviews*: Review conformance dashboards regularly to detect and remediate drift before it becomes widespread. - -== Related Topics - -* xref:exp-governance-monitor-cross-gateway-conformance.adoc[Monitor Cross-Gateway Conformance] -* xref:exp-governance-policy-library-apply.adoc[Apply Policies via Policy Library] -* xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] -* xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs] -* xref:exp-governance-create-strategy.adoc[Create Governance Strategies] From fbf4e3ce05bd61ba3e08285ed2f3a4b6410843f0 Mon Sep 17 00:00:00 2001 From: Luana Dos Santos Date: Mon, 13 Jul 2026 18:14:40 -0300 Subject: [PATCH 05/28] docs: remove CSV export content not in code or Jul 16 PRD Neither the omni-app code nor the Jul 16 Policy Read PRD includes an "Export to CSV" feature for governance strategies or conformance data. The PRD's "conformance report" is an on-screen evaluation, not a downloadable artifact. - Delete the standalone Export Cross-Gateway Policy Audit Reports topic - Remove the Export Reports step and Export Cross-Gateway Reports section from the govern topic, plus the dangling xref - Remove the Export Conformance Reports section from the monitor topic, plus the dangling xref Co-Authored-By: Claude Opus 4.8 --- ...nce-cross-gateway-policy-audit-export.adoc | 127 ------------------ ...xp-governance-govern-third-party-apis.adoc | 25 ---- ...nce-monitor-cross-gateway-conformance.adoc | 11 -- 3 files changed, 163 deletions(-) delete mode 100644 modules/ROOT/pages/exp-governance-cross-gateway-policy-audit-export.adoc diff --git a/modules/ROOT/pages/exp-governance-cross-gateway-policy-audit-export.adoc b/modules/ROOT/pages/exp-governance-cross-gateway-policy-audit-export.adoc deleted file mode 100644 index f6a7a5f98..000000000 --- a/modules/ROOT/pages/exp-governance-cross-gateway-policy-audit-export.adoc +++ /dev/null @@ -1,127 +0,0 @@ -= Export Cross-Gateway Policy Audit Reports -:keywords: policy audit, cross-gateway reports, compliance reports, csv export, governance audit, soc 2, gdpr - -Export governance strategy data to CSV to support compliance audits, stakeholder reviews, and regulatory reporting. The export includes conformance data and gateway/provider information for all APIs targeted by the strategy. - -== Use Cases - -Export cross-gateway policy audit reports to: - -SOC 2 compliance audits:: -Demonstrate that policies are consistently applied and enforced across all gateway platforms. - -GDPR compliance reporting:: -Provide evidence that data privacy policies, such as PII masking, are applied to APIs across your organization. - -Stakeholder reviews:: -Share governance posture with executives, compliance teams, or external auditors. - -Trend analysis:: -Track policy application and conformance over time by exporting reports at regular intervals. - -Incident response:: -Identify which APIs are non-conformant during security or compliance incidents. - -== Before You Begin - -Before exporting a report: - -* xref:exp-governance-create-strategy.adoc[Create a governance strategy] that targets the APIs you want to report on. -* Verify that the strategy is active and has evaluated the targeted APIs. -* For cross-gateway reports, make sure that xref:exp-governance-setup-third-party-providers.adoc[third-party providers are connected] and have discovered APIs. - -== Export a Governance Strategy Report - -. Log in and go to *Governance* > *Governance Strategies*. -. Select the governance strategy you want to report on. -. Select *Export to CSV*. -. The CSV file downloads to your local machine. - -The export includes all APIs targeted by the selected strategy, along with their conformance status and policy application details. - -== CSV Report Schema - -The exported CSV includes these columns: - -[cols="1,3"] -|=== -|Column |Description - -|Organization ID -|The unique identifier for your Anypoint Platform organization. - -|API ID -|The unique identifier for the API. - -|API Version -|The version of the API instance. - -|Gateway/Provider -|The platform hosting the API (such as Anypoint Platform, Akamai, or other connected providers). - -|Applied Policies -|A list of policies applied to the API instance. - -// FLAG: Aug 13 release (policy write scope). The "Policy Application Status" column (Enabled/Read-Only enforcement state) reflects policy enforcement, which is Policy Write — GA Aug 13. Uncomment when the Aug 13 write release is documented. -// |Policy Application Status -// |The enforcement state of each policy: -// -// * *Enabled*: The policy is actively enforced on the gateway. -// * *Read-Only*: The policy is applied in monitoring mode only. - -|Conformance Status -|Whether the API conforms to the governance strategy's control rules or automated policies: - -* *Conformant*: The API meets all requirements. -* *Non-Conformant*: The API fails one or more requirements. - -|Timestamp -|The date and time when the strategy last evaluated the API. -|=== - -// FLAG: Aug 13 release (policy write scope). The entire "Understanding Read-Only Entries" section describes policy enforcement state and credential-based write access, which is Policy Write — GA Aug 13. Uncomment when the Aug 13 write release is documented. -// == Understanding Read-Only Entries -// -// If the Policy Application Status column shows *Read-Only*: -// -// * The provider connection uses credentials with read-only permissions. -// * Policies are applied in monitoring mode and don't enforce requirements on the provider gateway. -// * Conformance data is available, but policy violations aren't automatically remediated. -// -// To enforce these policies on the provider gateway, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update provider credentials] to grant write-enabled permissions. After updating credentials, re-export the report to verify that policies transition to *Enabled* status. - -== Analyze Exported Data - -Use the exported CSV to: - -// FLAG: Aug 13 release (policy write scope). "Identify read-only policies" depends on the Policy Application Status enforcement column, which is Policy Write — GA Aug 13. Uncomment when the Aug 13 write release is documented. -// Identify read-only policies:: -// Filter the Policy Application Status column for *Read-Only* entries to find APIs where policies aren't fully enforced. - -Compare providers:: -Group by the Gateway/Provider column to compare conformance across Anypoint Platform and third-party providers. - -Track non-conformant APIs:: -Filter by Conformance Status to identify APIs that fail conformance checks. - -Audit policy coverage:: -Review the Applied Policies column to verify that required policies are applied to all targeted APIs. - -Import the CSV into spreadsheet software, BI tools, or compliance management platforms for deeper analysis. - -== Schedule Regular Exports - -For ongoing compliance tracking: - -* Export reports at regular intervals, such as monthly or quarterly. -* Compare exports over time to track conformance improvements or regressions. -* Share reports with compliance teams as part of your organization's governance review process. - -Regular exports help you maintain audit readiness and demonstrate continuous compliance. - -== See ALso - -* xref:exp-governance-monitor-cross-gateway-conformance.adoc[Monitor Cross-Gateway Conformance] -* xref:exp-governance-create-strategy.adoc[Create Governance Strategies] -* xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] -* xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs] diff --git a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc index 96c5f2d31..cc09f3d04 100644 --- a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc +++ b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc @@ -18,8 +18,6 @@ Follow these steps to govern APIs from third-party providers: // FLAG: Aug 13 release (policy write scope). The "Apply Policies" workflow step applies policies directly to provider-hosted instances, which is Policy Write (GA Aug 13). The Jul 16 release governs third-party APIs in read/conformance mode only. Uncomment when the Aug 13 write release is documented. // . *Apply Policies*: For targeted or supplemental policy application, use xref:exp-governance-policy-library-apply.adoc[Policy Library] to select and apply policies directly to provider-hosted API instances. -. *Export Reports*: Export cross-gateway policy and conformance reports to CSV for compliance audits and stakeholder reviews. - == Gateway/Provider Filter When creating a governance strategy, use the *Gateway/Provider* filter to target third-party provider APIs: @@ -58,28 +56,6 @@ Monitor conformance across multiple gateway platforms: // // Use the Policy Library when you need supplemental or one-off policy application outside governance strategies. -== Export Cross-Gateway Reports - -Export policy and conformance data for compliance audits: - -. Go to *Governance* > *Governance Strategies*. -. Select the strategy you want to report on. -. Select *Export to CSV*. - -The CSV includes: - -* Organization ID -* API ID -* API Version -* Gateway/Provider -* Applied policies -* Conformance status -* Timestamp -// FLAG: Aug 13 release (policy write scope). The "Policy Application Status (Enabled or Read-Only)" column and the read-only/write-access note describe policy enforcement state, which is Policy Write (GA Aug 13). Uncomment when the Aug 13 write release is documented. -// * Policy Application Status (Enabled or Read-Only) -// -// Read-Only entries indicate that policies are applied in monitoring mode only. To enable write access, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update provider credentials]. - == Related Topics * xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] @@ -87,4 +63,3 @@ The CSV includes: // FLAG: Aug 13 release (policy write scope). Link to the Policy Library apply topic, which is commented out until the Aug 13 write release. Uncomment together with that topic. // * xref:exp-governance-policy-library-apply.adoc[Apply Policies via Policy Library] * xref:exp-governance-monitor-cross-gateway-conformance.adoc[Monitor Cross-Gateway Conformance] -* xref:exp-governance-cross-gateway-policy-audit-export.adoc[Export Cross-Gateway Policy Audit Reports] diff --git a/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc index 2b50d592c..9b216e0b9 100644 --- a/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc +++ b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc @@ -65,20 +65,9 @@ Regular monitoring helps you: * Measure the impact of policy changes or governance strategy adjustments. * Demonstrate compliance improvements to stakeholders during audits. -== Export Conformance Reports - -To share conformance data with stakeholders or include it in compliance audits: - -. From the governance strategy dashboard, select *Export to CSV*. -// FLAG: Aug 13 release (policy write scope). "policy application status" reflects enforcement state (Enabled/Read-Only), which is Policy Write — GA Aug 13. For Jul 16, the CSV covers read/conformance data only. Restore the fuller list when the Aug 13 write release is documented. -. The CSV includes conformance status, Gateway/Provider, and applied policies for each API. - -For more information about the CSV schema and how to use exported reports, see xref:exp-governance-cross-gateway-policy-audit-export.adoc[Export Cross-Gateway Policy Audit Reports]. - == Related Topics * xref:exp-governance-create-strategy.adoc[Create Governance Strategies] * xref:exp-governance-create-profiles-gateway-provider-filter.adoc[Filter Governance Scope by Gateway or Provider] * xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] -* xref:exp-governance-cross-gateway-policy-audit-export.adoc[Export Cross-Gateway Policy Audit Reports] * xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs] From 8b9f57f99ac6c28c414b57914670fe2133c3ea19 Mon Sep 17 00:00:00 2001 From: Luana Dos Santos Date: Mon, 13 Jul 2026 18:51:56 -0300 Subject: [PATCH 06/28] docs: remove provider-scoping filter topic; fix Provider label The "Gateway/Provider filter" as a strategy-scoping control isn't in the code, and the Jul 16 PRD strikes through source_gateway (provider-level scoping), scoping strategies by environment and applied_at_level instead. The literal label "Gateway/Provider" doesn't exist in the product; the real labels are "Provider" (column) and the provider view filter. - Delete the gateway/provider filter topic and its xrefs - Remove strategy-scoping-by-provider prose from the govern and monitor topics (including the incorrect "All Runtimes = all providers" claim) - Relabel the real conformance-view column and filter to "Provider" Co-Authored-By: Claude Opus 4.8 --- ...eate-profiles-gateway-provider-filter.adoc | 75 ------------------- ...xp-governance-govern-third-party-apis.adoc | 21 ++---- ...nce-monitor-cross-gateway-conformance.adoc | 15 ++-- .../exp-governance-policy-library-apply.adoc | 2 +- ...overnance-setup-third-party-providers.adoc | 2 +- 5 files changed, 15 insertions(+), 100 deletions(-) delete mode 100644 modules/ROOT/pages/exp-governance-create-profiles-gateway-provider-filter.adoc diff --git a/modules/ROOT/pages/exp-governance-create-profiles-gateway-provider-filter.adoc b/modules/ROOT/pages/exp-governance-create-profiles-gateway-provider-filter.adoc deleted file mode 100644 index b51e4ede4..000000000 --- a/modules/ROOT/pages/exp-governance-create-profiles-gateway-provider-filter.adoc +++ /dev/null @@ -1,75 +0,0 @@ -= Filter Governance Scope by Gateway or Provider -:keywords: gateway filter, provider filter, governance scope, cross-gateway governance, third-party providers - -// FLAG: SCOPE REVIEW NEEDED — PM confirmation before publishing. The Jul 16 PRD (policy read scope) scopes governance strategies by `environment` and `applied_at_level`, and STRIKES THROUGH `source_gateway` ("scope rulesets to specific providers"). The omni-app code confirms a Gateway/Provider *column* (conformance findings are attributed per gateway) but does NOT confirm a Gateway/Provider *filter* as a strategy-scoping control. This topic may describe a control that isn't in Jul 16 scope. Confirm with the PM whether provider-level strategy scoping ships for Jul 16; if not, hold or reframe this topic (the Gateway/Provider column content used elsewhere remains valid). - -When creating a governance strategy, use the *Gateway/Provider* filter to target specific API gateway platforms or third-party providers. This filter enables unified governance across Anypoint Platform gateways and connected third-party provider platforms such as Akamai. - -== When the Gateway/Provider Filter Appears - -The *Gateway/Provider* filter appears in the governance strategy scope configuration step when: - -* Your organization has connected one or more third-party API gateway providers through *Platform* > *Providers*. -* The connected providers have discovered APIs that are registered in the portfolio. - -The filter appears only if you connect providers. Otherwise, the strategy applies only to Anypoint Platform-hosted APIs. - -== Before You Begin - -Before using the Gateway/Provider filter: - -* xref:exp-governance-setup-third-party-providers.adoc[Connect to one or more third-party providers] to enable cross-gateway governance. -* Verify that the connected providers have discovered APIs by checking *Portfolio Overview* for entries with the provider name in the *Gateway/Provider* column. - -== Select Gateway or Provider - -In the governance strategy creation workflow: - -. Go to the *Define Governance Scope* step. -. Expand the *Gateway/Provider* filter. -. Select one or more options: -+ --- -** *All Runtimes*: The strategy applies to all APIs across Anypoint Platform gateways and all connected third-party providers. -** *Anypoint Platform*: The strategy applies only to APIs hosted on Anypoint Platform gateways (Flex Gateway, Mule Gateway). -** Individual provider: Select specific providers to limit the strategy to APIs hosted on those platforms. --- - -You can select multiple providers to govern APIs across a subset of platforms without including all runtimes. - -== How the Filter Works - -The *Gateway/Provider* filter narrows the governance scope to APIs hosted on the selected platforms: - -* APIs that don't match the selected gateway or provider are excluded from the strategy, even if they match other scope criteria, such as tags or categories. -* If you select multiple providers, the strategy applies to APIs hosted on any of the selected platforms (OR logic). -* Combining the *Gateway/Provider* filter with other filters narrows the scope further. An API matches only when it satisfies all selected filters (AND logic). - -== Example: Govern Only Akamai APIs - -To create a governance strategy that applies only to APIs discovered from Akamai: - -. In the *Define Governance Scope* step, expand the *Gateway/Provider* filter. -. Select *Akamai* from the provider list. -. Configure other scope filters as needed, such as *Tags* or *Service Type*. -. Proceed through the strategy creation workflow. - -The resulting strategy applies only to APIs hosted on Akamai, as indicated in the *Gateway/Provider* column on the governance strategy dashboard. - -== Example: Govern All Runtimes - -To create a governance strategy that applies across all gateway platforms: - -. In the *Define Governance Scope* step, expand the *Gateway/Provider* filter. -. Select *All Runtimes*. -. Configure other scope filters as needed. -. Proceed through the strategy creation workflow. - -The strategy applies to all APIs across Anypoint Platform and all connected third-party providers. - -== See Also - -* xref:exp-governance-create-strategy.adoc[Create Governance Strategies] -* xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] -* xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs] -* xref:exp-providers-manage.adoc[Manage API Gateway Providers] diff --git a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc index cc09f3d04..ff3b07234 100644 --- a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc +++ b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc @@ -9,32 +9,23 @@ Follow these steps to govern APIs from third-party providers: . *Connect to Provider*: Use the xref:exp-governance-setup-third-party-providers.adoc[provider connection wizard] to establish a connection to your third-party API gateway (such as Akamai). The system creates a scanner and begins discovering APIs. -. *Verify Discovered APIs*: Go to *Portfolio Overview* and verify that discovered APIs appear with the provider name in the *Gateway/Provider* column. APIs are automatically added to the portfolio as they are discovered. +. *Verify Discovered APIs*: Go to *Portfolio Overview* and verify that discovered APIs appear with the provider name in the *Provider* column. APIs are automatically added to the portfolio as they are discovered. -. *Create Governance Strategy*: Create a xref:exp-governance-create-strategy.adoc[governance strategy] with the *Gateway/Provider* filter to target specific third-party providers or *All Runtimes*. Select the control rules or automated policies to apply. +. *Create Governance Strategy*: Create a xref:exp-governance-create-strategy.adoc[governance strategy] and select the control rules or automated policies to apply. The strategy evaluates conformance for all in-scope APIs, including those discovered from third-party providers. -. *Monitor Conformance*: Track conformance status for provider-hosted APIs through the governance strategy dashboard. Filter by specific providers to focus on a subset of your cross-gateway environment. +. *Monitor Conformance*: Track conformance status for provider-hosted APIs through the governance strategy dashboard. Use the *Provider* filter to focus on a subset of your cross-gateway environment. // FLAG: Aug 13 release (policy write scope). The "Apply Policies" workflow step applies policies directly to provider-hosted instances, which is Policy Write (GA Aug 13). The Jul 16 release governs third-party APIs in read/conformance mode only. Uncomment when the Aug 13 write release is documented. // . *Apply Policies*: For targeted or supplemental policy application, use xref:exp-governance-policy-library-apply.adoc[Policy Library] to select and apply policies directly to provider-hosted API instances. -== Gateway/Provider Filter - -When creating a governance strategy, use the *Gateway/Provider* filter to target third-party provider APIs: - -. In the governance strategy creation workflow, expand the *Gateway/Provider* filter. -. Select one or more connected providers from the list (such as *Akamai*), or select *All Runtimes* to include both Anypoint Platform and third-party provider APIs. - -The strategy applies only to APIs hosted on the selected providers. - == Cross-Gateway Conformance Monitoring Monitor conformance across multiple gateway platforms: . Go to *Governance* > *Governance Strategies*. -. Select an active strategy that targets multiple providers or *All Runtimes*. -. Review the conformance summary. The *Gateway/Provider* column shows which platform hosts each API. -. Use the *Gateway/Provider* filter to focus on conformance for a specific provider. +. Select an active strategy. +. Review the conformance summary. The *Provider* column shows which platform hosts each API. +. Use the *Provider* filter to focus on conformance for a specific provider. // FLAG: Aug 13 release (policy write scope). "Read-Only Policy Status" and the credential-update-to-enable-writes flow describe Policy Write (GA Aug 13). Uncomment when the Aug 13 write release is documented. // *Read-Only Policy Status*: If a policy shows *Read-Only* status, the provider connection uses read-only credentials. To enable policy writes, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update the credentials] with write-enabled permissions. diff --git a/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc index 9b216e0b9..3acce1d17 100644 --- a/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc +++ b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc @@ -8,19 +8,19 @@ After creating governance strategies that target multiple gateway platforms or t Before monitoring cross-gateway conformance: * xref:exp-governance-setup-third-party-providers.adoc[Connect to one or more third-party providers] to enable cross-gateway governance. -* xref:exp-governance-create-strategy.adoc[Create a governance strategy] that targets multiple providers or *All Runtimes* using the xref:exp-governance-create-profiles-gateway-provider-filter.adoc[Gateway/Provider filter]. +* xref:exp-governance-create-strategy.adoc[Create a governance strategy] that evaluates the APIs you want to monitor. * Verify that the strategy is active and has evaluated the targeted APIs. == View Cross-Gateway Conformance . Log in and go to *Governance* > *Governance Strategies*. -. Select an active strategy that targets multiple providers or *All Runtimes*. +. Select an active strategy. . Review the conformance summary dashboard. The dashboard displays: * *Conformance Status*: The percentage of targeted APIs that conform to the strategy's control rules or automated policies. -* Gateway/Provider column: Shows which platform hosts each API (such as Anypoint Platform, Akamai, or other connected providers). +* Provider column: Shows which platform hosts each API (such as Anypoint Platform, Akamai, or other connected providers). * Conformant vs. Non-Conformant APIs: A breakdown of APIs that meet or fail the strategy's requirements. // FLAG: Aug 13 release (policy write scope). "Policy Application Status" (Enabled/Read-Only enforcement state) reflects policy enforcement, which is Policy Write — GA Aug 13. Uncomment when the Aug 13 write release is documented. // * *Policy Application Status*: Indicates whether policies are *Enabled* (actively enforced) or *Read-Only* (monitoring mode only). @@ -29,10 +29,10 @@ The dashboard displays: To focus on conformance for a specific provider: -. In the conformance dashboard, locate the *Gateway/Provider* filter. -. Select one or more providers from the list (such as *Akamai*). +. In the conformance dashboard, locate the *Provider* filter. +. Select a provider from the list (such as *Akamai*). -The dashboard updates to show only APIs hosted on the selected platforms. +The dashboard updates to show only APIs hosted on the selected provider. Use this filter to: @@ -57,7 +57,7 @@ Track conformance trends to identify improvements or regressions: . Select a governance strategy from the dashboard. . Review the *Conformance History* chart (if available) to see how conformance has changed over time. -. Use the *Gateway/Provider* filter to compare trends across platforms. +. Use the *Provider* filter to compare trends across platforms. Regular monitoring helps you: @@ -68,6 +68,5 @@ Regular monitoring helps you: == Related Topics * xref:exp-governance-create-strategy.adoc[Create Governance Strategies] -* xref:exp-governance-create-profiles-gateway-provider-filter.adoc[Filter Governance Scope by Gateway or Provider] * xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] * xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs] diff --git a/modules/ROOT/pages/exp-governance-policy-library-apply.adoc b/modules/ROOT/pages/exp-governance-policy-library-apply.adoc index 60598496e..dc2cd734b 100644 --- a/modules/ROOT/pages/exp-governance-policy-library-apply.adoc +++ b/modules/ROOT/pages/exp-governance-policy-library-apply.adoc @@ -80,7 +80,7 @@ Choose the API instances where you want to apply the policy: . Use filters to narrow the list by: + -- -** *Gateway/Provider*: Filter by specific providers (such as Akamai) or Anypoint Platform gateways. +** *Provider*: Filter by specific providers (such as Akamai) or Anypoint Platform gateways. ** *Service Type*: Filter by service type (such as REST API or GraphQL). ** *Tags*: Filter by tags assigned to services. -- diff --git a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc index 5dbf87268..b8c29a0f3 100644 --- a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc +++ b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc @@ -77,7 +77,7 @@ Select *Connect* to establish the connection. After you connect to a provider: * *Scanner Auto-Creation*: The system automatically creates a scanner for the connected provider to enable API discovery. -* *API Discovery*: The scanner begins discovering APIs hosted on the provider platform. Discovered APIs appear in *Portfolio Overview* with the provider name in the *Gateway/Provider* column. +* *API Discovery*: The scanner begins discovering APIs hosted on the provider platform. Discovered APIs appear in *Portfolio Overview* with the provider name in the *Provider* column. * *Akamai Correlation Policy*: For Akamai providers, the system automatically applies a correlation policy to discovered APIs to enable cross-gateway observability and governance. // FLAG: Aug 13 release (policy write scope). This "Update Credentials" section describes enabling write-enabled credentials to apply policies to a provider gateway. Policy Write is GA Aug 13; the Jul 16 release is read/conformance only (except Kong, which already ships read+apply). Uncomment when the Aug 13 write release is documented. From a9aa89638b1d120726fb3f95a2638a066fdbc136 Mon Sep 17 00:00:00 2001 From: Luana Dos Santos Date: Tue, 14 Jul 2026 12:09:39 -0300 Subject: [PATCH 07/28] docs: fix navigation and unbold non-UI step labels - "Portfolio Overview" is a Home-page summary section, not a destination; discovered APIs with the Provider column live under Portfolio > APIs. Correct the three navigation references. - Unbold the descriptive workflow step labels in the govern topic (they aren't UI elements) and trim the duplicated conformance-monitoring section that overlapped the dedicated monitor topic. Co-Authored-By: Claude Opus 4.8 --- ...xp-governance-govern-third-party-apis.adoc | 19 +++++-------------- .../exp-governance-policy-library-apply.adoc | 2 +- ...overnance-setup-third-party-providers.adoc | 2 +- 3 files changed, 7 insertions(+), 16 deletions(-) diff --git a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc index ff3b07234..446801e6b 100644 --- a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc +++ b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc @@ -7,26 +7,17 @@ After connecting to a third-party API gateway provider, you can govern discovere Follow these steps to govern APIs from third-party providers: -. *Connect to Provider*: Use the xref:exp-governance-setup-third-party-providers.adoc[provider connection wizard] to establish a connection to your third-party API gateway (such as Akamai). The system creates a scanner and begins discovering APIs. +. Use the xref:exp-governance-setup-third-party-providers.adoc[provider connection wizard] to connect to your third-party API gateway. The system creates a scanner and begins discovering APIs. -. *Verify Discovered APIs*: Go to *Portfolio Overview* and verify that discovered APIs appear with the provider name in the *Provider* column. APIs are automatically added to the portfolio as they are discovered. +. Go to *Portfolio* > *APIs* and verify that discovered APIs appear with the provider name in the *Provider* column. APIs are automatically added to the portfolio as they are discovered. -. *Create Governance Strategy*: Create a xref:exp-governance-create-strategy.adoc[governance strategy] and select the control rules or automated policies to apply. The strategy evaluates conformance for all in-scope APIs, including those discovered from third-party providers. +. Create a xref:exp-governance-create-strategy.adoc[governance strategy] and select the control rules or automated policies to apply. The strategy evaluates conformance for all in-scope APIs, including those discovered from third-party providers. -. *Monitor Conformance*: Track conformance status for provider-hosted APIs through the governance strategy dashboard. Use the *Provider* filter to focus on a subset of your cross-gateway environment. +. Track conformance status for provider-hosted APIs through the governance strategy dashboard. Use the *Provider* filter to focus on a subset of your cross-gateway environment. // FLAG: Aug 13 release (policy write scope). The "Apply Policies" workflow step applies policies directly to provider-hosted instances, which is Policy Write (GA Aug 13). The Jul 16 release governs third-party APIs in read/conformance mode only. Uncomment when the Aug 13 write release is documented. // . *Apply Policies*: For targeted or supplemental policy application, use xref:exp-governance-policy-library-apply.adoc[Policy Library] to select and apply policies directly to provider-hosted API instances. -== Cross-Gateway Conformance Monitoring - -Monitor conformance across multiple gateway platforms: - -. Go to *Governance* > *Governance Strategies*. -. Select an active strategy. -. Review the conformance summary. The *Provider* column shows which platform hosts each API. -. Use the *Provider* filter to focus on conformance for a specific provider. - // FLAG: Aug 13 release (policy write scope). "Read-Only Policy Status" and the credential-update-to-enable-writes flow describe Policy Write (GA Aug 13). Uncomment when the Aug 13 write release is documented. // *Read-Only Policy Status*: If a policy shows *Read-Only* status, the provider connection uses read-only credentials. To enable policy writes, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update the credentials] with write-enabled permissions. @@ -47,7 +38,7 @@ Monitor conformance across multiple gateway platforms: // // Use the Policy Library when you need supplemental or one-off policy application outside governance strategies. -== Related Topics +== See Also * xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] * xref:exp-governance-create-strategy.adoc[Create Governance Strategies] diff --git a/modules/ROOT/pages/exp-governance-policy-library-apply.adoc b/modules/ROOT/pages/exp-governance-policy-library-apply.adoc index dc2cd734b..8cdeaa58d 100644 --- a/modules/ROOT/pages/exp-governance-policy-library-apply.adoc +++ b/modules/ROOT/pages/exp-governance-policy-library-apply.adoc @@ -104,7 +104,7 @@ Select *Apply* to apply the policy to the selected instances. After applying the policy: -. Go to *Portfolio Overview* and open the affected API instance. +. Go to *Portfolio* > *APIs* and open the affected API instance. . Review the *Applied Policies* tab to verify the policy appears in the list. . Check the *Policy Application Status*: + diff --git a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc index b8c29a0f3..05e2179e3 100644 --- a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc +++ b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc @@ -77,7 +77,7 @@ Select *Connect* to establish the connection. After you connect to a provider: * *Scanner Auto-Creation*: The system automatically creates a scanner for the connected provider to enable API discovery. -* *API Discovery*: The scanner begins discovering APIs hosted on the provider platform. Discovered APIs appear in *Portfolio Overview* with the provider name in the *Provider* column. +* *API Discovery*: The scanner begins discovering APIs hosted on the provider platform. Discovered APIs appear in *Portfolio* > *APIs* with the provider name in the *Provider* column. * *Akamai Correlation Policy*: For Akamai providers, the system automatically applies a correlation policy to discovered APIs to enable cross-gateway observability and governance. // FLAG: Aug 13 release (policy write scope). This "Update Credentials" section describes enabling write-enabled credentials to apply policies to a provider gateway. Policy Write is GA Aug 13; the Jul 16 release is read/conformance only (except Kong, which already ships read+apply). Uncomment when the Aug 13 write release is documented. From 4bad1691242b5994cce4dcef434cae1bffcee680 Mon Sep 17 00:00:00 2001 From: Luana Dos Santos Date: Tue, 14 Jul 2026 12:49:54 -0300 Subject: [PATCH 08/28] docs: use view-agnostic provider phrasing for discovered APIs The Provider column only appears in the Portfolio > APIs list (table) view; card view shows a provider badge and the API detail header shows a labeled Provider field. Describe the provider as a label rather than a column so the verification step is accurate across views. Co-Authored-By: Claude Opus 4.8 --- modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc | 2 +- .../ROOT/pages/exp-governance-setup-third-party-providers.adoc | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc index 446801e6b..fcbff3c77 100644 --- a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc +++ b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc @@ -9,7 +9,7 @@ Follow these steps to govern APIs from third-party providers: . Use the xref:exp-governance-setup-third-party-providers.adoc[provider connection wizard] to connect to your third-party API gateway. The system creates a scanner and begins discovering APIs. -. Go to *Portfolio* > *APIs* and verify that discovered APIs appear with the provider name in the *Provider* column. APIs are automatically added to the portfolio as they are discovered. +. Go to *Portfolio* > *APIs* and verify that discovered APIs appear, each labeled with its provider (for example, *AWS*). APIs are automatically added to the portfolio as they are discovered. . Create a xref:exp-governance-create-strategy.adoc[governance strategy] and select the control rules or automated policies to apply. The strategy evaluates conformance for all in-scope APIs, including those discovered from third-party providers. diff --git a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc index 05e2179e3..342d17fb5 100644 --- a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc +++ b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc @@ -77,7 +77,7 @@ Select *Connect* to establish the connection. After you connect to a provider: * *Scanner Auto-Creation*: The system automatically creates a scanner for the connected provider to enable API discovery. -* *API Discovery*: The scanner begins discovering APIs hosted on the provider platform. Discovered APIs appear in *Portfolio* > *APIs* with the provider name in the *Provider* column. +* *API Discovery*: The scanner begins discovering APIs hosted on the provider platform. Discovered APIs appear in *Portfolio* > *APIs*, each labeled with its provider (for example, *AWS*). * *Akamai Correlation Policy*: For Akamai providers, the system automatically applies a correlation policy to discovered APIs to enable cross-gateway observability and governance. // FLAG: Aug 13 release (policy write scope). This "Update Credentials" section describes enabling write-enabled credentials to apply policies to a provider gateway. Policy Write is GA Aug 13; the Jul 16 release is read/conformance only (except Kong, which already ships read+apply). Uncomment when the Aug 13 write release is documented. From b0fb12ed26f3999d1636dbaece6d956f740f4255 Mon Sep 17 00:00:00 2001 From: Luana Dos Santos Date: Tue, 14 Jul 2026 13:21:13 -0300 Subject: [PATCH 09/28] docs: correct conformance navigation; remove non-existent trend view - Selecting a strategy opens the Configuration tab; conformance results live in the Governed Services tab. Correct the steps and describe the real Conformance / Identified Issues summaries and table columns. - Remove the "Monitor Conformance Over Time" section: no Conformance History chart or conformance-over-time trend exists in the product (conformance is a point-in-time snapshot with a last-evaluated time and a Refresh action). It is not in Jul 16 or Aug 13 scope. - Name the provider filter by its real resting label (Any provider); fix remaining "compliance" wording to "conformance." Co-Authored-By: Claude Opus 4.8 --- ...nce-monitor-cross-gateway-conformance.adoc | 34 ++++++------------- 1 file changed, 10 insertions(+), 24 deletions(-) diff --git a/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc index 3acce1d17..8af7d6eb3 100644 --- a/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc +++ b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc @@ -14,14 +14,14 @@ Before monitoring cross-gateway conformance: == View Cross-Gateway Conformance . Log in and go to *Governance* > *Governance Strategies*. -. Select an active strategy. -. Review the conformance summary dashboard. +. Select an active strategy. The strategy opens on the *Configuration* tab, which shows the scope and rules. +. Select the *Governed Services* tab to view conformance results. -The dashboard displays: +The *Governed Services* tab displays: -* *Conformance Status*: The percentage of targeted APIs that conform to the strategy's control rules or automated policies. -* Provider column: Shows which platform hosts each API (such as Anypoint Platform, Akamai, or other connected providers). -* Conformant vs. Non-Conformant APIs: A breakdown of APIs that meet or fail the strategy's requirements. +* A *Conformance* summary: the total number of governed services, broken down into *Conformant*, *Nonconformant*, and *Pending*. +* An *Identified Issues* summary: counts of violations, warnings, and info-level findings. +* A table of governed services with *Service*, *Type*, *Provider*, and *Conformance* columns. The *Provider* column shows which platform hosts each API, such as Anypoint Platform, Akamai, or other connected providers. // FLAG: Aug 13 release (policy write scope). "Policy Application Status" (Enabled/Read-Only enforcement state) reflects policy enforcement, which is Policy Write — GA Aug 13. Uncomment when the Aug 13 write release is documented. // * *Policy Application Status*: Indicates whether policies are *Enabled* (actively enforced) or *Read-Only* (monitoring mode only). @@ -29,15 +29,15 @@ The dashboard displays: To focus on conformance for a specific provider: -. In the conformance dashboard, locate the *Provider* filter. -. Select a provider from the list (such as *Akamai*). +. On the *Governed Services* tab, locate the *Any provider* filter. +. Select a provider from the list. -The dashboard updates to show only APIs hosted on the selected provider. +The list updates to show only APIs hosted on the selected provider. Use this filter to: * Compare conformance across providers. -* Identify provider-specific compliance gaps. +* Identify provider-specific conformance gaps. * Focus on a subset of your multi-gateway environment during reviews or audits. // FLAG: Aug 13 release (policy write scope). The entire "Understanding Read-Only Policy Status" section describes policy enforcement and credential-based write access, which is Policy Write — GA Aug 13. The Jul 16 Policy Read GA monitors conformance in read-only mode only. Uncomment when the Aug 13 write release is documented. @@ -51,20 +51,6 @@ Use this filter to: // // *How to Remediate*: xref:exp-governance-setup-third-party-providers.adoc#update-credentials[Update provider credentials] to grant write-enabled permissions. After updating credentials, policies transition from *Read-Only* to *Enabled* status and can enforce requirements on the provider gateway. -== Monitor Conformance Over Time - -Track conformance trends to identify improvements or regressions: - -. Select a governance strategy from the dashboard. -. Review the *Conformance History* chart (if available) to see how conformance has changed over time. -. Use the *Provider* filter to compare trends across platforms. - -Regular monitoring helps you: - -* Identify APIs that consistently fail compliance checks. -* Measure the impact of policy changes or governance strategy adjustments. -* Demonstrate compliance improvements to stakeholders during audits. - == Related Topics * xref:exp-governance-create-strategy.adoc[Create Governance Strategies] From b1c83bb98dfc2b027a8ca284d3d627061b8467bb Mon Sep 17 00:00:00 2001 From: Luana Dos Santos Date: Tue, 14 Jul 2026 13:40:07 -0300 Subject: [PATCH 10/28] docs: fix Policy Library categories (Universal is a badge, not a category) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Policy Library has four categories (Access and Security, Performance and Cost, Data Privacy and Integrity, Compliance and Observability). "Universal" is not a fifth category — it's a badge marking policies that apply to any service, including scanned and federated APIs. Correct the category list in the commented-out Aug 13 content in both topics so it's accurate when uncommented. Co-Authored-By: Claude Opus 4.8 --- .../pages/exp-governance-govern-third-party-apis.adoc | 2 +- .../ROOT/pages/exp-governance-policy-library-apply.adoc | 9 ++++----- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc index fcbff3c77..6160a3d9a 100644 --- a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc +++ b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc @@ -30,7 +30,7 @@ Follow these steps to govern APIs from third-party providers: // . Complete the four-step wizard: // + // -- -// ** *Select Policy*: Choose from Universal, Access and Security, Performance and Cost, Data Privacy and Integrity, or Compliance and Observability categories. +// ** *Select Policy*: Browse policies and filter by the Access and Security, Performance and Cost, Data Privacy and Integrity, or Compliance and Observability categories. Policies that apply to any service are marked with a *Universal* badge. // ** *Configure Policy*: Set policy parameters. // ** *Select Instances*: Choose API instances hosted on third-party providers. // ** *Review & Apply*: Confirm and apply the policy. diff --git a/modules/ROOT/pages/exp-governance-policy-library-apply.adoc b/modules/ROOT/pages/exp-governance-policy-library-apply.adoc index 8cdeaa58d..609cb5874 100644 --- a/modules/ROOT/pages/exp-governance-policy-library-apply.adoc +++ b/modules/ROOT/pages/exp-governance-policy-library-apply.adoc @@ -41,10 +41,7 @@ The wizard guides you through policy selection, configuration, instance selectio == Select Policy -Choose the policy you want to apply from these categories: - -*Universal*:: -Policies that apply across all gateway types and service types, such as message logging or header injection. +Browse the available policies and filter by category: *Access and Security*:: Authentication and authorization policies, including OAuth 2.0, JWT validation, IP filtering, and rate limiting. @@ -58,6 +55,8 @@ Policies that protect data privacy and ensure data integrity, such as PII maskin *Compliance and Observability*:: Policies that enable compliance tracking and observability, such as audit logging, correlation ID injection, and OpenTelemetry tracing. +Policies that apply to any service, including scanned and federated APIs, are marked with a *Universal* badge. + Select the policy you want to apply and select *Next*. == Configure Policy @@ -115,7 +114,7 @@ After applying the policy: If the policy is in read-only mode and you want enforcement, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update provider credentials] to grant write access. -== Related Topics +== See Also * xref:exp-governance-create-strategy.adoc[Create Governance Strategies] * xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] From e8fff2f9a9cf8b1f57bd4fdd9a225d8775a71fdb Mon Sep 17 00:00:00 2001 From: Luana Dos Santos Date: Tue, 14 Jul 2026 13:46:37 -0300 Subject: [PATCH 11/28] docs: split Policy Library topic into browse (Jul 16) and apply (Aug 13) Retitle "Apply Policies via Policy Library" to "Browse the Policy Library" and add an uncommented read/browse introduction describing what the Policy Library is and what users can see (policy cards, search, the four categories, and the Universal badge). The browse intro is gated behind a "Jul 16 publish condition" note pending PM confirmation that the Policy Library feature flag is on in browse mode for Jul 16. The policy-application wizard remains commented behind the Aug 13 write flag, to be folded into the topic when that release is documented. Update the inbound xref label to match the new title. Co-Authored-By: Claude Opus 4.8 --- ...xp-governance-govern-third-party-apis.adoc | 2 +- .../exp-governance-policy-library-apply.adoc | 65 ++++++++++--------- 2 files changed, 35 insertions(+), 32 deletions(-) diff --git a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc index 6160a3d9a..199fe8ea2 100644 --- a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc +++ b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc @@ -43,5 +43,5 @@ Follow these steps to govern APIs from third-party providers: * xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] * xref:exp-governance-create-strategy.adoc[Create Governance Strategies] // FLAG: Aug 13 release (policy write scope). Link to the Policy Library apply topic, which is commented out until the Aug 13 write release. Uncomment together with that topic. -// * xref:exp-governance-policy-library-apply.adoc[Apply Policies via Policy Library] +// * xref:exp-governance-policy-library-apply.adoc[Browse the Policy Library] * xref:exp-governance-monitor-cross-gateway-conformance.adoc[Monitor Cross-Gateway Conformance] diff --git a/modules/ROOT/pages/exp-governance-policy-library-apply.adoc b/modules/ROOT/pages/exp-governance-policy-library-apply.adoc index 609cb5874..b35bca517 100644 --- a/modules/ROOT/pages/exp-governance-policy-library-apply.adoc +++ b/modules/ROOT/pages/exp-governance-policy-library-apply.adoc @@ -1,11 +1,37 @@ -= Apply Policies via Policy Library -:keywords: policy library, apply policies, policy enforcement, targeted policies, governance policies += Browse the Policy Library +:keywords: policy library, canonical policies, governance policies, policy catalog -// FLAG: Aug 13 release (policy write scope). This entire topic documents applying policies to API instances (including third-party provider instances), which is Policy Write — GA Aug 13. It is out of scope for the Jul 16 Policy Read GA. The topic body is commented out below; uncomment when the Aug 13 write release is documented. Note: for MuleSoft-native and Kong instances, policy application already ships, but cross-gateway apply as described here aligns with the Aug 13 milestone — confirm scope with the PM before publishing. -//// -The Policy Library provides a wizard-driven workflow to apply individual policies directly to selected API instances. Use the Policy Library for targeted or supplemental policy application when you want more control than governance strategies provide. +// FLAG: Jul 16 publish condition. The read/browse description below (what the Policy Library is and what users can see) is written for the Jul 16 Policy Read GA. However, the Policy Library UI is gated behind a feature flag (W_23173868_CANONICAL_POLICIES_ENABLED, default off) and is not called out as a Jul 16 deliverable in the PRD. Confirm with the PM that the Policy Library is enabled in browse mode for Jul 16 before publishing this topic. The policy-application wizard is Policy Write (GA Aug 13) and is commented out at the end of this file. + +The Policy Library is a catalog of predefined policies that you can browse from *Governance* > *Governance Strategies* > *Policy Library*. Use it to explore the policies available to your organization and understand what each one enforces before you govern your APIs. + +== What You Can See in the Policy Library + +The Policy Library displays each available policy as a card that shows the policy name, its category, and a short description of what the policy does. -== When to Use the Policy Library +To find a policy, you can: + +* Search for a policy by name using the search box. +* Filter policies by category: ++ +-- +** *Access and Security*: Authentication and authorization policies, including OAuth 2.0, JWT validation, IP filtering, and rate limiting. +** *Performance and Cost*: Policies that manage API performance and cost, such as caching, spike arrest, and request throttling. +** *Data Privacy and Integrity*: Policies that protect data privacy and ensure data integrity, such as PII masking, data encryption, and payload validation. +** *Compliance and Observability*: Policies that enable compliance tracking and observability, such as audit logging, correlation ID injection, and OpenTelemetry tracing. +-- + +Policies that apply to any service, including scanned and federated APIs, are marked with a *Universal* badge. + +== Related Topics + +* xref:exp-governance-create-strategy.adoc[Create Governance Strategies] +* xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] +* xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs] + +// FLAG: Aug 13 release (policy write scope). Everything below documents applying policies to API instances (including third-party provider instances) through the Policy Library wizard, which is Policy Write — GA Aug 13. It is out of scope for the Jul 16 Policy Read GA. Uncomment when the Aug 13 write release is documented, and fold these sections into the topic above (add the apply use cases, permissions, and wizard steps). Note: for MuleSoft-native and Kong instances, policy application already ships, but cross-gateway apply as described here aligns with the Aug 13 milestone — confirm scope with the PM before publishing. +//// +== When to Use the Policy Library to Apply Policies Use the Policy Library instead of governance strategies when you want to: @@ -32,7 +58,7 @@ For more information, see xref:exp-home-start.adoc#permissions[Enhanced Experien * API instances registered in the portfolio. For third-party provider services, make sure that the xref:exp-governance-setup-third-party-providers.adoc[provider connection] is established. -== Open the Policy Library +== Open the Policy Library Wizard . Log in and go to *Governance* > *Governance Strategies* > *Policy Library*. . Select *Apply Policy* to start the policy application wizard. @@ -41,23 +67,7 @@ The wizard guides you through policy selection, configuration, instance selectio == Select Policy -Browse the available policies and filter by category: - -*Access and Security*:: -Authentication and authorization policies, including OAuth 2.0, JWT validation, IP filtering, and rate limiting. - -*Performance and Cost*:: -Policies that manage API performance and cost, such as caching, spike arrest, and request throttling. - -*Data Privacy and Integrity*:: -Policies that protect data privacy and ensure data integrity, such as PII masking, data encryption, and payload validation. - -*Compliance and Observability*:: -Policies that enable compliance tracking and observability, such as audit logging, correlation ID injection, and OpenTelemetry tracing. - -Policies that apply to any service, including scanned and federated APIs, are marked with a *Universal* badge. - -Select the policy you want to apply and select *Next*. +Browse the available policies and filter by category, then select the policy you want to apply and select *Next*. == Configure Policy @@ -113,11 +123,4 @@ After applying the policy: -- If the policy is in read-only mode and you want enforcement, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update provider credentials] to grant write access. - -== See Also - -* xref:exp-governance-create-strategy.adoc[Create Governance Strategies] -* xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] -* xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs] -* xref:exp-services-view-details.adoc[View Service Details] //// From 8bc2b3683fc6a4fee189db688a7f62639c06f895 Mon Sep 17 00:00:00 2001 From: Luana Dos Santos Date: Tue, 14 Jul 2026 13:51:41 -0300 Subject: [PATCH 12/28] docs: retitle Policy Library browse section to an action-oriented heading MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit "What You Can See in the Policy Library" is a vague, question-like lead-in. Use "Browse Policies by Category" — a concise imperative that names what the section covers (search plus the four category filters) and matches the topic title. Co-Authored-By: Claude Opus 4.8 --- modules/ROOT/pages/exp-governance-policy-library-apply.adoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/ROOT/pages/exp-governance-policy-library-apply.adoc b/modules/ROOT/pages/exp-governance-policy-library-apply.adoc index b35bca517..5bca7add6 100644 --- a/modules/ROOT/pages/exp-governance-policy-library-apply.adoc +++ b/modules/ROOT/pages/exp-governance-policy-library-apply.adoc @@ -5,7 +5,7 @@ The Policy Library is a catalog of predefined policies that you can browse from *Governance* > *Governance Strategies* > *Policy Library*. Use it to explore the policies available to your organization and understand what each one enforces before you govern your APIs. -== What You Can See in the Policy Library +== Browse Policies by Category The Policy Library displays each available policy as a card that shows the policy name, its category, and a short description of what the policy does. @@ -23,7 +23,7 @@ To find a policy, you can: Policies that apply to any service, including scanned and federated APIs, are marked with a *Universal* badge. -== Related Topics +== See Also * xref:exp-governance-create-strategy.adoc[Create Governance Strategies] * xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] From 1248e503b3439531406bccca4969e5e889e91c52 Mon Sep 17 00:00:00 2001 From: Luana Dos Santos Date: Tue, 14 Jul 2026 13:54:01 -0300 Subject: [PATCH 13/28] docs: standardize cross-reference heading to "See Also" MuleSoft docs use "See Also" for the cross-reference section. Rename the "Related Topics" headings in the setup and monitor topics to match. Co-Authored-By: Claude Opus 4.8 --- .../pages/exp-governance-monitor-cross-gateway-conformance.adoc | 2 +- .../ROOT/pages/exp-governance-setup-third-party-providers.adoc | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc index 8af7d6eb3..2ea2da3af 100644 --- a/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc +++ b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc @@ -51,7 +51,7 @@ Use this filter to: // // *How to Remediate*: xref:exp-governance-setup-third-party-providers.adoc#update-credentials[Update provider credentials] to grant write-enabled permissions. After updating credentials, policies transition from *Read-Only* to *Enabled* status and can enforce requirements on the provider gateway. -== Related Topics +== See Also * xref:exp-governance-create-strategy.adoc[Create Governance Strategies] * xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] diff --git a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc index 342d17fb5..c568b4633 100644 --- a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc +++ b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc @@ -93,7 +93,7 @@ After you connect to a provider: // // After updating to write-enabled credentials, you can apply policies directly to APIs on the provider gateway through governance strategies or the xref:exp-governance-policy-library-apply.adoc[Policy Library]. -== Related Topics +== See Also * xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs] * xref:exp-governance-create-strategy.adoc[Create Governance Strategies] From a4b63f6b94936a8aeb62715e69fbde563ca03117 Mon Sep 17 00:00:00 2001 From: Luana Dos Santos Date: Tue, 14 Jul 2026 14:12:36 -0300 Subject: [PATCH 14/28] change section title --- .../ROOT/pages/exp-governance-setup-third-party-providers.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc index c568b4633..f7c4ab7b7 100644 --- a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc +++ b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc @@ -1,7 +1,7 @@ = Connect to Third-Party API Providers :keywords: third-party providers, akamai, api discovery, provider connection, scanner, api governance -Connect to third-party API gateway providers such as Akamai to automatically discover and govern APIs hosted on those platforms. When you connect to a supported provider, the system creates scanners, discovers APIs, and applies correlation policies to enable cross-gateway governance. +Connect to third-party API gateway providers to automatically discover and govern APIs hosted on those platforms. When you connect to a supported provider, the system creates scanners, discovers APIs, and applies correlation policies to enable cross-gateway governance. == Before You Begin From c247443f6d51e072142f8247c14443a7364b8171 Mon Sep 17 00:00:00 2001 From: Luana Dos Santos Date: Tue, 14 Jul 2026 14:22:43 -0300 Subject: [PATCH 15/28] changed title --- ...p-governance-setup-third-party-providers.adoc | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc index f7c4ab7b7..e2dbef9a6 100644 --- a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc +++ b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc @@ -5,7 +5,7 @@ Connect to third-party API gateway providers to automatically discover and gover == Before You Begin -Before getting started, make sure you have: +Before you connect to a provider, make sure you have: * An Anypoint Platform account. * Any of these permissions: @@ -23,17 +23,9 @@ For more information, see xref:exp-home-start.adoc#permissions[Enhanced Experien . Log in and go to *Platform* > *Providers*. . Select *Add Provider* to start the connection wizard. - ++ The wizard guides you through provider selection, connection setup, and credential configuration. - -=== Choose Provider - -Select the third-party API gateway provider you want to connect to: - -* *Akamai*—Connect to Akamai API Gateway to discover and govern APIs hosted on Akamai infrastructure. -* Additional providers appear as support is added. - -Select your provider and select *Next*. +. Select your provider and select *Next*. === Connect to Provider @@ -72,7 +64,7 @@ Enter the required authentication credentials for your provider account. The spe Select *Connect* to establish the connection. -== What Happens Next +== Provider Connection Results After you connect to a provider: From 9625ddd082805f5e1245b1cdb5a3bb8e469e7220 Mon Sep 17 00:00:00 2001 From: Luana Dos Santos <84200607+luanamulesoft@users.noreply.github.com> Date: Tue, 14 Jul 2026 14:25:28 -0300 Subject: [PATCH 16/28] Update exp-governance-setup-third-party-providers.adoc --- .../ROOT/pages/exp-governance-setup-third-party-providers.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc index e2dbef9a6..75054aa1a 100644 --- a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc +++ b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc @@ -64,7 +64,7 @@ Enter the required authentication credentials for your provider account. The spe Select *Connect* to establish the connection. -== Provider Connection Results +== Provider Connection Results After you connect to a provider: From 578d641a48b1b2edbf25b7fa434beecb43d984f5 Mon Sep 17 00:00:00 2001 From: Luana Dos Santos Date: Tue, 14 Jul 2026 14:40:16 -0300 Subject: [PATCH 17/28] docs: unbold non-UI outcome labels in provider connection results Scanner Auto-Creation, API Discovery, and Akamai Correlation Policy are descriptive category lead-ins, not UI element labels, so they shouldn't be bold. Rewrite the connection-results list as plain sentences. Co-Authored-By: Claude Opus 4.8 --- .../pages/exp-governance-setup-third-party-providers.adoc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc index 75054aa1a..9eacbd12a 100644 --- a/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc +++ b/modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc @@ -68,9 +68,9 @@ Select *Connect* to establish the connection. After you connect to a provider: -* *Scanner Auto-Creation*: The system automatically creates a scanner for the connected provider to enable API discovery. -* *API Discovery*: The scanner begins discovering APIs hosted on the provider platform. Discovered APIs appear in *Portfolio* > *APIs*, each labeled with its provider (for example, *AWS*). -* *Akamai Correlation Policy*: For Akamai providers, the system automatically applies a correlation policy to discovered APIs to enable cross-gateway observability and governance. +* The system automatically creates a scanner for the connected provider to enable API discovery. +* The scanner discovers APIs hosted on the provider platform. Discovered APIs appear in *Portfolio* > *APIs*, each labeled with its provider (for example, *AWS*). +* For Akamai providers, the system automatically applies a correlation policy to discovered APIs to enable cross-gateway observability and governance. // FLAG: Aug 13 release (policy write scope). This "Update Credentials" section describes enabling write-enabled credentials to apply policies to a provider gateway. Policy Write is GA Aug 13; the Jul 16 release is read/conformance only (except Kong, which already ships read+apply). Uncomment when the Aug 13 write release is documented. // == Update Credentials From 158917ab15a03546e7c5c5ec5ff18a5cef511caa Mon Sep 17 00:00:00 2001 From: Luana Dos Santos Date: Tue, 14 Jul 2026 14:44:16 -0300 Subject: [PATCH 18/28] docs: add third-party provider governance topics to nav Add the four PR 499 topics under Work with Governance Strategies in workflow order: connect providers, govern third-party APIs, monitor cross-gateway conformance, and browse the Policy Library. Co-Authored-By: Claude Opus 4.8 --- modules/ROOT/nav.adoc | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/modules/ROOT/nav.adoc b/modules/ROOT/nav.adoc index 96f9abae4..31de6de8b 100644 --- a/modules/ROOT/nav.adoc +++ b/modules/ROOT/nav.adoc @@ -23,6 +23,10 @@ *** xref:exp-governance-create-strategy.adoc[] *** xref:exp-governance-manage-strategies.adoc[] *** xref:exp-governance-view-cost-and-token-usage.adoc[] + *** xref:exp-governance-setup-third-party-providers.adoc[] + *** xref:exp-governance-govern-third-party-apis.adoc[] + *** xref:exp-governance-monitor-cross-gateway-conformance.adoc[] + *** xref:exp-governance-policy-library-apply.adoc[] ** xref:exp-services-monitoring.adoc[] ** xref:exp-services-view-detailed-metrics.adoc[] ** xref:exp-alerts-configure-notifications.adoc[] From df1be70b9aa5bbcece480b1a0d126d2664fc901f Mon Sep 17 00:00:00 2001 From: Luana Dos Santos <84200607+luanamulesoft@users.noreply.github.com> Date: Tue, 14 Jul 2026 16:21:37 -0300 Subject: [PATCH 19/28] Update nav.adoc --- modules/ROOT/nav.adoc | 1 - 1 file changed, 1 deletion(-) diff --git a/modules/ROOT/nav.adoc b/modules/ROOT/nav.adoc index 31de6de8b..cf9e05cec 100644 --- a/modules/ROOT/nav.adoc +++ b/modules/ROOT/nav.adoc @@ -23,7 +23,6 @@ *** xref:exp-governance-create-strategy.adoc[] *** xref:exp-governance-manage-strategies.adoc[] *** xref:exp-governance-view-cost-and-token-usage.adoc[] - *** xref:exp-governance-setup-third-party-providers.adoc[] *** xref:exp-governance-govern-third-party-apis.adoc[] *** xref:exp-governance-monitor-cross-gateway-conformance.adoc[] *** xref:exp-governance-policy-library-apply.adoc[] From 7ad4446e2e1db4ce4c775c7a9938dc79875dcebc Mon Sep 17 00:00:00 2001 From: Luana Dos Santos <84200607+luanamulesoft@users.noreply.github.com> Date: Tue, 14 Jul 2026 16:30:22 -0300 Subject: [PATCH 20/28] Update nav.adoc --- modules/ROOT/nav.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/nav.adoc b/modules/ROOT/nav.adoc index cf9e05cec..a0e1b45cf 100644 --- a/modules/ROOT/nav.adoc +++ b/modules/ROOT/nav.adoc @@ -22,10 +22,10 @@ ** xref:exp-governance-work-with-strategies.adoc[] *** xref:exp-governance-create-strategy.adoc[] *** xref:exp-governance-manage-strategies.adoc[] - *** xref:exp-governance-view-cost-and-token-usage.adoc[] *** xref:exp-governance-govern-third-party-apis.adoc[] *** xref:exp-governance-monitor-cross-gateway-conformance.adoc[] *** xref:exp-governance-policy-library-apply.adoc[] + *** xref:exp-governance-view-cost-and-token-usage.adoc[] ** xref:exp-services-monitoring.adoc[] ** xref:exp-services-view-detailed-metrics.adoc[] ** xref:exp-alerts-configure-notifications.adoc[] From 578ea90f44a0e6e3149f7be7ecbb91c9827a31cf Mon Sep 17 00:00:00 2001 From: Luana Dos Santos <84200607+luanamulesoft@users.noreply.github.com> Date: Fri, 17 Jul 2026 14:59:32 -0300 Subject: [PATCH 21/28] Apply suggestion from @luanamulesoft --- modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc index 199fe8ea2..2be4b6854 100644 --- a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc +++ b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc @@ -7,7 +7,7 @@ After connecting to a third-party API gateway provider, you can govern discovere Follow these steps to govern APIs from third-party providers: -. Use the xref:exp-governance-setup-third-party-providers.adoc[provider connection wizard] to connect to your third-party API gateway. The system creates a scanner and begins discovering APIs. +. Connect and create a scanner. When the scanner runs, it discovers and catalogs APIs and their read-only policies. See xref:[placeholder] . Go to *Portfolio* > *APIs* and verify that discovered APIs appear, each labeled with its provider (for example, *AWS*). APIs are automatically added to the portfolio as they are discovered. From ad1eb457c09ea1205095f4548f7e0b5cfc88603d Mon Sep 17 00:00:00 2001 From: Luana Dos Santos <84200607+luanamulesoft@users.noreply.github.com> Date: Fri, 17 Jul 2026 15:03:27 -0300 Subject: [PATCH 22/28] Update exp-governance-govern-third-party-apis.adoc --- modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc index 2be4b6854..3ed920d6c 100644 --- a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc +++ b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc @@ -13,7 +13,7 @@ Follow these steps to govern APIs from third-party providers: . Create a xref:exp-governance-create-strategy.adoc[governance strategy] and select the control rules or automated policies to apply. The strategy evaluates conformance for all in-scope APIs, including those discovered from third-party providers. -. Track conformance status for provider-hosted APIs through the governance strategy dashboard. Use the *Provider* filter to focus on a subset of your cross-gateway environment. +. Track conformance status for provider-hosted APIs through the governance strategy dashboard. Use the *Any provider* filter in the *Governed Services* tab of your govenance strategy to focus on a subset of your cross-gateway environment. // FLAG: Aug 13 release (policy write scope). The "Apply Policies" workflow step applies policies directly to provider-hosted instances, which is Policy Write (GA Aug 13). The Jul 16 release governs third-party APIs in read/conformance mode only. Uncomment when the Aug 13 write release is documented. // . *Apply Policies*: For targeted or supplemental policy application, use xref:exp-governance-policy-library-apply.adoc[Policy Library] to select and apply policies directly to provider-hosted API instances. From 3668bd4259082b6bb5fa92acbaadeea50ce939be Mon Sep 17 00:00:00 2001 From: Luana Dos Santos <84200607+luanamulesoft@users.noreply.github.com> Date: Tue, 28 Jul 2026 16:41:29 -0300 Subject: [PATCH 23/28] Apply suggestion from @JennyHajee Co-authored-by: Jenny Hajee <94015849+JennyHajee@users.noreply.github.com> --- modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc index 3ed920d6c..e033f116a 100644 --- a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc +++ b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc @@ -7,7 +7,7 @@ After connecting to a third-party API gateway provider, you can govern discovere Follow these steps to govern APIs from third-party providers: -. Connect and create a scanner. When the scanner runs, it discovers and catalogs APIs and their read-only policies. See xref:[placeholder] +. Connect and create a scanner. When the scanner runs, it discovers and catalogs APIs and their read-only policies. See xref:exp-services-view-details.adoc[] . Go to *Portfolio* > *APIs* and verify that discovered APIs appear, each labeled with its provider (for example, *AWS*). APIs are automatically added to the portfolio as they are discovered. From 2d884c8c97315f2ba55e634fd5a14cb91e2fb173 Mon Sep 17 00:00:00 2001 From: Luana Dos Santos <84200607+luanamulesoft@users.noreply.github.com> Date: Tue, 28 Jul 2026 16:45:16 -0300 Subject: [PATCH 24/28] Apply suggestion from @luanamulesoft --- .../pages/exp-governance-monitor-cross-gateway-conformance.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc index 2ea2da3af..fe11e74f1 100644 --- a/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc +++ b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc @@ -7,7 +7,7 @@ After creating governance strategies that target multiple gateway platforms or t Before monitoring cross-gateway conformance: -* xref:exp-governance-setup-third-party-providers.adoc[Connect to one or more third-party providers] to enable cross-gateway governance. +* xref:exp-services-view-details.adoc[Connect to one or more third-party providers] to enable cross-gateway governance. * xref:exp-governance-create-strategy.adoc[Create a governance strategy] that evaluates the APIs you want to monitor. * Verify that the strategy is active and has evaluated the targeted APIs. From 5c1a8fb153431a3ac441388e582daa4486ac51a2 Mon Sep 17 00:00:00 2001 From: Luana Dos Santos <84200607+luanamulesoft@users.noreply.github.com> Date: Tue, 28 Jul 2026 16:45:36 -0300 Subject: [PATCH 25/28] Apply suggestion from @luanamulesoft --- .../pages/exp-governance-monitor-cross-gateway-conformance.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc index fe11e74f1..97d8cf14e 100644 --- a/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc +++ b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc @@ -21,7 +21,7 @@ The *Governed Services* tab displays: * A *Conformance* summary: the total number of governed services, broken down into *Conformant*, *Nonconformant*, and *Pending*. * An *Identified Issues* summary: counts of violations, warnings, and info-level findings. -* A table of governed services with *Service*, *Type*, *Provider*, and *Conformance* columns. The *Provider* column shows which platform hosts each API, such as Anypoint Platform, Akamai, or other connected providers. +* A table of governed services with *Service*, *Type*, *Provider*, and *Conformance* columns. The *Provider* column shows which platform hosts each API. // FLAG: Aug 13 release (policy write scope). "Policy Application Status" (Enabled/Read-Only enforcement state) reflects policy enforcement, which is Policy Write — GA Aug 13. Uncomment when the Aug 13 write release is documented. // * *Policy Application Status*: Indicates whether policies are *Enabled* (actively enforced) or *Read-Only* (monitoring mode only). From a3a939dc700c88c7101544e04bb07e12ae25884a Mon Sep 17 00:00:00 2001 From: Luana Dos Santos <84200607+luanamulesoft@users.noreply.github.com> Date: Tue, 28 Jul 2026 16:45:47 -0300 Subject: [PATCH 26/28] Apply suggestion from @luanamulesoft --- .../pages/exp-governance-monitor-cross-gateway-conformance.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc index 97d8cf14e..30236f7f2 100644 --- a/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc +++ b/modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc @@ -54,5 +54,5 @@ Use this filter to: == See Also * xref:exp-governance-create-strategy.adoc[Create Governance Strategies] -* xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] +* xref:exp-services-view-details.adoc[] * xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs] From ac44b86c56ea446a532bff1196a55b0adacf9351 Mon Sep 17 00:00:00 2001 From: Luana Dos Santos <84200607+luanamulesoft@users.noreply.github.com> Date: Tue, 28 Jul 2026 16:46:13 -0300 Subject: [PATCH 27/28] Apply suggestion from @luanamulesoft --- modules/ROOT/pages/exp-governance-policy-library-apply.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/exp-governance-policy-library-apply.adoc b/modules/ROOT/pages/exp-governance-policy-library-apply.adoc index 5bca7add6..22bd1297a 100644 --- a/modules/ROOT/pages/exp-governance-policy-library-apply.adoc +++ b/modules/ROOT/pages/exp-governance-policy-library-apply.adoc @@ -26,7 +26,7 @@ Policies that apply to any service, including scanned and federated APIs, are ma == See Also * xref:exp-governance-create-strategy.adoc[Create Governance Strategies] -* xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] +* xref:exp-services-view-details.adoc[] * xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs] // FLAG: Aug 13 release (policy write scope). Everything below documents applying policies to API instances (including third-party provider instances) through the Policy Library wizard, which is Policy Write — GA Aug 13. It is out of scope for the Jul 16 Policy Read GA. Uncomment when the Aug 13 write release is documented, and fold these sections into the topic above (add the apply use cases, permissions, and wizard steps). Note: for MuleSoft-native and Kong instances, policy application already ships, but cross-gateway apply as described here aligns with the Aug 13 milestone — confirm scope with the PM before publishing. From 9107a81880dc840dd40db6af92064a534876a27a Mon Sep 17 00:00:00 2001 From: Luana Dos Santos <84200607+luanamulesoft@users.noreply.github.com> Date: Tue, 28 Jul 2026 16:47:17 -0300 Subject: [PATCH 28/28] Apply suggestion from @luanamulesoft --- modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc index e033f116a..85e373208 100644 --- a/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc +++ b/modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc @@ -40,7 +40,7 @@ Follow these steps to govern APIs from third-party providers: == See Also -* xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers] +* xref:exp-services-view-details.adoc[] * xref:exp-governance-create-strategy.adoc[Create Governance Strategies] // FLAG: Aug 13 release (policy write scope). Link to the Policy Library apply topic, which is commented out until the Aug 13 write release. Uncomment together with that topic. // * xref:exp-governance-policy-library-apply.adoc[Browse the Policy Library]