W-23392787 docs: add third-party provider governance experience topics

modules/ROOT/nav.adoc

@@ -22,6 +22,9 @@
   ** xref:exp-governance-work-with-strategies.adoc[]
    *** xref:exp-governance-create-strategy.adoc[]
    *** xref:exp-governance-manage-strategies.adoc[]
+   *** xref:exp-governance-govern-third-party-apis.adoc[]
+   *** xref:exp-governance-monitor-cross-gateway-conformance.adoc[]
+   *** xref:exp-governance-policy-library-apply.adoc[]
    *** xref:exp-governance-view-cost-and-token-usage.adoc[]
   ** xref:exp-services-monitoring.adoc[]
   ** xref:exp-services-view-detailed-metrics.adoc[]

modules/ROOT/pages/exp-governance-govern-third-party-apis.adoc

@@ -0,0 +1,47 @@
+= Govern Third-Party Provider APIs
+:keywords: third-party apis, cross-gateway governance, provider governance, api compliance, policy enforcement
+
+After connecting to a third-party API gateway provider, you can govern discovered APIs through the same governance workflow used for Anypoint Platform APIs. This enables unified governance across multiple gateway platforms.
+
+== End-to-End Workflow
+
+Follow these steps to govern APIs from third-party providers:
+
+. Connect and create a scanner. When the scanner runs, it discovers and catalogs APIs and their read-only policies. See xref:[placeholder] 
+
+. Go to *Portfolio* > *APIs* and verify that discovered APIs appear, each labeled with its provider (for example, *AWS*). APIs are automatically added to the portfolio as they are discovered.
+
+. Create a xref:exp-governance-create-strategy.adoc[governance strategy] and select the control rules or automated policies to apply. The strategy evaluates conformance for all in-scope APIs, including those discovered from third-party providers.
+
+. Track conformance status for provider-hosted APIs through the governance strategy dashboard. Use the *Any provider* filter in the *Governed Services* tab of your govenance strategy to focus on a subset of your cross-gateway environment.
+
+// FLAG: Aug 13 release (policy write scope). The "Apply Policies" workflow step applies policies directly to provider-hosted instances, which is Policy Write (GA Aug 13). The Jul 16 release governs third-party APIs in read/conformance mode only. Uncomment when the Aug 13 write release is documented.
+// . *Apply Policies*: For targeted or supplemental policy application, use xref:exp-governance-policy-library-apply.adoc[Policy Library] to select and apply policies directly to provider-hosted API instances.
+
+// FLAG: Aug 13 release (policy write scope). "Read-Only Policy Status" and the credential-update-to-enable-writes flow describe Policy Write (GA Aug 13). Uncomment when the Aug 13 write release is documented.
+// *Read-Only Policy Status*: If a policy shows *Read-Only* status, the provider connection uses read-only credentials. To enable policy writes, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update the credentials] with write-enabled permissions.
+
+// FLAG: Aug 13 release (policy write scope). The entire "Policy Library for Third-Party APIs" section applies policies to provider instances, which is Policy Write (GA Aug 13), not Jul 16 Policy Read. Uncomment when the Aug 13 write release is documented.
+// == Policy Library for Third-Party APIs
+//
+// The xref:exp-governance-policy-library-apply.adoc[Policy Library] provides a targeted way to apply individual policies to third-party provider services:
+//
+// . Go to *Governance* > *Governance Strategies* > *Policy Library*.
+// . Complete the four-step wizard:
+// +
+// --
+// ** *Select Policy*: Browse policies and filter by the Access and Security, Performance and Cost, Data Privacy and Integrity, or Compliance and Observability categories. Policies that apply to any service are marked with a *Universal* badge.
+// ** *Configure Policy*: Set policy parameters.
+// ** *Select Instances*: Choose API instances hosted on third-party providers.
+// ** *Review & Apply*: Confirm and apply the policy.
+// --
+//
+// Use the Policy Library when you need supplemental or one-off policy application outside governance strategies.
+
+== See Also
+
+* xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers]
+* xref:exp-governance-create-strategy.adoc[Create Governance Strategies]
+// FLAG: Aug 13 release (policy write scope). Link to the Policy Library apply topic, which is commented out until the Aug 13 write release. Uncomment together with that topic.
+// * xref:exp-governance-policy-library-apply.adoc[Browse the Policy Library]
+* xref:exp-governance-monitor-cross-gateway-conformance.adoc[Monitor Cross-Gateway Conformance]

modules/ROOT/pages/exp-governance-monitor-cross-gateway-conformance.adoc

@@ -0,0 +1,58 @@
+= Monitor Cross-Gateway Conformance
+:keywords: cross-gateway conformance, provider conformance, governance monitoring, compliance tracking, multi-gateway governance
+
+After creating governance strategies that target multiple gateway platforms or third-party providers, monitor conformance across your entire API ecosystem through a unified dashboard. The conformance summary shows conformance status for APIs hosted on Anypoint Platform gateways and connected third-party providers.
+
+== Before You Begin
+
+Before monitoring cross-gateway conformance:
+
+* xref:exp-governance-setup-third-party-providers.adoc[Connect to one or more third-party providers] to enable cross-gateway governance.
+* xref:exp-governance-create-strategy.adoc[Create a governance strategy] that evaluates the APIs you want to monitor.
+* Verify that the strategy is active and has evaluated the targeted APIs.
+
+== View Cross-Gateway Conformance
+
+. Log in and go to *Governance* > *Governance Strategies*.
+. Select an active strategy. The strategy opens on the *Configuration* tab, which shows the scope and rules.
+. Select the *Governed Services* tab to view conformance results.
+
+The *Governed Services* tab displays:
+
+* A *Conformance* summary: the total number of governed services, broken down into *Conformant*, *Nonconformant*, and *Pending*.
+* An *Identified Issues* summary: counts of violations, warnings, and info-level findings.
+* A table of governed services with *Service*, *Type*, *Provider*, and *Conformance* columns. The *Provider* column shows which platform hosts each API, such as Anypoint Platform, Akamai, or other connected providers.
+// FLAG: Aug 13 release (policy write scope). "Policy Application Status" (Enabled/Read-Only enforcement state) reflects policy enforcement, which is Policy Write — GA Aug 13. Uncomment when the Aug 13 write release is documented.
+// * *Policy Application Status*: Indicates whether policies are *Enabled* (actively enforced) or *Read-Only* (monitoring mode only).
+
+== Filter by Specific Provider
+
+To focus on conformance for a specific provider:
+
+. On the *Governed Services* tab, locate the *Any provider* filter.
+. Select a provider from the list.
+
+The list updates to show only APIs hosted on the selected provider.
+
+Use this filter to:
+
+* Compare conformance across providers.
+* Identify provider-specific conformance gaps.
+* Focus on a subset of your multi-gateway environment during reviews or audits.
+
+// FLAG: Aug 13 release (policy write scope). The entire "Understanding Read-Only Policy Status" section describes policy enforcement and credential-based write access, which is Policy Write — GA Aug 13. The Jul 16 Policy Read GA monitors conformance in read-only mode only. Uncomment when the Aug 13 write release is documented.
+// == Understanding Read-Only Policy Status
+//
+// If a policy shows *Read-Only* status in the conformance dashboard:
+//
+// * The provider connection uses credentials with read-only permissions.
+// * Policies are applied in monitoring mode only and don't enforce requirements on the provider gateway.
+// * The system can track conformance but can't automatically remediate violations.
+//
+// *How to Remediate*: xref:exp-governance-setup-third-party-providers.adoc#update-credentials[Update provider credentials] to grant write-enabled permissions. After updating credentials, policies transition from *Read-Only* to *Enabled* status and can enforce requirements on the provider gateway.
+
+== See Also
+
+* xref:exp-governance-create-strategy.adoc[Create Governance Strategies]
+* xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers]
+* xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs]

modules/ROOT/pages/exp-governance-policy-library-apply.adoc

@@ -0,0 +1,126 @@
+= Browse the Policy Library
+:keywords: policy library, canonical policies, governance policies, policy catalog
+
+// FLAG: Jul 16 publish condition. The read/browse description below (what the Policy Library is and what users can see) is written for the Jul 16 Policy Read GA. However, the Policy Library UI is gated behind a feature flag (W_23173868_CANONICAL_POLICIES_ENABLED, default off) and is not called out as a Jul 16 deliverable in the PRD. Confirm with the PM that the Policy Library is enabled in browse mode for Jul 16 before publishing this topic. The policy-application wizard is Policy Write (GA Aug 13) and is commented out at the end of this file.
+
+The Policy Library is a catalog of predefined policies that you can browse from *Governance* > *Governance Strategies* > *Policy Library*. Use it to explore the policies available to your organization and understand what each one enforces before you govern your APIs.
+
+== Browse Policies by Category
+
+The Policy Library displays each available policy as a card that shows the policy name, its category, and a short description of what the policy does.
+
+To find a policy, you can:
+
+* Search for a policy by name using the search box.
+* Filter policies by category:
++
+--
+** *Access and Security*: Authentication and authorization policies, including OAuth 2.0, JWT validation, IP filtering, and rate limiting.
+** *Performance and Cost*: Policies that manage API performance and cost, such as caching, spike arrest, and request throttling.
+** *Data Privacy and Integrity*: Policies that protect data privacy and ensure data integrity, such as PII masking, data encryption, and payload validation.
+** *Compliance and Observability*: Policies that enable compliance tracking and observability, such as audit logging, correlation ID injection, and OpenTelemetry tracing.
+--
+
+Policies that apply to any service, including scanned and federated APIs, are marked with a *Universal* badge.
+
+== See Also
+
+* xref:exp-governance-create-strategy.adoc[Create Governance Strategies]
+* xref:exp-governance-setup-third-party-providers.adoc[Connect to Third-Party API Providers]
+* xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs]
+
+// FLAG: Aug 13 release (policy write scope). Everything below documents applying policies to API instances (including third-party provider instances) through the Policy Library wizard, which is Policy Write — GA Aug 13. It is out of scope for the Jul 16 Policy Read GA. Uncomment when the Aug 13 write release is documented, and fold these sections into the topic above (add the apply use cases, permissions, and wizard steps). Note: for MuleSoft-native and Kong instances, policy application already ships, but cross-gateway apply as described here aligns with the Aug 13 milestone — confirm scope with the PM before publishing.
+////
+== When to Use the Policy Library to Apply Policies
+
+Use the Policy Library instead of governance strategies when you want to:
+
+* Apply a policy to a specific set of API instances without creating a governance strategy.
+* Add supplemental policies to instances that are already governed by strategies.
+* Apply policies to third-party provider services hosted on platforms such as Akamai.
+* Test policy behavior on a limited scope before a broader rollout.
+
+For comprehensive, scope-driven governance across multiple services, use xref:exp-governance-create-strategy.adoc[governance strategies] instead.
+
+== Before You Begin
+
+Before getting started, make sure you have:
+
+* An Anypoint Platform account.
+* Any of these permissions:
++
+--
+** API Governance: Governance Administrator
+** API Manager: Manage Policies
+--
++
+For more information, see xref:exp-home-start.adoc#permissions[Enhanced Experience Permissions].
+
+* API instances registered in the portfolio. For third-party provider services, make sure that the xref:exp-governance-setup-third-party-providers.adoc[provider connection] is established.
+
+== Open the Policy Library Wizard
+
+. Log in and go to *Governance* > *Governance Strategies* > *Policy Library*.
+. Select *Apply Policy* to start the policy application wizard.
+
+The wizard guides you through policy selection, configuration, instance selection, and review.
+
+== Select Policy
+
+Browse the available policies and filter by category, then select the policy you want to apply and select *Next*.
+
+== Configure Policy
+
+Enter configuration parameters for your selected policy. Required and optional fields vary by policy type.
+
+Common configuration fields include:
+
+* *Policy Name*: A descriptive name for this policy application.
+* *Enforcement Mode*: Whether to enforce the policy or monitor violations only (if supported).
+* *Parameters*: Policy-specific settings such as rate limits, authentication providers, or transformation rules.
+
+Configure the policy parameters according to your requirements and select *Next*.
+
+== Select Instances
+
+Choose the API instances where you want to apply the policy:
+
+. Review the list of available API instances. The list includes instances from Anypoint Platform and connected third-party providers.
+. Use filters to narrow the list by:
++
+--
+** *Provider*: Filter by specific providers (such as Akamai) or Anypoint Platform gateways.
+** *Service Type*: Filter by service type (such as REST API or GraphQL).
+** *Tags*: Filter by tags assigned to services.
+--
+
+. Select one or more instances where you want to apply the policy.
+. Select *Next*.
+
+== Review and Apply
+
+Review the policy application summary:
+
+* *Policy*: The selected policy and its configuration.
+* *Instances*: The list of instances where the policy is applied.
+* *Expected Outcome*: A summary of what happens when you apply the policy.
+
+*Read-Only Mode*: If any selected instances belong to a provider connection with read-only credentials, those instances receive the policy in monitoring mode only. To enable write access, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update provider credentials].
+
+Select *Apply* to apply the policy to the selected instances.
+
+== Verify Policy Application
+
+After applying the policy:
+
+. Go to *Portfolio* > *APIs* and open the affected API instance.
+. Review the *Applied Policies* tab to verify the policy appears in the list.
+. Check the *Policy Application Status*:
++
+--
+** *Enabled*: The policy is actively enforced on the gateway.
+** *Read-Only*: The policy is applied in monitoring mode only (typically due to read-only provider credentials).
+--
+
+If the policy is in read-only mode and you want enforcement, xref:exp-governance-setup-third-party-providers.adoc#update-credentials[update provider credentials] to grant write access.
+////

modules/ROOT/pages/exp-governance-setup-third-party-providers.adoc

@@ -0,0 +1,93 @@
+= Connect to Third-Party API Providers
+:keywords: third-party providers, akamai, api discovery, provider connection, scanner, api governance
+
+Connect to third-party API gateway providers to automatically discover and govern APIs hosted on those platforms. When you connect to a supported provider, the system creates scanners, discovers APIs, and applies correlation policies to enable cross-gateway governance.
+
+== Before You Begin
+
+Before you connect to a provider, make sure you have:
+
+* An Anypoint Platform account.
+* Any of these permissions:
++
+--
+** API Governance: Governance Administrator
+** Platform: Manage Providers
+--
++
+For more information, see xref:exp-home-start.adoc#permissions[Enhanced Experience Permissions].
+
+* Provider credentials with appropriate API access permissions.
+
+== Connect to a Provider
+
+. Log in and go to *Platform* > *Providers*.
+. Select *Add Provider* to start the connection wizard.
++
+The wizard guides you through provider selection, connection setup, and credential configuration.
+. Select your provider and select *Next*.
+
+=== Connect to Provider
+
+Enter the connection details for your selected provider:
+
+*Provider Name*::
+A descriptive name to identify this provider connection in the platform.
+
+*Base URL*::
+The API endpoint URL for your provider instance (for example, `https://api.akamai.com`).
+
+*Region*::
+The geographic region where your provider instance is hosted (if applicable).
+
+Select *Next* to proceed to credential configuration.
+
+=== Connection Setup
+
+Configure authentication credentials to enable API access:
+
+*Authentication Method*::
+Select the authentication method supported by your provider (API Key, OAuth, or Client Credentials).
+
+*Credentials*::
+Enter the required authentication credentials for your provider account. The specific fields depend on your selected authentication method:
++
+--
+** *API Key*: Enter your API key and secret.
+** *OAuth*: Provide client ID, client secret, and authorization URL.
+** *Client Credentials*: Enter client ID and client secret.
+--
+
+// FLAG: Aug 13 release (policy write scope). This "Read-Only Access" note describes applying policies to a provider gateway, which is Policy Write (GA Aug 13), not Jul 16 Policy Read. Uncomment when the Aug 13 write release is documented.
+// *Read-Only Access*::
+// If your credentials have read-only permissions, the system can discover APIs and monitor conformance but can't apply policies directly to the provider gateway. Use xref:exp-governance-policy-library-apply.adoc[Policy Library] to apply policies in read-only mode, or update credentials later to enable write access.
+
+Select *Connect* to establish the connection.
+
+== Provider Connection Results 
+
+After you connect to a provider:
+
+* The system automatically creates a scanner for the connected provider to enable API discovery.
+* The scanner discovers APIs hosted on the provider platform. Discovered APIs appear in *Portfolio* > *APIs*, each labeled with its provider (for example, *AWS*).
+* For Akamai providers, the system automatically applies a correlation policy to discovered APIs to enable cross-gateway observability and governance.
+
+// FLAG: Aug 13 release (policy write scope). This "Update Credentials" section describes enabling write-enabled credentials to apply policies to a provider gateway. Policy Write is GA Aug 13; the Jul 16 release is read/conformance only (except Kong, which already ships read+apply). Uncomment when the Aug 13 write release is documented.
+// == Update Credentials
+//
+// If your initial credentials were read-only and you want to enable policy application:
+//
+// . Go to *Platform* > *Providers*.
+// . Locate your provider connection and select *Edit*.
+// . Select *Update Credentials*.
+// . Enter credentials with write permissions.
+// . Select *Save*.
+//
+// After updating to write-enabled credentials, you can apply policies directly to APIs on the provider gateway through governance strategies or the xref:exp-governance-policy-library-apply.adoc[Policy Library].
+
+== See Also
+
+* xref:exp-governance-govern-third-party-apis.adoc[Govern Third-Party Provider APIs]
+* xref:exp-governance-create-strategy.adoc[Create Governance Strategies]
+* xref:exp-providers-manage.adoc[Manage API Gateway Providers]
+* xref:exp-scanners-manage.adoc[Manage API Scanners]