Policy Enforcement Point (PEP)
The component that sits in the request path, asks a PDP for a decision, and actually allows or blocks the request — the reference monitor's role in a modern distributed architecture.
aka: PEP
A PEP is where enforcement happens, and it can live in very different places — an API gateway, a service mesh sidecar’s ext_authz filter, or an edge function — but its job never changes: intercept the request, ask the PDP, and honor whatever it says. Placing PEPs correctly, close to the resource without adding unnecessary hops, is most of what “authorization architecture” actually means.