# Apply policies
Govern what passes through the surface once a caller is authenticated, and what the managed agent can do when it calls external services. OPA policies apply Rego rules at gateway scope (all surfaces) or surface scope (one surface).

| Guide | What you will achieve |
| [Use JWT claims to control access to a surface](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/policies/use-jwt-claims-to-control-access-to-a-surface.md) | Add Policy elements to a surface to control which inbound requests reach your managed agent, based on JWT claims, request attributes, or caller context. |
| [Control MCP tool access with per-tool policies](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/policies/control-mcp-tool-access-with-per-tool-policies.md) | Assign Rego policies to individual MCP tools so only callers whose credentials satisfy the policy can invoke each tool. |
| [Apply policy to outbound calls](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/policies/apply-policy-to-outbound-calls.md) | Route your managed agent’s outbound calls through the gateway to apply OPA policy and trust checks before each request leaves. |
| [Apply OPA policies to your gateway and surfaces](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/policies/apply-opa-policies.md) | Create OPA Rego policy definitions and activate them at gateway scope or surface scope to enforce access control. |


## Pages in this section


- [Use JWT claims to control access to a surface](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/policies/use-jwt-claims-to-control-access-to-a-surface.md): Add Policy elements to a surface to control which inbound requests reach your managed agent, based on JWT claims, request attributes, or caller context.

- [Control MCP tool access with per-tool policies](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/policies/control-mcp-tool-access-with-per-tool-policies.md): Assign Rego policies to individual tools on an MCP surface so only callers whose credentials satisfy the policy can invoke each tool.

- [Apply policy to outbound calls](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/policies/apply-policy-to-outbound-calls.md): Route your managed agent's outbound calls through the gateway to apply OPA policy and trust checks to every external request it makes.

- [Apply OPA policies to your gateway and surfaces](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/policies/apply-opa-policies.md): Create OPA Rego policy definitions and apply them at gateway scope or surface scope to control which requests the Agent Gateway allows or forwards.