The core of the apiman runtime layer is the policy engine. This policy engine must be able to create a policy chain from an api key, then apply that policy chain to the inbound request and output response.