The policy engine will need a registry of policies/services/applications so it can lookup a policy chain given an api key. The policy registry will be pluggable. One of the impl types (useful mostly for testing) must be a purely in-memory implementation.