The management layer needs to aggregate the list of policies for a given service contract and include that list when registering an app with the gateway. This should be easy enough to do as we have all of the information necessary to query for the policies and aggregate them in the proper order (app, plan, service).