 runtime,</p><ol><li><p>A request is intercepted by the proxy, and the proxy will send check requests to the external auth service, as
configured by the user in the authorization policy.</p></li><li><p>The external auth service will make the decision whether to allow it or not.</p></li><li><p>If allowed, the request will continue and will be enforced by any local authorization defined by <code>ALLOW</code>/<code>DENY</code> action.</p></li><li><p>If denied, the request will be rejected immediately.</p></li>