WEEK 28 · FORWARD MOVES

Pick one chokepoint and make it the policy plane.

The control plane is consolidating, and the gateway is where your policy starts to actually live.

Submitted by Neil Watkins · MondayMove

Your strongest security control this year will not be a product. It will be a place.

Tool sprawl does not stay sprawl forever. Given enough time it gets absorbed. Consoles fold into platforms, platforms fold into gateways, and the gateway becomes the one point every request must clear. That is the moment policy stops being a document somebody wrote and starts being enforcement nobody can route around.

Look at where the plumbing is heading. AI gateways sit in front of model calls. API gateways sit in front of services. SASE planes sit in front of the network. Data access layers sit in front of the crown jewels. Every one of them is a chokepoint, and a chokepoint is the cheapest place you will ever find to express a rule once and have it hold for everything behind it.

The security programs that win in 2027 will read more like platform engineering teams than help desks. They will own a handful of enforcement points instead of babysitting a warehouse of tools. That shift does not start with a strategy deck. It starts with one gateway.

I watched this land with a team that had been treating a data access layer as plumbing and nothing more. They flipped a single rule into it, who can read financial records, and deleted the scattered copies living out in their services. The next audit question that used to burn a week became one query they ran while the auditor watched. Nobody bought anything. They just moved one decision to a place that already existed.

Most teams hear "consolidation" and picture fewer vendors on the renewal list. That is the boring version, and it misses the real prize. The prize is fewer places where a decision gets made. When an access decision lives in a ticket, it dies with the ticket. When it lives in a chokepoint, it applies to every request that comes after it without anyone reopening the question. Revoke access in a scattered model and you are chasing thirty services and hoping you found them all. Revoke it at the chokepoint and it is one change, effective everywhere.

So stop counting tools. Start counting decision points, and pick the one worth defending.

So, here's the MondayMove

Pick one access decision this week and move it into a single chokepoint: an AI gateway, an API gateway, a SASE plane, or a data access layer. Make that chokepoint the place the policy lives, not the ticket where it once died.

Find your chokepoint, move one decision into it, and let the pattern grow from there.

Friday Follow-Up

What Happened When Teams Moved One Decision to the Chokepoint

The move sounded clean on Monday. Picking the chokepoint turned out to be the easy part.

Submitted by Neil Watkins · MondayMove

July 10, 2026

MondayMove gives you one concrete action every Monday. FridayFollowUp closes the loop.

Each Friday, a short dispatch on what practitioners actually found when they ran the week's move: where they got stuck, what surprised them, and what to do next. Not sanitized case studies. Field notes. Practitioner to practitioner.

Monday's move: pick one access decision and move it into a single chokepoint, an AI gateway, an API gateway, a SASE plane, or a data access layer.

Finding the chokepoint took people about ten minutes. Almost everyone landed on a point their traffic already flowed through, usually an API gateway or a data access layer they had half-built and never fully trusted. That part felt good. Then the actual work showed up, and it was not the move. It was the cleanup.

The recurring snag was the copies. Lifting a rule into the gateway is straightforward. Deleting the thirty scattered versions that used to enforce it is where teams stalled, because at least one of those copies was load-bearing in a way nobody documented. A couple of people moved the decision into the chokepoint, left the old checks running "just in case," and ended up with two policies that quietly disagreed. That is worse than where they started, and the ones who hit it said so plainly.

The teams who got clean results did one unglamorous thing first. They logged at the chokepoint before they enforced at the chokepoint. A week of watching what the gateway would have decided, compared against what the scattered checks actually did, surfaced every disagreement before it could break anything. Nobody who skipped that step was glad they skipped it.

For next week, do not add a second chokepoint yet. Go back to the one decision you moved and finish it. Confirm the old copies are gone, not dormant, and confirm your logs prove the gateway is the only thing deciding now. A half-migrated policy is a liability wearing the costume of progress. Close the first one out completely before you reach for the next.

No correct answers here. This is practitioner-to-practitioner. The more honest the responses, the more useful this gets for everyone reading on Monday morning.

See you then.

Discussion