# Enforce Data Governance Centrally with Confluent Gateway Confluent Private Cloud Gateway (Confluent Gateway) enables centralized governance enforcement for your Kafka workloads. You define data policies once in Confluent Schema Registry ([Schema Registry](https://docs.confluent.io/platform/current/schema-registry/index.html)), and Confluent Gateway enforces them at the proxy layer on every producer and consumer request, ensuring only compliant records reach your Kafka clusters. Because enforcement happens at the proxy layer, you can change rules across all routes without reconfiguring client applications or individual brokers. #### NOTE Centralized governance enforcement is an **Early Access** feature in Confluent Gateway 1.3 and supports Docker-based deployments only. This feature is intended for evaluation, might change before General Availability (GA), and is not recommended for production workloads. ## Centralized governance capabilities Centralized governance enforcement provides the following capabilities: * **Four enforcement policy types**: Set enforcement levels independently for record keys and values to match each topic’s risk profile. Confluent Gateway enforces schema ID validation, deep schema validation, field-level encryption, and full payload encryption for records that use Apache Avro®, JSON Schema, or Protobuf. * **Encryption**: Apply Schema Registry Encrypt rules through [data contract rules](https://docs.confluent.io/platform/current/schema-registry/fundamentals/data-contracts.html). Confluent Gateway handles encryption and decryption transparently. * **Per-topic overrides**: Override the global enforcement level on specific topics to support varying workload requirements. ## How centralized governance enforcement works  After you deploy Confluent Gateway between clients and brokers and enable data governance policies, Confluent Gateway inspects each record’s payload, validates it against Schema Registry based on the configured [enforcement level](gateway-governance-config.md#gateway-governance-enforcement-level), and forwards the record, rejects it, or applies data contract rules, such as encryption, before forwarding it to the broker. On the consume path, Confluent Gateway applies data contract rules, such as decryption, before delivering records to consumers. ## Next steps Configure Confluent Gateway to enforce centralized governance. For more information, including verification and troubleshooting, see [Enforce Centralized Governance with Confluent Gateway](gateway-governance-config.md#gateway-governance-config).