Almost every large organization has more than one gateway. An acquisition brought one, a cloud migration brought another, one business unit standardized on a third, and the legacy one is still running because a mainframe integration depends on it. Consolidation is usually years away and sometimes never comes.
So stop trying to make the gateways identical and make the policy identical instead. Write the requirements once, vendor-neutrally: every public API requires authentication, every consumer is rate limited, no API accepts unbounded payloads, all traffic is logged with a correlation ID, PII fields are redacted at the edge. That register is the source of truth.
Then, per gateway, either generate the configuration from that register or write a verifier that reads the live configuration and reports which policies are actually in force. Generation is better where the vendor supports declarative config; verification is the fallback and is still enormously valuable.
Finally, produce one coverage report across every gateway. The question a governance program has to be able to answer is not “what does our policy say” but “on which of our 400 routes is it actually enforced right now.” Without that number you have a policy document, not a policy.
