OWSM has two ways of enforcing security etc. for a Web Service. Oracle calls these Policy Enforcement Points (PEPs). The two types of PEPs are called Gateways and Agents.

Gateways
Runs in the OAS and acts as an proxy for all incoming requests. The Gateway inspects the request and allows or disallows it to pass-through to the Web Service.

Properties:

• Transport protocol translation. For incoming transport protocol: HTTP, JMS and MQ is supported and for the outgoing: HTTP, HTTPS, JMS, MQ, or a custom protocol.

• Content routing so which Web Service that is called is based on the content in the message request.
• Do not guarantee endpoint-level security, meaning that the communication between a Gateway and a Web Service is not encrypted.

WSM gateway not planned in 11g http://wiki.oracle.com/page/OWSM+11gR1+FAQ
(What about incoming HTTPS?)

Agents
An Agent can either run server side with the Web Service or client side with the Web Service client. Can be configured to communicate with OWSM Policy Manager. If they are, they retrieve the security information from Policy Manager. If the Policy Manager is disabled, then the Agents look for a local file that contains the security policies to be executed.
A client Agent would often be used if the client do not support the security protocols that is needed. A server Agent would often be used toguarantee endpoint-level security by encrypting the message or part of it between a client and a Web Services or a Gateway and a Web Service.

(What about Monitoring?)

Properties:

• Support these Java containers: OC4J, AXIS, Others.
• Note an OWSM must be installed on the machine where you are installing the client agent!
• The WSMADMIN tool in ORACLE_HOME\owsm\bin is used for installing an Agent
  

Comparison
Gateways are easier to implement than Agents.