feat(portal): Application <> consumer mapping

app/_includes/dev-portal/kaa-vs-ace.md

@@ -5,6 +5,10 @@ When you link an API to a Gateway, you have two options:
 These plugins are responsible for applying authentication and authorization on the Gateway Service or control plane.
 The [authentication strategy](/dev-portal/auth-strategies/) that you select for the API defines how clients authenticate.
 
+In {{site.base_gateway}} 3.15 or later, both plugins also look up {{site.identity}} principals to resolve any [plugins applied to a {{site.dev_portal}} application](/dev-portal/self-service/#map-an-application-to-a-consumer), so that Consumer or principal-scoped plugins apply to the application's traffic. 
+Principal lookups are cached, so additional lookups aren't required until the cache is evicted. 
+Cache eviction is controlled at the principal and {{site.base_gateway}}-level.
+
 The following table can help you decide which option to pick:
 <!--vale off-->
 {% table %}

app/_includes/plugins/ace/ace-overview.md

@@ -1,9 +1,13 @@
-The Access Control Enforcement (ACE) plugin manages developer access control to APIs published with Dev Portal.
+The Access Control Enforcement (ACE) plugin manages developer access control to APIs published with {{site.dev_portal}}.
 
 You can use the ACE plugin as an alternative to the {{site.konnect_short_name}} application auth (KAA) plugin to link APIs to a Gateway instead of linking APIs to a Gateway Service. 
 Unlike the KAA plugin, the ACE plugin can link to control planes to configure access control and create API package operations for Gateway Services.
 API packages use the ACE plugin to manage developer access control to APIs. 
 
+If you [apply a plugin to a {{site.dev_portal}} application](/dev-portal/self-service/#map-an-application-to-a-consumer), the ACE plugin looks up the application's principal to resolve the mapped Consumer at runtime, so any Consumer or principal-scoped plugins apply to the application's traffic. 
+Principal lookups are cached, so additional lookups aren't required until the cache is evicted. 
+Cache eviction is controlled at the principal and {{site.base_gateway}}-level.
+
 The ACE plugin runs *after* all other [authentication plugins](/plugins/?category=authentication) run. 
 For example, if you have [Key Authentication](/plugins/key-auth/) configured and it rejects a request, the ACE plugin *will not* run.