Given multiple policies applied to one API, explain how policy ordering/priority determines execution sequence and configure the order so that, for example, authentication runs before rate-limiting.