How to restrict the calling of interfaces in Web Services

1. Join WS Security Policy?  
2. Add gateway security filtering before Web Service?  
3. Add user ID/caller ID and org ID/name information to the soap header. Of course, others can also imitate it