diff --git a/azure/templates/post-deploy.yml b/azure/templates/post-deploy.yml
index c06ae54..273d9f3 100644
--- a/azure/templates/post-deploy.yml
+++ b/azure/templates/post-deploy.yml
@@ -84,6 +84,8 @@ steps:
     displayName: Deploy mock provider
     workingDirectory: "$(Pipeline.Workspace)/s/$(SERVICE_NAME)/$(SERVICE_ARTIFACT_NAME)"
     retryCountOnTaskFailure: 2
+    env:
+       PYTHONWARNINGS: "ignore::SyntaxWarning"
 
   - bash: |
       set -e
diff --git a/mock_provider/Dockerfile b/mock_provider/Dockerfile
index e155af5..ec9f8bc 100644
--- a/mock_provider/Dockerfile
+++ b/mock_provider/Dockerfile
@@ -19,4 +19,4 @@ COPY --from=0  /specification  /usr/src/prism/packages/cli/gp-connect-user-permi
 COPY --from=0  /updated-spec.json  /usr/src/prism/packages/cli/gp-connect-user-permissions/specification/gp-connect-user-permissions.json
 
 #Running command of mock with OAS file
-CMD ["mock" , "-h", "0.0.0.0", "-p" ,"9000" ,"gp-connect-user-permissions/specification/gp-connect-user-permissions.json"]
+CMD ["mock" , "-h", "0.0.0.0", "-p" ,"9000" , "--multiprocess=false", "gp-connect-user-permissions/specification/gp-connect-user-permissions.json"]
diff --git a/proxies/live/apiproxy/policies/AM-Enable-DelegatedAccess.xml b/proxies/live/apiproxy/policies/AM-Enable-DelegatedAccess.xml
new file mode 100644
index 0000000..b9863b0
--- /dev/null
+++ b/proxies/live/apiproxy/policies/AM-Enable-DelegatedAccess.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<AssignMessage async="false" continueOnError="false" enabled="true" name="AM-Enable-DelegatedAccess">
+    <DisplayName>AM-Enable-DelegatedAccess</DisplayName>
+    <AssignVariable>
+        <Name>delegatedaccess.enabled</Name>
+        <Value>true</Value>
+    </AssignVariable>
+    <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
+</AssignMessage>
\ No newline at end of file
diff --git a/proxies/live/apiproxy/policies/FlowCallout.CompositeTokenCheckOptIN.xml b/proxies/live/apiproxy/policies/FlowCallout.CompositeTokenCheckOptIN.xml
new file mode 100644
index 0000000..7e04d6d
--- /dev/null
+++ b/proxies/live/apiproxy/policies/FlowCallout.CompositeTokenCheckOptIN.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<FlowCallout async="false" continueOnError="false" enabled="true" name="FlowCallout.CompositeTokenCheckOptIN">
+    <DisplayName>FlowCallout.CompositeTokenCheckOptIN</DisplayName>
+    <FaultRules/>
+    <Properties/>
+    <SharedFlowBundle>CompositeTokenCheckOptIN</SharedFlowBundle>
+</FlowCallout>
\ No newline at end of file
diff --git a/proxies/live/apiproxy/policies/JavaScript.ValidateNHSNumber.xml b/proxies/live/apiproxy/policies/JavaScript.ValidateNHSNumber.xml
new file mode 100644
index 0000000..c9ae9d0
--- /dev/null
+++ b/proxies/live/apiproxy/policies/JavaScript.ValidateNHSNumber.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Javascript name="JavaScript.ValidateNHSNumber" enabled="true" continueOnError="false">
+    <DisplayName>JavaScript.ValidateNHSNumber</DisplayName>
+    <ResourceURL>jsc://ValidateNHSNumber.js</ResourceURL>
+</Javascript>
\ No newline at end of file
diff --git a/proxies/live/apiproxy/proxies/default.xml b/proxies/live/apiproxy/proxies/default.xml
index 6d8078a..3ea4ffc 100644
--- a/proxies/live/apiproxy/proxies/default.xml
+++ b/proxies/live/apiproxy/proxies/default.xml
@@ -4,6 +4,16 @@
       <Step>
         <Name>FlowCallout.GetEnvironmentKeyValueMapData</Name>
       </Step>
+      <Step>
+        <Name>AM-Enable-DelegatedAccess</Name>
+      </Step>
+      <Step>
+        <Name>FlowCallout.CompositeTokenCheckOptIN</Name>
+        <Condition>not (proxy.pathsuffix MatchesPath "/_ping" or proxy.pathsuffix MatchesPath "/_status")</Condition>
+      </Step>
+      <Step>
+        <Name>JavaScript.ValidateNHSNumber</Name>
+      </Step>
     </Request>
   </PreFlow>
   <Flows>
diff --git a/proxies/live/apiproxy/resources/jsc/ValidateNHSNumber.js b/proxies/live/apiproxy/resources/jsc/ValidateNHSNumber.js
new file mode 100644
index 0000000..e9ad9d5
--- /dev/null
+++ b/proxies/live/apiproxy/resources/jsc/ValidateNHSNumber.js
@@ -0,0 +1,40 @@
+print("nhsd.actor.nhs_number NUM   : " + context.getVariable("nhsd.actor.nhs_number"));
+print("nhsd.subject.nhs_number NUM   : " + context.getVariable("nhsd.subject.nhs_number"));
+
+var httpverb = context.getVariable("request.verb");
+var actorNHS = context.getVariable("nhsd.actor.nhs_number");
+if (httpverb == 'GET') {
+    var queryNHSNumber = context.getVariable("request.queryparam.patientNHSNumber");
+    print("queryNHSNumber :" +queryNHSNumber);
+    if (queryNHSNumber) {
+        if (queryNHSNumber !== actorNHS) {
+            print("NHS Number is not valid");
+        }
+    }
+    else {
+        var routeParamArray = context.getVariable("proxy.pathsuffix").split('/');
+        var routeNHSNumber = routeParamArray[routeParamArray.length - 1];
+        print("routeNHSNumber :" +routeNHSNumber);
+        if (routeNHSNumber && routeNHSNumber !== actorNHS){
+            print("NHS Number is not valid");
+        }    
+    }
+}
+else {
+    if(httpverb == 'POST') {
+        var reqContent = context.getVariable("request.content");
+        var jsonContent = JSON.parse(reqContent);
+        var postNHSnumber = null;
+        for (var i = 0; i < jsonContent.parameter.length; i++) {
+            var p = jsonContent.parameter[i];
+            if ( p.name === "patientNHSNumber" && p.valueIdentifier && p.valueIdentifier.value) {
+                postNHSnumber = p.valueIdentifier.value;
+                break;
+            }
+        }
+        print("postNHSnumber :" +postNHSnumber);
+        if (postNHSnumber && postNHSnumber !== actorNHS){
+            print("NHS Number is not valid");
+        }
+    }
+}
\ No newline at end of file