You use Open Policy Agent (OPA) for complex, fine-grained attribute-based access control (ABAC). Why is deploying OPA as a 'Sidecar' on the Gateway instance strictly superior to calling a centralized OPA 'Policy Server'?

1. A Sidecars use the exact same CPU cores as the Gateway, allowing them to share memory without using the network stack.
2. B Latency Minimization: Policy evaluation is on the 'Critical Path' of every request. A network call to a central server adds 20-50ms; a sidecar call over the loopback interface adds <1ms, protecting the system's P99 latency.
3. C Sidecars are immune to DDoS attacks because they don't have an IP address.
4. D Centralized servers are incapable of parsing JSON-based policy documents.