These methods differ in the following ways: Your operating environment determines the best method for you. Key management and the encryption policy engine can be in any of the environment layers  that are shown in Figure 3-1. The application layer, for example, IBM Spectrum Protect, initiates the data transfer for tape  storage. The library layer is the TS4500 tape library, which contains an internal interface to each tape  drive that is installed in the library. The application-managed tape encryption method is best in operating environments that run  an application that already can generate and manage encryption policies and keys, such as  IBM Spectrum Protect. Policies that specify when encryption is to be used are defined  through the application interface. The policies and keys pass through the data path between  the application layer and the encryption-capable tape drives.  3.2.3 Application-managed encryption (AME) GLYPH<SM590000> Where the encryption policy engine resides GLYPH<SM590000> Where key management occurs for your encryption solution GLYPH<SM590000> How the key manager is connected to the drive Chapter 3. Encryption  181 Figure 3-1 Possible locations for the encryption policy engine and key management