All of the usual AWS KMS authorization mechanisms — IAM policies, AWS KMS key policies, grants — that you use with other KMS keys, work the same way for KMS keys in external key stores.
In addition, your and/or your external key manager partners have the ability to implement a secondary layer of authorization controls based on request metadata included with each request sent from AWS KMS to the XKS Proxy. This metadata includes the calling AWS user/role, the KMS key ARN, and the specific KMS API that was requested. This allows you to apply fine-grained authorization policy on the use of a key in your external key manager beyond simply trusting any request from AWS KMS. The choice of policy enforcement using these request attributes are left to your individual XKS Proxy implementations.