Milestone 4.C.2 — Per-Org Model Routing ConfigurationCopy Anchor Link

Status: Completed
Goal: Track C — Multi-Provider Adapters & Resilience
Phase: 4 — Operator Platform & Multi-Provider
Estimated effort: 2 days
Track: Track C — Multi-Provider Adapters & Resilience

---

Why This Milestone ExistsCopy Anchor Link

Exit criteria requires model-based routing configuration per org — allowlists/denylists and default-model overrides (e.g. enterprise restricted to Anthropic for compliance). Platform registry remains the source of which models exist; org policy is a veto gate before Registry.For.

---

Non-GoalsCopy Anchor Link

• Generic rules engine / DSL
• Per-user model routing
• Azure OpenAI or Bedrock adapters
• Auth service changes
• fallback_chain (4.C.4)
• Strict provider allowlist (#790)

---

Shipped surfaceCopy Anchor Link

PrecedenceCopy Anchor Link

1. Request model (trimmed) if non-empty
2. Else agent default_model from proxy Postgres
3. Else 400 model required
4. Org policy first-match (priority ASC, filepath.Match); no match → allow
5. Registry.For(candidate) → attach provider or 501

ChannelsCopy Anchor Link

• model_policy_updates:{org_id} / model_policy_updates:*
• Payload: {"v":1,"org_id":"<uuid>"}

---

Success signalsCopy Anchor Link

• Deny → ErrModelNotAllowedForOrg → 403 MODEL_NOT_ALLOWED (middleware unit + registry tests)
• Cache hit avoids second loader call; TTL expiry + pub/sub invalidate ≤1s (miniredis)
• TestRouting_OrgPolicy_* against real Postgres (//go:build integration)
• Unit foreign-org path checks → 404 on all verbs (test_unit_model_policies_*_foreign_org_404; live API+RLS ISO is a follow-up)
• Minimal middleware + constructor wiring (not “zero middleware changes”)

---

PrerequisitesCopy Anchor Link

• M4.C.1 Anthropic adapter merged (two providers useful for routing demos)
• M4.A.3 agents default_model column available for empty-model fill