A credential lease is a short-lived server-side grant that allows one organization to use one approved model through one provider gateway. Members select a model; their browsers never receive the provider credential.
Checks before a lease is issued
- The person belongs to the active organization.
- The gateway is available to that organization.
- The requested model belongs to the gateway and is approved.
- A managed gateway still has a ready deployment.
- The lease is scoped to that organization, gateway, and model and expires quickly.
Lease caches include organization identity. Two organizations requesting the same model do not share a credential grant.
Investigate a denied model request
Confirm the organization, gateway visibility, model approval, deployment readiness, and lease issuance in that order. Do not work around a denial by sending a raw provider credential to the browser or silently selecting another model.