The browser may request a model identifier. The server decides which organization, gateway, provider endpoint, credential, and deployment are allowed to satisfy that request.
Decision order
- Resolve the active organization and authenticated person.
- Resolve the Project and Environment allowed to execute.
- Read the versioned provider-registry entry and gateway visible to that authority.
- Confirm the requested model belongs to the gateway and is approved.
- Verify required provider capabilities and qualification evidence.
- Reserve the applicable budget/allocation.
- For a managed gateway, confirm that its deployment is still ready.
- Issue a scoped credential lease and build the runner request from that result.
Reject a mismatched gateway/model pair. Falling back to another provider or credential makes the user-visible selection misleading and can cross organization access boundaries.
Versioned provider registry
Registry entries identify provider, gateway, models, declared capabilities, configuration revision, and qualification state. Record the resolved entry and revision with every run.
Member and application selection
Members select only approved model identifiers. The application may narrow that choice for its profile but may not silently broaden organization or Environment authority.
Record and diagnose the decision
Persist the chosen profile, registry revision, model/capabilities, budget decision, lease identity, and denial reason. If current behavior drifts, compare that evidence with the currently deployed registry and release identity.