The browser may request a model identifier. The server decides which organization, gateway, provider endpoint, credential, and deployment are allowed to satisfy that request.
Decision order
- Resolve the active organization and authenticated person.
- Find a gateway visible to that organization.
- Confirm that the requested model belongs to the gateway and is approved.
- For a managed gateway, confirm that its deployment is still ready.
- Issue a scoped credential lease.
- Build the runner request from that validated server result.
Reject a mismatched gateway/model pair. Falling back to another provider or credential makes the user-visible selection misleading and can cross organization access boundaries.