From 244ca3f671e134293d9ad066a9a36c86f4799b94 Mon Sep 17 00:00:00 2001 From: mlsmaycon Date: Sun, 26 Jul 2026 11:25:32 +0000 Subject: [PATCH] agentnetwork: cover within-policy allowlist-guardrail union Add unit coverage for a single policy that references multiple allowlist guardrails: the selector (policyPermitsModel) and the synthesiser (buildProviderAllowlists) must both treat the model set as the union of those guardrails, not just the first. --- .../agentnetwork/policyselect_model_test.go | 25 +++++++++++++++++++ .../synthesizer_provider_allowlist_test.go | 9 +++++++ 2 files changed, 34 insertions(+) diff --git a/management/internals/modules/agentnetwork/policyselect_model_test.go b/management/internals/modules/agentnetwork/policyselect_model_test.go index 56c1dac23..c72db1be3 100644 --- a/management/internals/modules/agentnetwork/policyselect_model_test.go +++ b/management/internals/modules/agentnetwork/policyselect_model_test.go @@ -221,3 +221,28 @@ func TestSelectPolicy_DisabledAllowlistDoesNotRestrict(t *testing.T) { assert.True(t, res.Allow, "a disabled allowlist must not restrict the model") assert.Equal(t, "pol-A", res.SelectedPolicyID) } + +// TestSelectPolicy_UnionAcrossPolicyGuardrails proves a policy with multiple +// allowlist guardrails permits the union of their models (not just the first). +func TestSelectPolicy_UnionAcrossPolicyGuardrails(t *testing.T) { + ctrl := gomock.NewController(t) + mgr, mockStore := newSelectorMgr(t, ctrl) + + policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1", "g-2") + expectPolicies(mockStore, "acc-1", policy) + expectGuardrails(mockStore, "acc-1", + allowlistGuardrail("g-1", "acc-1", "gpt-4o"), + allowlistGuardrail("g-2", "acc-1", "claude-opus-4"), + ) + expectConsumptionBatch(mockStore, nil) + + res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{ + AccountID: "acc-1", + GroupIDs: []string{"grp-eng"}, + ProviderID: "prov-1", + Model: "claude-opus-4", // only in the second guardrail's list + }) + require.NoError(t, err) + assert.True(t, res.Allow, "a model in any of the policy's allowlist guardrails must be permitted") + assert.Equal(t, "pol-A", res.SelectedPolicyID) +} diff --git a/management/internals/modules/agentnetwork/synthesizer_provider_allowlist_test.go b/management/internals/modules/agentnetwork/synthesizer_provider_allowlist_test.go index f4c1ff361..52699b1ba 100644 --- a/management/internals/modules/agentnetwork/synthesizer_provider_allowlist_test.go +++ b/management/internals/modules/agentnetwork/synthesizer_provider_allowlist_test.go @@ -74,4 +74,13 @@ func TestBuildProviderAllowlists(t *testing.T) { assert.Equal(t, []string{"gpt-4o"}, got["prov-x"]) assert.Equal(t, []string{"gpt-4o"}, got["prov-y"]) }) + + t.Run("union across a single policy's guardrails", func(t *testing.T) { + policies := []*types.Policy{ + policyForProviders("p1", []string{"g-4o", "g-opus"}, "prov-x"), + } + got := buildProviderAllowlists(policies, byID) + assert.ElementsMatch(t, []string{"claude-opus-4", "gpt-4o"}, got["prov-x"], + "a policy's own multiple allowlist guardrails union together") + }) }