From 692257a3ebd2a491c37265a767fe2eb046273849 Mon Sep 17 00:00:00 2001 From: mlsmaycon Date: Sun, 26 Jul 2026 11:32:51 +0000 Subject: [PATCH] agentnetwork: cover enabled-but-empty allowlist denies all Pin the behaviour that an allowlist-enabled guardrail with no models yields a per-provider empty set (deny every model), distinct from an unrestricted provider. Raised in review. --- .../agentnetwork/synthesizer_provider_allowlist_test.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/management/internals/modules/agentnetwork/synthesizer_provider_allowlist_test.go b/management/internals/modules/agentnetwork/synthesizer_provider_allowlist_test.go index 52699b1ba..2cfc0db8c 100644 --- a/management/internals/modules/agentnetwork/synthesizer_provider_allowlist_test.go +++ b/management/internals/modules/agentnetwork/synthesizer_provider_allowlist_test.go @@ -83,4 +83,13 @@ func TestBuildProviderAllowlists(t *testing.T) { assert.ElementsMatch(t, []string{"claude-opus-4", "gpt-4o"}, got["prov-x"], "a policy's own multiple allowlist guardrails union together") }) + + t.Run("an enabled allowlist with no models denies everything", func(t *testing.T) { + empty := map[string]*types.Guardrail{"g-empty": allowlistGuardrail("g-empty", "acc-1")} + got := buildProviderAllowlists([]*types.Policy{ + policyForProviders("p1", []string{"g-empty"}, "prov-x"), + }, empty) + assert.Equal(t, map[string][]string{"prov-x": {}}, got, + "an enabled-but-empty allowlist is restricted with an empty set, not unrestricted") + }) }