[management, proxy] scope agent-network model allowlist per policy/group and provider (#6905)

## Describe your changes

The model-allowlist guardrail was merged into one account-wide union and
enforced flat on every request, ignoring which policy/group/provider
authorised it. With multiple policies — especially a mix of guardrailed
and un-guardrailed ones — this caused:

- **false-allow**: a model allowlisted for one group/provider leaked to
any caller; and
- **false-deny**: an un-guardrailed policy (intended unrestricted) was
blocked by another policy's allowlist.

Enforcement is now policy/group-aware, mirroring `llm_limit_check`:

- **Management (`SelectPolicyForRequest`) is authoritative.** It uses
the request model (already carried in
`CheckLLMPolicyLimitsRequest.model`, previously ignored) to keep only
applicable policies whose guardrails permit the model; no
allowlist-enabled guardrail = unrestricted. Denies
`llm_policy.model_blocked` when policies govern the (provider, groups)
but none permits the model.
- **Proxy `llm_guardrail` becomes a per-provider fail-closed backstop.**
The synthesiser emits an allowlist only for providers every authorising
policy restricts; the middleware keys off the resolved provider id and
keeps unknown-model fail-closed.

proxy/internal/auth/tunnel_cache.go

@@ -3,20 +3,30 @@ package auth
 import (
 	"context"
 	"net/netip"
+	"os"
+	"strings"
 	"sync"
 	"time"
 
+	log "github.com/sirupsen/logrus"
 	"golang.org/x/sync/singleflight"
 
 	"github.com/netbirdio/netbird/proxy/internal/types"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
-// tunnelCacheTTL caps how long a positive ValidateTunnelPeer result is
-// reused before re-fetching from management. 5 minutes balances freshness
-// against management load on busy mesh networks.
+// tunnelCacheTTL is the default cap on how long a positive ValidateTunnelPeer
+// result is reused before re-fetching from management. 5 minutes balances
+// freshness against management load on busy mesh networks. Override it with
+// envTunnelCacheTTL when an account needs authorization changes to take effect
+// sooner (at the cost of more ValidateTunnelPeer RPCs).
 const tunnelCacheTTL = 300 * time.Second
 
+// envTunnelCacheTTL overrides tunnelCacheTTL. The value is a Go duration string
+// (e.g. "30s", "2m"); an unset, unparseable, or non-positive value keeps the
+// default.
+const envTunnelCacheTTL = "NB_PROXY_TUNNEL_CACHE_TTL"
+
 // tunnelCachePerAccount caps the number of cached identities per account.
 // Bounded eviction avoids memory growth in pathological cases (huge peer
 // roster, brief request bursts) while staying generous for normal use.
@@ -60,16 +70,35 @@ type accountBucket struct {
 	order []tunnelCacheKey
 }
 
-// newTunnelValidationCache constructs a cache with default TTL and bounds.
+// newTunnelValidationCache constructs a cache with the configured TTL
+// (envTunnelCacheTTL override or default) and default bounds.
 func newTunnelValidationCache() *tunnelValidationCache {
 	return &tunnelValidationCache{
 		entries: make(map[types.AccountID]*accountBucket),
-		ttl:     tunnelCacheTTL,
+		ttl:     tunnelCacheTTLFromEnv(),
 		maxSize: tunnelCachePerAccount,
 		now:     time.Now,
 	}
 }
 
+// tunnelCacheTTLFromEnv returns the tunnel-cache TTL, honoring the
+// envTunnelCacheTTL override. The override must be a positive Go duration
+// string (e.g. "30s", "2m"); anything unset, unparseable, or non-positive
+// falls back to tunnelCacheTTL.
+func tunnelCacheTTLFromEnv() time.Duration {
+	raw := strings.TrimSpace(os.Getenv(envTunnelCacheTTL))
+	if raw == "" {
+		return tunnelCacheTTL
+	}
+	d, err := time.ParseDuration(raw)
+	if err != nil || d <= 0 {
+		log.Warnf("ignoring invalid %s=%q (want a positive Go duration like 30s or 2m); using default %s",
+			envTunnelCacheTTL, raw, tunnelCacheTTL)
+		return tunnelCacheTTL
+	}
+	return d
+}
+
 // get returns a cached response for the key, or nil when missing or
 // expired. Expired entries are evicted lazily on read.
 func (c *tunnelValidationCache) get(key tunnelCacheKey) *proto.ValidateTunnelPeerResponse {

proxy/internal/auth/tunnel_cache_test.go

@@ -169,3 +169,32 @@ func TestTunnelCache_BoundedSizeEvictsOldest(t *testing.T) {
 	assert.NotNil(t, cache.get(keys[1]), "second-newest must remain cached")
 	assert.NotNil(t, cache.get(keys[2]), "newest must remain cached")
 }
+
+func TestTunnelCacheTTLFromEnv(t *testing.T) {
+	t.Run("unset uses default", func(t *testing.T) {
+		t.Setenv(envTunnelCacheTTL, "")
+		assert.Equal(t, tunnelCacheTTL, tunnelCacheTTLFromEnv())
+	})
+	t.Run("valid duration overrides", func(t *testing.T) {
+		t.Setenv(envTunnelCacheTTL, "45s")
+		assert.Equal(t, 45*time.Second, tunnelCacheTTLFromEnv())
+	})
+	t.Run("whitespace trimmed", func(t *testing.T) {
+		t.Setenv(envTunnelCacheTTL, "  2m ")
+		assert.Equal(t, 2*time.Minute, tunnelCacheTTLFromEnv())
+	})
+	t.Run("unparseable uses default", func(t *testing.T) {
+		t.Setenv(envTunnelCacheTTL, "nonsense")
+		assert.Equal(t, tunnelCacheTTL, tunnelCacheTTLFromEnv())
+	})
+	t.Run("non-positive uses default", func(t *testing.T) {
+		t.Setenv(envTunnelCacheTTL, "0s")
+		assert.Equal(t, tunnelCacheTTL, tunnelCacheTTLFromEnv())
+		t.Setenv(envTunnelCacheTTL, "-30s")
+		assert.Equal(t, tunnelCacheTTL, tunnelCacheTTLFromEnv())
+	})
+	t.Run("constructor honors override", func(t *testing.T) {
+		t.Setenv(envTunnelCacheTTL, "90s")
+		assert.Equal(t, 90*time.Second, newTunnelValidationCache().ttl)
+	})
+}

proxy/internal/middleware/builtin/llm_guardrail/factory.go

@@ -10,11 +10,15 @@ import (
 )
 
 // Config is the JSON-decoded shape accepted by the factory. The
-// runtime path consumes the normalised allowlist; raw config is not
+// runtime path consumes the normalised allowlists; raw config is not
 // retained beyond construction.
 type Config struct {
-	ModelAllowlist []string      `json:"model_allowlist"`
-	PromptCapture  PromptCapture `json:"prompt_capture"`
+	// ProviderAllowlists maps a resolved provider id (KeyLLMResolvedProviderID) to
+	// its model allowlist. A provider present is restricted to those models; one
+	// absent is unrestricted. Kept per-provider so one provider's list can't leak
+	// onto another.
+	ProviderAllowlists map[string][]string `json:"provider_allowlists,omitempty"`
+	PromptCapture      PromptCapture       `json:"prompt_capture"`
 }
 
 // PromptCapture toggles the optional prompt capture + redaction step
@@ -54,21 +58,28 @@ func isEmptyJSON(raw []byte) bool {
 	return false
 }
 
-// normaliseConfig lowercases and trims allowlist entries so the runtime
-// match is case-insensitive. Empty entries are dropped.
+// normaliseConfig lowercases and trims allowlist entries for case-insensitive
+// matching; empty entries drop. A provider whose entries all drop keeps an empty
+// (non-nil) list — "deny every model" — distinct from an absent provider
+// (unrestricted).
 func normaliseConfig(cfg Config) Config {
-	if len(cfg.ModelAllowlist) == 0 {
+	if len(cfg.ProviderAllowlists) == 0 {
+		cfg.ProviderAllowlists = nil
 		return cfg
 	}
-	cleaned := make([]string, 0, len(cfg.ModelAllowlist))
-	for _, entry := range cfg.ModelAllowlist {
-		n := normaliseModel(entry)
-		if n == "" {
-			continue
+	cleaned := make(map[string][]string, len(cfg.ProviderAllowlists))
+	for provider, models := range cfg.ProviderAllowlists {
+		list := make([]string, 0, len(models))
+		for _, entry := range models {
+			n := normaliseModel(entry)
+			if n == "" {
+				continue
+			}
+			list = append(list, n)
 		}
-		cleaned = append(cleaned, n)
+		cleaned[provider] = list
 	}
-	cfg.ModelAllowlist = cleaned
+	cfg.ProviderAllowlists = cleaned
 	return cfg
 }
 

proxy/internal/middleware/builtin/llm_guardrail/middleware.go

@@ -83,8 +83,9 @@ func (m *Middleware) MutationsSupported() bool { return false }
 // prompt capture only affects the metadata emitted alongside an allow.
 func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middleware.Output, error) {
 	model, modelPresent := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
+	providerID, _ := lookupMetadata(in.Metadata, middleware.KeyLLMResolvedProviderID)
 
-	if denial := m.evaluateAllowlist(model, modelPresent); denial != nil {
+	if denial := m.evaluateAllowlist(providerID, model, modelPresent); denial != nil {
 		return denial, nil
 	}
 
@@ -110,20 +111,32 @@ func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middlewar
 // is a no-op.
 func (m *Middleware) Close() error { return nil }
 
-// evaluateAllowlist returns a deny Output when the configured allowlist
-// rejects the model. A nil return means the request should proceed.
-func (m *Middleware) evaluateAllowlist(model string, modelPresent bool) *middleware.Output {
-	if len(m.cfg.ModelAllowlist) == 0 {
+// evaluateAllowlist denies when the resolved provider's allowlist rejects the
+// model; nil means proceed. Scoped to the provider llm_router resolved, so an
+// unrestricted provider (absent from config) is never caught by another's list.
+func (m *Middleware) evaluateAllowlist(providerID, model string, modelPresent bool) *middleware.Output {
+	if len(m.cfg.ProviderAllowlists) == 0 {
 		return nil
 	}
-	// Fail closed: with an allowlist configured, a request whose model the
-	// upstream parser could not extract (absent or empty) must be denied rather
-	// than allowed. This is what enforces the allowlist for URL/path-routed
-	// providers (Bedrock, Vertex, ...) whose model lives outside the JSON body.
+	// Restrictions exist but the resolved provider is unknown, so we can't tell
+	// if this request targets a restricted provider — fail closed. llm_router
+	// normally stamps the provider first, so this is a defensive guard.
+	if providerID == "" {
+		return denyModel("", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
+	}
+	allowlist, restricted := m.cfg.ProviderAllowlists[providerID]
+	if !restricted {
+		// This provider has no allowlist (some authorising policy left it
+		// unrestricted); management owns any per-policy/group decision.
+		return nil
+	}
+	// Fail closed: with an allowlist in effect for this provider, a request whose
+	// model the parser couldn't extract (absent/empty) is denied. This enforces
+	// the allowlist for path-routed providers (Bedrock, Vertex) with no body model.
 	if !modelPresent || normaliseModel(model) == "" {
 		return denyModel("", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
 	}
-	if m.modelInAllowlist(model) {
+	if modelInAllowlist(allowlist, model) {
 		return nil
 	}
 	return denyModel(model, denyCodeModel, denyMessageModel, denyReasonModel)
@@ -151,14 +164,15 @@ func denyModel(model, code, message, reason string) *middleware.Output {
 	}
 }
 
-// modelInAllowlist reports whether the model matches any allowlist
-// entry under the case-insensitive, trim-tolerant comparison rule.
-func (m *Middleware) modelInAllowlist(model string) bool {
+// modelInAllowlist reports whether the model matches any entry in the supplied
+// (already-normalised) allowlist under the case-insensitive, trim-tolerant
+// comparison rule.
+func modelInAllowlist(allowlist []string, model string) bool {
 	normalised := normaliseModel(model)
 	if normalised == "" {
 		return false
 	}
-	for _, allowed := range m.cfg.ModelAllowlist {
+	for _, allowed := range allowlist {
 		if allowed == normalised {
 			return true
 		}

proxy/internal/middleware/builtin/llm_guardrail/middleware_test.go

@@ -26,6 +26,25 @@ func newInput(meta ...middleware.KV) *middleware.Input {
 	return &middleware.Input{Slot: middleware.SlotOnRequest, Metadata: meta}
 }
 
+const (
+	testProvider  = "prov-1"
+	otherProvider = "prov-2"
+)
+
+// providerCfg builds a Config restricting testProvider to the given models.
+func providerCfg(models ...string) Config {
+	return Config{ProviderAllowlists: map[string][]string{testProvider: models}}
+}
+
+// newInputProvider builds an input that carries a resolved provider id (as
+// llm_router would stamp) plus any extra metadata.
+func newInputProvider(provider string, meta ...middleware.KV) *middleware.Input {
+	all := make([]middleware.KV, 0, len(meta)+1)
+	all = append(all, middleware.KV{Key: middleware.KeyLLMResolvedProviderID, Value: provider})
+	all = append(all, meta...)
+	return &middleware.Input{Slot: middleware.SlotOnRequest, Metadata: all}
+}
+
 func TestMiddlewareIdentity(t *testing.T) {
 	mw := New(Config{})
 	assert.Equal(t, ID, mw.ID(), "middleware ID must be llm_guardrail")
@@ -47,12 +66,12 @@ func TestMiddlewareIdentity(t *testing.T) {
 
 func TestAllowlistEmptyAllowsAnyModel(t *testing.T) {
 	mw := New(Config{})
-	out, err := mw.Invoke(context.Background(), newInput(
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
 		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
 	))
 	require.NoError(t, err)
 	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionAllow, out.Decision, "empty allowlist must allow any model")
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "no provider allowlists must allow any model")
 	v, ok := metaValue(t, out.Metadata, middleware.KeyLLMPolicyDecision)
 	require.True(t, ok, "decision metadata must be emitted")
 	assert.Equal(t, "allow", v, "decision must be allow")
@@ -62,8 +81,8 @@ func TestAllowlistEmptyAllowsAnyModel(t *testing.T) {
 }
 
 func TestAllowlistMatchAllows(t *testing.T) {
-	mw := New(Config{ModelAllowlist: []string{"gpt-4o", "claude-opus-4"}})
-	out, err := mw.Invoke(context.Background(), newInput(
+	mw := New(providerCfg("gpt-4o", "claude-opus-4"))
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
 		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
 	))
 	require.NoError(t, err)
@@ -71,8 +90,8 @@ func TestAllowlistMatchAllows(t *testing.T) {
 }
 
 func TestAllowlistMissDenies(t *testing.T) {
-	mw := New(Config{ModelAllowlist: []string{"gpt-4o"}})
-	out, err := mw.Invoke(context.Background(), newInput(
+	mw := New(providerCfg("gpt-4o"))
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
 		middleware.KV{Key: middleware.KeyLLMModel, Value: "claude-opus-4"},
 	))
 	require.NoError(t, err)
@@ -91,10 +110,10 @@ func TestAllowlistMissDenies(t *testing.T) {
 }
 
 func TestAllowlistCaseInsensitive(t *testing.T) {
-	mw := New(Config{ModelAllowlist: []string{"  GPT-4o  ", "Claude-OPUS-4"}})
+	mw := New(providerCfg("  GPT-4o  ", "Claude-OPUS-4"))
 	cases := []string{"gpt-4o", "GPT-4O", "  claude-opus-4 "}
 	for _, model := range cases {
-		out, err := mw.Invoke(context.Background(), newInput(
+		out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
 			middleware.KV{Key: middleware.KeyLLMModel, Value: model},
 		))
 		require.NoError(t, err)
@@ -103,14 +122,15 @@ func TestAllowlistCaseInsensitive(t *testing.T) {
 }
 
 func TestAllowlistMissingModelKeyDenies(t *testing.T) {
-	// Fail closed: with an allowlist configured, a request whose model the
-	// parser could not extract (URL/path-routed providers such as Bedrock or
-	// Vertex whose shape wasn't recognised) must be denied, not allowed.
-	mw := New(Config{ModelAllowlist: []string{"gpt-4o"}})
-	out, err := mw.Invoke(context.Background(), newInput())
+	// Fail closed: with an allowlist in effect for the resolved provider, a
+	// request whose model the parser could not extract (URL/path-routed
+	// providers such as Bedrock or Vertex whose shape wasn't recognised) must be
+	// denied, not allowed.
+	mw := New(providerCfg("gpt-4o"))
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider))
 	require.NoError(t, err)
 	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionDeny, out.Decision, "absent model must be denied when an allowlist is set")
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "absent model must be denied when the provider is restricted")
 	assert.Equal(t, 403, out.DenyStatus, "deny status must be 403")
 	require.NotNil(t, out.DenyReason, "deny reason must be populated")
 	assert.Equal(t, "llm_policy.model_unknown", out.DenyReason.Code, "deny code must be model_unknown")
@@ -122,26 +142,101 @@ func TestAllowlistMissingModelKeyDenies(t *testing.T) {
 
 func TestAllowlistEmptyModelValueDenies(t *testing.T) {
 	// A present-but-empty model is as undeterminable as an absent one.
-	mw := New(Config{ModelAllowlist: []string{"gpt-4o"}})
-	out, err := mw.Invoke(context.Background(), newInput(
+	mw := New(providerCfg("gpt-4o"))
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
 		middleware.KV{Key: middleware.KeyLLMModel, Value: "   "},
 	))
 	require.NoError(t, err)
 	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionDeny, out.Decision, "empty model must be denied when an allowlist is set")
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "empty model must be denied when the provider is restricted")
 	require.NotNil(t, out.DenyReason, "deny reason must be populated")
 	assert.Equal(t, "llm_policy.model_unknown", out.DenyReason.Code, "deny code must be model_unknown")
 }
 
 func TestAllowlistEmptyListAllowsMissingModel(t *testing.T) {
-	// Without an allowlist there is nothing to enforce, so a missing model is
-	// still allowed — the fail-closed rule only applies when a list is set.
+	// Without any provider allowlists there is nothing to enforce, so a missing
+	// model is still allowed — the fail-closed rule only applies when a
+	// restriction is in effect.
 	mw := New(Config{})
 	out, err := mw.Invoke(context.Background(), newInput())
 	require.NoError(t, err)
 	assert.Equal(t, middleware.DecisionAllow, out.Decision, "no allowlist must allow even without a model")
 }
 
+func TestUnrestrictedProviderAllowsAnyModel(t *testing.T) {
+	// The request resolved to otherProvider, which has no allowlist, so its
+	// traffic must not be caught by testProvider's restriction — the
+	// cross-provider-leak / false-deny guard.
+	mw := New(providerCfg("gpt-4o"))
+	out, err := mw.Invoke(context.Background(), newInputProvider(otherProvider,
+		middleware.KV{Key: middleware.KeyLLMModel, Value: "claude-opus-4"},
+	))
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "an unrestricted provider must not inherit another provider's allowlist")
+}
+
+func TestPerProviderAllowlistsAreIsolated(t *testing.T) {
+	// gpt-4o is allowed only on testProvider; claude-opus-4 only on
+	// otherProvider. A model allowlisted for one provider must not be usable on
+	// the other — the fail-closed layer never unions allowlists across providers.
+	mw := New(Config{ProviderAllowlists: map[string][]string{
+		testProvider:  {"gpt-4o"},
+		otherProvider: {"claude-opus-4"},
+	}})
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+		middleware.KV{Key: middleware.KeyLLMModel, Value: "claude-opus-4"},
+	))
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "claude-opus-4 is allowed only on otherProvider, not testProvider")
+	require.NotNil(t, out.DenyReason)
+	assert.Equal(t, "llm_policy.model_blocked", out.DenyReason.Code, "cross-provider model must be blocked, not model_unknown")
+}
+
+func TestRestrictionsButNoResolvedProviderFailsClosed(t *testing.T) {
+	// Restrictions exist for the account but the resolved provider id is absent,
+	// so the request cannot be scoped to a provider. Fail closed rather than
+	// wave it through.
+	mw := New(providerCfg("gpt-4o"))
+	out, err := mw.Invoke(context.Background(), newInput(
+		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+	))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "missing resolved provider must fail closed when restrictions exist")
+	require.NotNil(t, out.DenyReason)
+	assert.Equal(t, "llm_policy.model_unknown", out.DenyReason.Code, "deny code must be model_unknown")
+}
+
+func TestEnabledButEmptyAllowlistDeniesEveryModel(t *testing.T) {
+	// An allowlist-enabled provider with zero models is distinct from an
+	// unrestricted (absent) provider: it must deny every model.
+	mw := New(providerCfg())
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+	))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "an enabled-but-empty allowlist must deny every model")
+	require.NotNil(t, out.DenyReason)
+	assert.Equal(t, "llm_policy.model_blocked", out.DenyReason.Code, "deny code must be model_blocked, not model_unknown")
+}
+
+func TestFactoryAllEmptyEntriesDenyEveryModel(t *testing.T) {
+	// All the provider's entries are blank; they collapse to a non-nil empty
+	// list (deny everything for that provider), not "no restriction".
+	raw := []byte(`{"provider_allowlists":{"prov-1":["","   "]}}`)
+	mw, err := Factory{}.New(raw)
+	require.NoError(t, err)
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+	))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "all-blank allowlist entries must still restrict the provider")
+	require.NotNil(t, out.DenyReason)
+	assert.Equal(t, "llm_policy.model_blocked", out.DenyReason.Code, "deny code must be model_blocked")
+}
+
 func TestPromptCaptureDisabledEmitsNoPrompt(t *testing.T) {
 	mw := New(Config{})
 	out, err := mw.Invoke(context.Background(), newInput(
@@ -217,8 +312,8 @@ func TestFactoryAcceptsZeroConfigs(t *testing.T) {
 
 func TestFactoryDecodesValidConfig(t *testing.T) {
 	cfg := Config{
-		ModelAllowlist: []string{"gpt-4o"},
-		PromptCapture:  PromptCapture{Enabled: true, RedactPii: true},
+		ProviderAllowlists: map[string][]string{testProvider: {"gpt-4o"}},
+		PromptCapture:      PromptCapture{Enabled: true, RedactPii: true},
 	}
 	raw, err := json.Marshal(cfg)
 	require.NoError(t, err, "marshalling test config must succeed")
@@ -234,15 +329,15 @@ func TestFactoryRejectsMalformedJSON(t *testing.T) {
 }
 
 func TestFactoryNormalisesAllowlist(t *testing.T) {
-	raw := []byte(`{"model_allowlist":["  GPT-4o  ","",""," Claude-3 "]}`)
+	raw := []byte(`{"provider_allowlists":{"prov-1":["  GPT-4o  ","",""," Claude-3 "]}}`)
 	mw, err := Factory{}.New(raw)
 	require.NoError(t, err)
-	out, err := mw.Invoke(context.Background(), newInput(
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
 		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
 	))
 	require.NoError(t, err)
 	assert.Equal(t, middleware.DecisionAllow, out.Decision, "factory must lowercase + trim allowlist entries")
-	out2, err := mw.Invoke(context.Background(), newInput(
+	out2, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
 		middleware.KV{Key: middleware.KeyLLMModel, Value: "claude-3"},
 	))
 	require.NoError(t, err)

proxy/internal/middleware/builtin/llm_limit_check/middleware.go

@@ -175,7 +175,7 @@ func denyFromManagement(resp *proto.CheckLLMPolicyLimitsResponse) *middleware.Ou
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
 			Code:    code,
-			Message: "LLM policy limit exceeded",
+			Message: denyMessageForCode(code),
 		},
 		Metadata: []middleware.KV{
 			{Key: middleware.KeyLLMPolicyDecision, Value: "deny"},
@@ -184,6 +184,21 @@ func denyFromManagement(resp *proto.CheckLLMPolicyLimitsResponse) *middleware.Ou
 	}
 }
 
+// denyMessageForCode maps a management deny code to a public message.
+// Model-allowlist rejections get a model-specific message matching the
+// local guardrail; everything else keeps the generic quota wording. The
+// message stays generic so it never leaks internal quota detail.
+func denyMessageForCode(code string) string {
+	switch code {
+	case "llm_policy.model_blocked":
+		return "model is not in the policy allowlist"
+	case "llm_policy.model_unknown":
+		return "request model could not be determined for the policy allowlist"
+	default:
+		return "LLM policy limit exceeded"
+	}
+}
+
 // lookupKV returns the value associated with key, or the empty
 // string when absent.
 func lookupKV(kvs []middleware.KV, key string) string {

proxy/internal/middleware/builtin/llm_limit_check/middleware_test.go

@@ -115,6 +115,46 @@ func TestInvoke_DenyConvertsToProxyDeny(t *testing.T) {
 	assert.NotContains(t, out.DenyReason.Message, "1000", "internal cap numbers must not reach the caller")
 }
 
+// TestInvoke_ModelDenyMessages proves a model-allowlist rejection gets a
+// model-specific public message rather than the generic quota wording, so a
+// blocked or undetermined model reads consistently with the local guardrail.
+func TestInvoke_ModelDenyMessages(t *testing.T) {
+	cases := []struct {
+		name    string
+		code    string
+		message string
+	}{
+		{"blocked", "llm_policy.model_blocked", "model is not in the policy allowlist"},
+		{"unknown", "llm_policy.model_unknown", "request model could not be determined for the policy allowlist"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			mgmt := &fakeMgmt{
+				checkResp: &proto.CheckLLMPolicyLimitsResponse{
+					Decision: "deny",
+					DenyCode: tc.code,
+				},
+			}
+			m := New(mgmt, nil)
+
+			out := runInvoke(t, m, &middleware.Input{
+				AccountID:  "acc-1",
+				UserGroups: []string{"grp-engineers"},
+				Metadata: []middleware.KV{
+					{Key: middleware.KeyLLMResolvedProviderID, Value: "prov-1"},
+					{Key: middleware.KeyLLMModel, Value: "some-model"},
+				},
+			})
+
+			assert.Equal(t, middleware.DecisionDeny, out.Decision)
+			require.NotNil(t, out.DenyReason, "deny envelope must carry a reason payload")
+			assert.Equal(t, tc.code, out.DenyReason.Code, "canonical deny code surfaces to the caller")
+			assert.Equal(t, tc.message, out.DenyReason.Message,
+				"model denials must use a model-specific message, matching the local guardrail")
+		})
+	}
+}
+
 // TestInvoke_NoMgmtClientPassesThrough proves the partial-wiring
 // safety: a middleware constructed without a management client
 // allows every request without attribution. This makes a half-set-up

proxy/internal/middleware/builtin/llm_request_parser/guardrail_allowlist_test.go

@@ -25,10 +25,17 @@ func runParserGuardrail(t *testing.T, url string, body []byte, allowlist []strin
 	})
 	require.NoError(t, err, "parser must not error")
 
-	guard := llm_guardrail.New(llm_guardrail.Config{ModelAllowlist: allowlist})
+	const providerID = "prov-under-test"
+	guard := llm_guardrail.New(llm_guardrail.Config{
+		ProviderAllowlists: map[string][]string{providerID: allowlist},
+	})
+	// The real chain has llm_router stamp the resolved provider id before the
+	// guardrail runs; the parser doesn't, so add it here so the guardrail can
+	// scope the allowlist to this provider.
+	meta := append([]middleware.KV{{Key: middleware.KeyLLMResolvedProviderID, Value: providerID}}, parsed.Metadata...)
 	out, err := guard.Invoke(context.Background(), &middleware.Input{
 		Slot:     middleware.SlotOnRequest,
-		Metadata: parsed.Metadata,
+		Metadata: meta,
 	})
 	require.NoError(t, err, "guardrail must not error")
 	require.NotNil(t, out, "guardrail must return an output")