[client] Resolve profiles for the sudo invoking user instead of root

The SSH server flags force `netbird up` through sudo, but the CLI resolved
every per-user path with the process user. As root that reads root's own
(empty) local state, so a `sudo netbird up` silently switched the daemon from
the user's profile to the default one — cancelling any login already waiting
in the browser — and then ran an SSO login for the default profile's config.
Whichever account that login returned, the default profile's peer belongs to
someone else, so every attempt ended in "peer is already registered by a
different User or a Setup Key", with nothing telling the user why.

Resolve the acting user through SUDO_USER when running as root: the active
profile, the profile config paths and the stored account email now come from
the invoking user's directories. Privilege decisions are untouched — they stay
on the kernel credentials of the daemon connection, which an environment
variable can never influence; a forged SUDO_USER only selects a profile root
could select anyway.

The invoking user's directories are strictly read-only under sudo. Anything
root wrote there would be root-owned and break the user's own runs, so instead
of chowning files back, the local writes are skipped: the active-profile
bookkeeping and the account-email state simply do not update from a sudo run
(the daemon records the switch on its side; a skipped email write costs at
most one extra account prompt later).

Plain root — no sudo context — has no user to act for, so the ambiguity is
refused instead of guessed at: when the daemon's active profile differs from
what root resolves and no --profile was given, up fails with a message naming
both profiles, instead of silently switching the daemon and failing later with
the ownership error.

agent-network/README.md

@@ -67,33 +67,6 @@ components:
   — the management-side control plane: providers, policies, guardrails, limits, routing,
   and usage/access logs.
 
-## Access roles
-
-Agent Network permissions build on the account permission matrix
-([`management/server/permissions/`](../management/server/permissions)). The
-`agent_network` area is split into dotted submodules (`agent_network.providers`,
-`.policies`, `.guardrails`, `.budgets`, `.usage`, `.logs`, `.settings`); a role may
-grant a single submodule or the parent, which cascades to all of them.
-
-Two roles delegate Agent Network access without account-admin rights:
-
-- **`agent_network_admin`** — full control over the whole `agent_network` area plus
-  read-only users, groups, peers, and account info (needed to build policies).
-  Nothing else in the account.
-- **`usage_viewer`** — the regular User baseline plus read on
-  `agent_network.usage` (the aggregated usage and cost overview) and read-only
-  access to the resources the usage filters resolve against: users, groups,
-  peers, and the provider list. No policies, no request-level access logs.
-
-Every authenticated user, regardless of role, can read the caller-scoped
-self-service endpoint `GET /api/agent-network/me/setup` (the endpoint, providers,
-and models the caller's own policies allow — what a local AI tool needs and nothing
-more). The regular usage and access-log endpoints self-scope instead of denying:
-a caller without the account-wide grant gets their own rows back, so "my usage"
-and "my requests" are the same endpoints the admin dashboard uses. Role
-definitions live in
-[`management/server/permissions/roles/`](../management/server/permissions/roles).
-
 ## Documentation
 
 Full documentation, architecture, and quickstart:

client/cmd/debug.go

@@ -3,7 +3,6 @@ package cmd
 import (
 	"context"
 	"fmt"
-	"os/user"
 	"strings"
 	"time"
 
@@ -114,7 +113,7 @@ func debugConfigDump(cmd *cobra.Command, _ []string) error {
 	if err != nil {
 		return fmt.Errorf("get active profile: %v", err)
 	}
-	currUser, err := user.Current()
+	currUser, err := profilemanager.InvokingUser()
 	if err != nil {
 		return fmt.Errorf("get current user: %v", err)
 	}

client/cmd/login.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"os"
-	"os/user"
 	"strings"
 
 	log "github.com/sirupsen/logrus"
@@ -53,7 +52,7 @@ var loginCmd = &cobra.Command{
 			// nolint
 			ctx = context.WithValue(ctx, system.DeviceNameCtxKey, hostName)
 		}
-		username, err := user.Current()
+		username, err := profilemanager.InvokingUser()
 		if err != nil {
 			return fmt.Errorf("get current user: %v", err)
 		}

client/cmd/logout.go

@@ -3,11 +3,11 @@ package cmd
 import (
 	"context"
 	"fmt"
-	"os/user"
 	"time"
 
 	"github.com/spf13/cobra"
 
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/proto"
 )
 
@@ -37,7 +37,7 @@ var logoutCmd = &cobra.Command{
 		if profileName != "" {
 			req.ProfileName = &profileName
 
-			currUser, err := user.Current()
+			currUser, err := profilemanager.InvokingUser()
 			if err != nil {
 				return fmt.Errorf("get current user: %v", err)
 			}

client/cmd/profile.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"os/user"
 	"strings"
 	"text/tabwriter"
 	"time"
@@ -97,7 +96,7 @@ func listProfilesFunc(cmd *cobra.Command, _ []string) error {
 	}
 	defer conn.Close()
 
-	currUser, err := user.Current()
+	currUser, err := profilemanager.InvokingUser()
 	if err != nil {
 		return fmt.Errorf("get current user: %w", err)
 	}
@@ -138,7 +137,7 @@ func addProfileFunc(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	currUser, err := user.Current()
+	currUser, err := profilemanager.InvokingUser()
 	if err != nil {
 		return fmt.Errorf("get current user: %w", err)
 	}
@@ -179,7 +178,7 @@ func renameProfileFunc(cmd *cobra.Command, args []string) error {
 	}
 	defer conn.Close()
 
-	currUser, err := user.Current()
+	currUser, err := profilemanager.InvokingUser()
 	if err != nil {
 		return fmt.Errorf("get current user: %w", err)
 	}
@@ -233,7 +232,7 @@ func removeProfileFunc(cmd *cobra.Command, args []string) error {
 	}
 	defer conn.Close()
 
-	currUser, err := user.Current()
+	currUser, err := profilemanager.InvokingUser()
 	if err != nil {
 		return fmt.Errorf("get current user: %w", err)
 	}
@@ -261,7 +260,7 @@ func selectProfileFunc(cmd *cobra.Command, args []string) error {
 	profileManager := profilemanager.NewProfileManager()
 	handle := args[0]
 
-	currUser, err := user.Current()
+	currUser, err := profilemanager.InvokingUser()
 	if err != nil {
 		return fmt.Errorf("get current user: %w", err)
 	}

client/cmd/up.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
-	"os/user"
 	"runtime"
 	"strings"
 	"time"
@@ -122,7 +121,7 @@ func upFunc(cmd *cobra.Command, args []string) error {
 
 	pm := profilemanager.NewProfileManager()
 
-	username, err := user.Current()
+	username, err := profilemanager.InvokingUser()
 	if err != nil {
 		return fmt.Errorf("get current user: %v", err)
 	}
@@ -295,6 +294,21 @@ func runInDaemonMode(ctx context.Context, cmd *cobra.Command, pm *profilemanager
 
 	client := proto.NewDaemonServiceClient(conn)
 
+	// Plain root has no invoking user to resolve profiles for, so the local
+	// state falls back to root's own — the default profile. Acting on that
+	// while the daemon runs another user's profile would silently switch the
+	// daemon away from it (and a later browser login would register the
+	// default profile's peer under whichever account the IdP returns). Refuse
+	// the ambiguity instead of guessing.
+	if profilemanager.IsPlainRoot() && profileName == "" {
+		if active, err := client.GetActiveProfile(ctx, &proto.GetActiveProfileRequest{}); err == nil &&
+			active.GetId() != "" && active.GetId() != activeProf.ID.String() {
+			return fmt.Errorf(
+				"running as root: the daemon's active profile is %q (user %q), but this invocation resolves to %q; pass --profile to choose one explicitly, or run via sudo from your own user",
+				active.GetProfileName(), active.GetUsername(), activeProf.ID)
+		}
+	}
+
 	status, err := client.Status(ctx, &proto.StatusRequest{
 		WaitForReady: func() *bool { b := true; return &b }(),
 	})
@@ -314,7 +328,7 @@ func runInDaemonMode(ctx context.Context, cmd *cobra.Command, pm *profilemanager
 		}
 	}
 
-	username, err := user.Current()
+	username, err := profilemanager.InvokingUser()
 	if err != nil {
 		return fmt.Errorf("get current user: %v", err)
 	}

client/internal/dns/host_windows.go

@@ -35,6 +35,8 @@ var (
 // exported so a diagnostic reader reports the same locations that are written.
 const (
 	// NRPTKeyPrefix starts the name of every NRPT rule key this client creates.
+	// Older versions used different layouts under the same prefix: a single
+	// unsuffixed key, then one key per domain, now one key per batch of domains.
 	NRPTKeyPrefix = "NetBird-Match"
 
 	// DNSPolicyConfigRoot holds the NRPT rules of the local policy store.
@@ -89,7 +91,6 @@ type registryConfigurator struct {
 	guid            string
 	routingAll      bool
 	gpo             bool
-	nrptEntryCount  int
 	origNameservers []netip.Addr
 }
 
@@ -322,14 +323,9 @@ func (r *registryConfigurator) applyDNSConfig(config HostDNSConfig, stateManager
 	}
 
 	if len(matchDomains) != 0 {
-		count, err := r.addDNSMatchPolicy(matchDomains, config.ServerIP)
-		// Update count even on error to ensure cleanup covers partially created rules
-		r.nrptEntryCount = count
-		if err != nil {
+		if err := r.addDNSMatchPolicy(matchDomains, config.ServerIP); err != nil {
 			return fmt.Errorf("add dns match policy: %w", err)
 		}
-	} else {
-		r.nrptEntryCount = 0
 	}
 
 	r.updateState(stateManager)
@@ -345,9 +341,8 @@ func (r *registryConfigurator) applyDNSConfig(config HostDNSConfig, stateManager
 
 func (r *registryConfigurator) updateState(stateManager *statemanager.Manager) {
 	if err := stateManager.UpdateState(&ShutdownState{
-		Guid:           r.guid,
-		GPO:            r.gpo,
-		NRPTEntryCount: r.nrptEntryCount,
+		Guid: r.guid,
+		GPO:  r.gpo,
 	}); err != nil {
 		log.Errorf("failed to update shutdown state: %s", err)
 	}
@@ -362,7 +357,7 @@ func (r *registryConfigurator) addDNSSetupForAll(ip netip.Addr) error {
 	return nil
 }
 
-func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr) (int, error) {
+func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr) error {
 	// if the gpo key is present, we need to put our DNS settings there, otherwise our config might be ignored
 	// see https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpnrpt/8cc31cb9-20cb-4140-9e85-3e08703b4745
 
@@ -379,19 +374,17 @@ func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr
 		gpoPath := fmt.Sprintf("%s-%d", gpoDnsPolicyConfigMatchPath, ruleIndex)
 
 		if err := r.configureDNSPolicy(localPath, batchDomains, ip); err != nil {
-			return ruleIndex, fmt.Errorf("configure DNS Local policy for rule %d: %w", ruleIndex, err)
+			return fmt.Errorf("configure DNS Local policy for rule %d: %w", ruleIndex, err)
 		}
 
-		// Increment immediately so the caller's cleanup path knows about this rule
-		ruleIndex++
-
 		if r.gpo {
 			if err := r.configureDNSPolicy(gpoPath, batchDomains, ip); err != nil {
-				return ruleIndex, fmt.Errorf("configure gpo DNS policy for rule %d: %w", ruleIndex-1, err)
+				return fmt.Errorf("configure gpo DNS policy for rule %d: %w", ruleIndex, err)
 			}
 		}
 
-		log.Debugf("added NRPT rule %d with %d domains", ruleIndex-1, len(batchDomains))
+		log.Debugf("added NRPT rule %d with %d domains", ruleIndex, len(batchDomains))
+		ruleIndex++
 	}
 
 	if r.gpo {
@@ -401,7 +394,7 @@ func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr
 	}
 
 	log.Infof("added %d NRPT rules for %d domains", ruleIndex, len(domains))
-	return ruleIndex, nil
+	return nil
 }
 
 func (r *registryConfigurator) configureDNSPolicy(policyPath string, domains []string, ip netip.Addr) error {
@@ -534,28 +527,28 @@ func (r *registryConfigurator) restoreHostDNS() error {
 	return nil
 }
 
+// removeDNSMatchPolicies deletes every NRPT rule this client may have created,
+// from the local and the GPO policy store. The rules are found by enumerating
+// the registry, the only authoritative record of what was written. Cleanup must
+// not depend on a rule count: the in-memory one is scoped to a single
+// registryConfigurator and the persisted one is deleted on every clean
+// disconnect, and a rule left behind keeps resolving names over an interface
+// that is gone, until reboot discards the volatile key.
 func (r *registryConfigurator) removeDNSMatchPolicies() error {
 	var merr *multierror.Error
 
-	// Try to remove the base entries (for backward compatibility)
-	if err := removeRegistryKeyFromDNSPolicyConfig(dnsPolicyConfigMatchPath); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("remove local base entry: %w", err))
-	}
-
-	if err := removeRegistryKeyFromDNSPolicyConfig(gpoDnsPolicyConfigMatchPath); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("remove GPO base entry: %w", err))
-	}
-
-	for i := 0; i < r.nrptEntryCount; i++ {
-		localPath := fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i)
-		gpoPath := fmt.Sprintf("%s-%d", gpoDnsPolicyConfigMatchPath, i)
-
-		if err := removeRegistryKeyFromDNSPolicyConfig(localPath); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("remove local entry %d: %w", i, err))
+	for _, root := range []string{DNSPolicyConfigRoot, GPODNSPolicyConfigRoot} {
+		names, err := listNRPTRuleKeys(root)
+		if err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("list rule keys under %s: %w", root, err))
+			continue
 		}
 
-		if err := removeRegistryKeyFromDNSPolicyConfig(gpoPath); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("remove GPO entry %d: %w", i, err))
+		for _, name := range names {
+			path := root + `\` + name
+			if err := removeRegistryKeyFromDNSPolicyConfig(path); err != nil {
+				merr = multierror.Append(merr, fmt.Errorf("remove entry %s: %w", path, err))
+			}
 		}
 	}
 
@@ -570,6 +563,39 @@ func (r *registryConfigurator) restoreUncleanShutdownDNS() error {
 	return r.restoreHostDNS()
 }
 
+// listNRPTRuleKeys returns the names of our NRPT rule keys under a policy store
+// root. An absent root holds nothing to clean up, which is the normal state of
+// the GPO store on a machine without DNS Client policy.
+func listNRPTRuleKeys(root string) ([]string, error) {
+	k, err := registry.OpenKey(registry.LOCAL_MACHINE, root, registry.ENUMERATE_SUB_KEYS)
+	switch {
+	case errors.Is(err, registry.ErrNotExist), errors.Is(err, syscall.ERROR_PATH_NOT_FOUND):
+		// the GPO store is absent on a machine without DNS client policy
+		log.Debugf("HKEY_LOCAL_MACHINE\\%s does not exist", root)
+		return nil, nil
+	case err != nil:
+		// any other failure has to reach the caller: reporting no rules would
+		// report a successful cleanup while leaving the rules in place
+		return nil, fmt.Errorf("open HKEY_LOCAL_MACHINE\\%s: %w", root, err)
+	}
+	defer closer(k)
+
+	names, err := k.ReadSubKeyNames(-1)
+	if err != nil {
+		return nil, fmt.Errorf("read subkey names: %w", err)
+	}
+
+	var ruleKeys []string
+	for _, name := range names {
+		// registry key names are case insensitive
+		if strings.HasPrefix(strings.ToLower(name), strings.ToLower(NRPTKeyPrefix)) {
+			ruleKeys = append(ruleKeys, name)
+		}
+	}
+
+	return ruleKeys, nil
+}
+
 func removeRegistryKeyFromDNSPolicyConfig(regKeyPath string) error {
 	k, err := registry.OpenKey(registry.LOCAL_MACHINE, regKeyPath, registry.QUERY_VALUE)
 	if err != nil {

client/internal/dns/host_windows_test.go

@@ -25,7 +25,7 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 
 	// Create a test interface registry key so updateSearchDomains doesn't fail
 	testGUID := "{12345678-1234-1234-1234-123456789ABC}"
-	interfacePath := `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\` + testGUID
+	interfacePath := InterfaceConfigPath + `\` + testGUID
 	testKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, interfacePath, registry.SET_VALUE)
 	require.NoError(t, err, "Should create test interface registry key")
 	testKey.Close()
@@ -56,7 +56,7 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 	require.NoError(t, err)
 
 	// Verify 3 NRPT rules exist
-	assert.Equal(t, 3, cfg.nrptEntryCount, "Should create 3 NRPT rules for 125 domains")
+	assert.Equal(t, 3, countNRPTRuleKeys(t), "Should create 3 NRPT rules for 125 domains")
 	for i := 0; i < 3; i++ {
 		exists, err := registryKeyExists(fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i))
 		require.NoError(t, err)
@@ -81,7 +81,7 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 	require.NoError(t, err)
 
 	// Verify first 2 NRPT rules exist
-	assert.Equal(t, 2, cfg.nrptEntryCount, "Should create 2 NRPT rules for 75 domains")
+	assert.Equal(t, 2, countNRPTRuleKeys(t), "Should create 2 NRPT rules for 75 domains")
 	for i := 0; i < 2; i++ {
 		exists, err := registryKeyExists(fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i))
 		require.NoError(t, err)
@@ -106,9 +106,65 @@ func registryKeyExists(path string) (bool, error) {
 	return true, nil
 }
 
+// TestNRPTCleanupWithoutRuleCount verifies that rules written by a previous run
+// are removed by a configurator that has no record of how many there are: an
+// unclean exit loses the in-memory count and a clean disconnect deletes the
+// persisted one, so cleanup cannot depend on either.
+func TestNRPTCleanupWithoutRuleCount(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping registry integration test in short mode")
+	}
+
+	defer cleanupRegistryKeys(t)
+	cleanupRegistryKeys(t)
+
+	testIP := netip.MustParseAddr("100.64.0.1")
+
+	// 75 domains produce two indexed rules, as the current layout does
+	domains := make([]string, 75)
+	for i := range domains {
+		domains[i] = fmt.Sprintf(".domain%d.com", i+1)
+	}
+
+	previousRun := &registryConfigurator{}
+	require.NoError(t, previousRun.addDNSMatchPolicy(domains, testIP))
+
+	// the unsuffixed key an older version would have written
+	require.NoError(t, previousRun.configureDNSPolicy(dnsPolicyConfigMatchPath, []string{".legacy.example.com"}, testIP))
+
+	// a policy owned by someone else, which cleanup must not touch
+	foreignPath := DNSPolicyConfigRoot + `\DnsPolicyConfigTestForeign`
+	foreignKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, foreignPath, registry.SET_VALUE)
+	require.NoError(t, err, "Should create foreign policy key")
+	foreignKey.Close()
+	defer func() {
+		_ = registry.DeleteKey(registry.LOCAL_MACHINE, foreignPath)
+	}()
+
+	require.Equal(t, 3, countNRPTRuleKeys(t), "Should have two indexed rules and the legacy one")
+
+	// a configurator that never applied a DNS config, as one built after a
+	// restart or from a shutdown state without a count is
+	freshRun := &registryConfigurator{}
+	require.NoError(t, freshRun.removeDNSMatchPolicies())
+
+	assert.Equal(t, 0, countNRPTRuleKeys(t), "Should remove every rule left by the previous run")
+
+	exists, err := registryKeyExists(foreignPath)
+	require.NoError(t, err)
+	assert.True(t, exists, "Should not remove a policy that is not ours")
+}
+
+func countNRPTRuleKeys(t *testing.T) int {
+	t.Helper()
+
+	names, err := listNRPTRuleKeys(DNSPolicyConfigRoot)
+	require.NoError(t, err, "Should list NRPT rule keys")
+	return len(names)
+}
+
 func cleanupRegistryKeys(*testing.T) {
-	// Clean up more entries to account for batching tests with many domains
-	cfg := &registryConfigurator{nrptEntryCount: 20}
+	cfg := &registryConfigurator{}
 	_ = cfg.removeDNSMatchPolicies()
 }
 
@@ -125,7 +181,7 @@ func TestNRPTDomainBatching(t *testing.T) {
 
 	// Create a test interface registry key so updateSearchDomains doesn't fail
 	testGUID := "{12345678-1234-1234-1234-123456789ABC}"
-	interfacePath := `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\` + testGUID
+	interfacePath := InterfaceConfigPath + `\` + testGUID
 	testKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, interfacePath, registry.SET_VALUE)
 	require.NoError(t, err, "Should create test interface registry key")
 	testKey.Close()
@@ -193,7 +249,7 @@ func TestNRPTDomainBatching(t *testing.T) {
 			require.NoError(t, err)
 
 			// Verify that exactly expectedRuleCount rules were created
-			assert.Equal(t, tc.expectedRuleCount, cfg.nrptEntryCount,
+			assert.Equal(t, tc.expectedRuleCount, countNRPTRuleKeys(t),
 				"Should create %d NRPT rules for %d domains", tc.expectedRuleCount, tc.domainCount)
 
 			// Verify all expected rules exist

client/internal/dns/unclean_shutdown_windows.go

@@ -5,9 +5,8 @@ import (
 )
 
 type ShutdownState struct {
-	Guid           string
-	GPO            bool
-	NRPTEntryCount int
+	Guid string
+	GPO  bool
 }
 
 func (s *ShutdownState) Name() string {
@@ -16,9 +15,8 @@ func (s *ShutdownState) Name() string {
 
 func (s *ShutdownState) Cleanup() error {
 	manager := &registryConfigurator{
-		guid:           s.Guid,
-		gpo:            s.GPO,
-		nrptEntryCount: s.NRPTEntryCount,
+		guid: s.Guid,
+		gpo:  s.GPO,
 	}
 
 	if err := manager.restoreUncleanShutdownDNS(); err != nil {

client/internal/ebpf/ebpf/manager_linux.go

@@ -2,17 +2,21 @@ package ebpf
 
 import (
 	_ "embed"
+	"fmt"
 	"net"
 	"sync"
 
 	"github.com/cilium/ebpf/link"
 	"github.com/cilium/ebpf/rlimit"
 	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/unix"
 
 	"github.com/netbirdio/netbird/client/internal/ebpf/manager"
 )
 
 const (
+	xdpProgName = "nb_xdp_prog"
+
 	mapKeyFeatures uint32 = 0
 
 	featureFlagWGProxy      = 0b00000001
@@ -68,21 +72,50 @@ func (tf *GeneralManager) loadXdp() error {
 		return err
 	}
 
-	// load pre-compiled programs into the kernel.
-	err = loadBpfObjects(&tf.bpfObjs, nil)
+	// lo has no native XDP, so the program runs in generic mode. Unless it
+	// declares multi-buffer support the kernel must linearize every non-linear
+	// skb before running it. Loopback packets are up to 64 KB, so that is a
+	// contiguous GFP_ATOMIC allocation per packet, and when it fails the packet
+	// is dropped before the program runs, stalling local TCP connections.
+	// Multi-buffer XDP in generic mode requires kernel 6.3, so fall back to a
+	// plain attach when the kernel rejects it.
+	err = tf.attachXdp(iFace.Index, true)
+	if err == nil {
+		return nil
+	}
+	log.Debugf("failed to attach multi-buffer xdp program, retrying without it: %s", err)
+
+	return tf.attachXdp(iFace.Index, false)
+}
+
+func (tf *GeneralManager) attachXdp(iFaceIndex int, multiBuffer bool) error {
+	spec, err := loadBpf()
 	if err != nil {
-		return err
+		return fmt.Errorf("load bpf spec: %w", err)
+	}
+
+	if multiBuffer {
+		prog, ok := spec.Programs[xdpProgName]
+		if !ok {
+			return fmt.Errorf("program %s not found in bpf spec", xdpProgName)
+		}
+		prog.Flags |= unix.BPF_F_XDP_HAS_FRAGS
+	}
+
+	if err := spec.LoadAndAssign(&tf.bpfObjs, nil); err != nil {
+		return fmt.Errorf("load bpf objects: %w", err)
 	}
 
 	tf.link, err = link.AttachXDP(link.XDPOptions{
 		Program:   tf.bpfObjs.NbXdpProg,
-		Interface: iFace.Index,
+		Interface: iFaceIndex,
 	})
-
 	if err != nil {
-		_ = tf.bpfObjs.Close()
+		if closeErr := tf.bpfObjs.Close(); closeErr != nil {
+			log.Debugf("failed to close bpf objects after xdp attach error: %s", closeErr)
+		}
 		tf.link = nil
-		return err
+		return fmt.Errorf("attach xdp: %w", err)
 	}
 	return nil
 }

client/internal/profilemanager/config.go

@@ -217,6 +217,12 @@ func getConfigDir() (string, error) {
 	}
 
 	configDir := filepath.Join(base, "netbird")
+	// Under sudo this is the invoking user's directory and strictly read-only:
+	// anything root creates in it would be root-owned and break the user's own
+	// runs. Reads of a missing directory fall through to defaults.
+	if _, sudo := sudoInvokingUser(); sudo {
+		return configDir, nil
+	}
 	if err := os.MkdirAll(configDir, 0o755); err != nil {
 		return "", err
 	}
@@ -224,6 +230,9 @@ func getConfigDir() (string, error) {
 }
 
 func baseConfigDir() (string, error) {
+	if u, ok := sudoInvokingUser(); ok {
+		return userBaseConfigDir(u)
+	}
 	if runtime.GOOS == "darwin" {
 		if u, err := user.Current(); err == nil && u.HomeDir != "" {
 			return filepath.Join(u.HomeDir, "Library", "Application Support"), nil

client/internal/profilemanager/invoking_user.go

@@ -0,0 +1,69 @@
+package profilemanager
+
+import (
+	"fmt"
+	"os"
+	"os/user"
+	"path/filepath"
+	"runtime"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// InvokingUser returns the user a CLI invocation acts for. Under sudo that is
+// the user who ran sudo, not root: privileged flags force commands through
+// sudo, and resolving profiles as root would silently switch the daemon to
+// root's (default) profile instead of the invoking user's. Privilege decisions
+// are not made here — those stay on the kernel credentials of the daemon
+// connection, which SUDO_USER (a plain environment variable) can never
+// influence; a forged value only selects a profile root could select anyway.
+func InvokingUser() (*user.User, error) {
+	if u, ok := sudoInvokingUser(); ok {
+		return u, nil
+	}
+	return user.Current()
+}
+
+// IsPlainRoot reports that the process runs as root with no usable sudo
+// context: there is no invoking user to act for, so per-user resolution falls
+// back to root's own (empty) state. Callers use it to refuse ambiguous
+// operations instead of silently acting on the wrong profile.
+func IsPlainRoot() bool {
+	if os.Geteuid() != 0 {
+		return false
+	}
+	_, ok := sudoInvokingUser()
+	return !ok
+}
+
+// sudoInvokingUser resolves SUDO_USER when the process runs as root under
+// sudo. Returns false whenever the sudo context is absent or unusable, in
+// which case callers fall back to the process user.
+func sudoInvokingUser() (*user.User, bool) {
+	if os.Geteuid() != 0 {
+		return nil, false
+	}
+	name := os.Getenv("SUDO_USER")
+	if name == "" || name == "root" {
+		return nil, false
+	}
+	u, err := user.Lookup(name)
+	if err != nil {
+		log.Warnf("failed to look up sudo invoking user %q, acting as root: %v", name, err)
+		return nil, false
+	}
+	return u, true
+}
+
+// userBaseConfigDir mirrors os.UserConfigDir for a user other than the process
+// owner. Environment overrides (XDG_CONFIG_HOME) cannot be honoured here: under
+// sudo the environment is root's, not the invoking user's.
+func userBaseConfigDir(u *user.User) (string, error) {
+	if u.HomeDir == "" {
+		return "", fmt.Errorf("user %s has no home directory", u.Username)
+	}
+	if runtime.GOOS == "darwin" {
+		return filepath.Join(u.HomeDir, "Library", "Application Support"), nil
+	}
+	return filepath.Join(u.HomeDir, ".config"), nil
+}

client/internal/profilemanager/invoking_user_test.go

@@ -0,0 +1,57 @@
+package profilemanager
+
+import (
+	"os"
+	"os/user"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestInvokingUserFallsBackToProcessUser(t *testing.T) {
+	t.Setenv("SUDO_USER", "")
+
+	got, err := InvokingUser()
+	require.NoError(t, err)
+
+	current, err := user.Current()
+	require.NoError(t, err)
+	assert.Equal(t, current.Username, got.Username)
+}
+
+func TestSudoInvokingUserInactiveWithoutSudoContext(t *testing.T) {
+	t.Setenv("SUDO_USER", "")
+	_, ok := sudoInvokingUser()
+	assert.False(t, ok)
+}
+
+func TestSudoInvokingUserIgnoresRoot(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("needs root to enter the sudo branch")
+	}
+	t.Setenv("SUDO_USER", "root")
+	_, ok := sudoInvokingUser()
+	assert.False(t, ok, "sudo from a root shell must not redirect anything")
+}
+
+func TestUserBaseConfigDir(t *testing.T) {
+	u := &user.User{Username: "misha", HomeDir: filepath.Join("/home", "misha")}
+	dir, err := userBaseConfigDir(u)
+	require.NoError(t, err)
+	if runtime.GOOS == "darwin" {
+		assert.Equal(t, filepath.Join(u.HomeDir, "Library", "Application Support"), dir)
+	} else {
+		assert.Equal(t, filepath.Join(u.HomeDir, ".config"), dir)
+	}
+
+	_, err = userBaseConfigDir(&user.User{Username: "nohome"})
+	require.Error(t, err)
+}
+
+func TestIsPlainRoot(t *testing.T) {
+	t.Setenv("SUDO_USER", "")
+	assert.Equal(t, os.Geteuid() == 0, IsPlainRoot())
+}

client/internal/profilemanager/profilemanager.go

@@ -3,7 +3,6 @@ package profilemanager
 import (
 	"fmt"
 	"os"
-	"os/user"
 	"path/filepath"
 	"strings"
 	"sync"
@@ -54,7 +53,7 @@ func (p *Profile) FilePath() (string, error) {
 		return "", fmt.Errorf("invalid profile ID: %q", id)
 	}
 
-	username, err := user.Current()
+	username, err := InvokingUser()
 	if err != nil {
 		return "", fmt.Errorf("failed to get current user: %w", err)
 	}
@@ -130,7 +129,7 @@ func (pm *ProfileManager) getActiveProfileState() ID {
 	if err != nil {
 		if !os.IsNotExist(err) {
 			log.Warnf("failed to read active profile state: %v", err)
-		} else {
+		} else if _, sudo := sudoInvokingUser(); !sudo {
 			if err := pm.setActiveProfileState(defaultProfileName); err != nil {
 				log.Warnf("failed to set default profile state: %v", err)
 			}
@@ -148,6 +147,13 @@ func (pm *ProfileManager) getActiveProfileState() ID {
 }
 
 func (pm *ProfileManager) setActiveProfileState(id ID) error {
+	// The invoking user's state is read-only under sudo — a root-owned file in
+	// the user's directory would break their own runs. The daemon still records
+	// the switch on its side; only the user-local bookkeeping is skipped.
+	if u, sudo := sudoInvokingUser(); sudo {
+		log.Infof("running under sudo: not persisting active profile %q for user %s", id, u.Username)
+		return nil
+	}
 
 	configDir, err := getConfigDir()
 	if err != nil {

client/internal/profilemanager/state.go

@@ -7,6 +7,8 @@ import (
 	"os"
 	"path/filepath"
 
+	log "github.com/sirupsen/logrus"
+
 	"github.com/netbirdio/netbird/util"
 )
 
@@ -63,6 +65,15 @@ func (pm *ProfileManager) SetProfileState(id ID, state *ProfileState) error {
 		return fmt.Errorf("invalid profile ID: %q", id)
 	}
 
+	// The invoking user's state is read-only under sudo. The file only carries
+	// the account email for the login hint and display, so skipping the write
+	// costs at most one extra account prompt later — a root-owned file in the
+	// user's directory would cost every later update instead.
+	if u, sudo := sudoInvokingUser(); sudo {
+		log.Debugf("running under sudo: not persisting profile state for user %s", u.Username)
+		return nil
+	}
+
 	stateFile := filepath.Join(configDir, id.String()+".state.json")
 	if err := util.WriteJsonWithRestrictedPermission(context.Background(), stateFile, state); err != nil {
 		return fmt.Errorf("write profile state: %w", err)

go.mod

@@ -19,7 +19,7 @@ require (
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/vishvananda/netlink v1.3.1
-	golang.org/x/crypto v0.54.0
+	golang.org/x/crypto v0.55.0
 	golang.org/x/sys v0.47.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
@@ -127,9 +127,9 @@ require (
 	go.uber.org/zap v1.27.0
 	goauthentik.io/api/v3 v3.2023051.3
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
-	golang.org/x/mobile v0.0.0-20251113184115-a159579294ab
-	golang.org/x/mod v0.37.0
-	golang.org/x/net v0.56.0
+	golang.org/x/mobile v0.0.0-20260816165457-f98cc9b3c733
+	golang.org/x/mod v0.39.0
+	golang.org/x/net v0.58.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.22.0
 	golang.org/x/term v0.45.0
@@ -313,8 +313,8 @@ require (
 	go.opentelemetry.io/otel/trace v1.43.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
-	golang.org/x/text v0.40.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect

go.sum

@@ -728,13 +728,13 @@ golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1m
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mobile v0.0.0-20251113184115-a159579294ab h1:Iqyc+2zr7aGyLuEadIm0KRJP0Wwt+fhlXLa51Fxf1+Q=
-golang.org/x/mobile v0.0.0-20251113184115-a159579294ab/go.mod h1:Eq3Nh/5pFSWug2ohiudJ1iyU59SO78QFuh4qTTN++I0=
+golang.org/x/mobile v0.0.0-20260816165457-f98cc9b3c733 h1:XKMObIaAElmkdO+4SQh1iCfzwciZHJi1OblnX9BED9k=
+golang.org/x/mobile v0.0.0-20260816165457-f98cc9b3c733/go.mod h1:jMwjxoDSx9jqhNaZqPnr6nnKzb7cs+Dy1Czk7wdX+R8=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -744,8 +744,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.39.0 h1:UF5zwQdCRRUpHfyPwr7d4UrGiVeldIsogtzWVnczL74=
+golang.org/x/mod v0.39.0/go.mod h1:bvIbwjQ0HUFFf5AKukeeYQG4ZBUG9yxQbR9aEweIwYY=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
@@ -764,8 +764,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
@@ -843,8 +843,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -858,8 +858,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

infrastructure_files/migrate-to-enterprise.sh

@@ -221,9 +221,6 @@ render_override() {
 # Remove this file (and config.yaml.enterprise if present) to revert.
 
 services:
-  ${DASHBOARD_SERVICE}:
-    image: \${NETBIRD_DASHBOARD_IMAGE:-ghcr.io/netbirdio/dashboard-cloud:latest}
-
   ${COMBINED_SERVICE}:
     image: \${NETBIRD_SERVER_IMAGE:-ghcr.io/netbirdio/netbird-server-cloud:latest}
     environment:

management/internals/modules/agentnetwork/handlers/me_handler.go

@@ -1,56 +0,0 @@
-package handlers
-
-import (
-	"net/http"
-
-	"github.com/gorilla/mux"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	nbcontext "github.com/netbirdio/netbird/management/server/context"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-	"github.com/netbirdio/netbird/shared/management/http/util"
-)
-
-// addMeEndpoints registers the self-service "My Agent Network" route.
-// It is available to every authenticated user regardless of role: the
-// response is scoped strictly to the caller, which is tighter than any
-// role gate could be. The caller's own usage and requests are served by
-// the regular usage/logs endpoints, which self-scope for callers without
-// the account-wide grants.
-func (h *handler) addMeEndpoints(router *mux.Router) {
-	router.HandleFunc("/agent-network/me/setup", h.getMySetup).Methods("GET", "OPTIONS")
-}
-
-func (h *handler) getMySetup(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	setup, err := h.manager.GetSetupForUser(r.Context(), userAuth.AccountId, userAuth.UserId)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	util.WriteJSONObject(r.Context(), w, setupToAPI(setup))
-}
-
-func setupToAPI(setup *types.EffectiveSetup) api.AgentNetworkMeSetup {
-	providers := make([]api.AgentNetworkMeProvider, 0, len(setup.Providers))
-	for _, p := range setup.Providers {
-		providers = append(providers, api.AgentNetworkMeProvider{
-			Name:             p.Name,
-			CatalogId:        p.CatalogID,
-			ApiFlavor:        p.APIFlavor,
-			AllModelsAllowed: p.AllModelsAllowed,
-			Models:           p.Models,
-		})
-	}
-	return api.AgentNetworkMeSetup{
-		Configured: setup.Configured,
-		Endpoint:   setup.Endpoint,
-		Providers:  providers,
-	}
-}

management/internals/modules/agentnetwork/handlers/providers_handler.go

@@ -43,7 +43,6 @@ func RegisterEndpoints(manager agentnetwork.Manager, router *mux.Router) {
 	h.addConsumptionEndpoints(router)
 	h.addAccessLogEndpoints(router)
 	h.addBudgetRuleEndpoints(router)
-	h.addMeEndpoints(router)
 }
 
 func (h *handler) getCatalogProviders(w http.ResponseWriter, r *http.Request) {

management/internals/modules/agentnetwork/manager.go

@@ -83,13 +83,6 @@ type Manager interface {
 	RecordAccountBudgetUsage(ctx context.Context, accountID, userID string, groupIDs []string, tokensIn, tokensOut int64, costUSD float64) error
 	RecordUsage(ctx context.Context, in RecordUsageInput) error
 	SelectPolicyForRequest(ctx context.Context, in PolicySelectionInput) (*PolicySelectionResult, error)
-
-	// GetSetupForUser backs the self-service "My Agent Network" setup
-	// endpoint. Caller-scoped, so it skips the role permission gate; see
-	// the implementation. The caller's own usage and requests come
-	// through GetUsageOverview / ListAccessLogs, which self-scope when
-	// the account-wide grant is missing.
-	GetSetupForUser(ctx context.Context, accountID, userID string) (*types.EffectiveSetup, error)
 }
 
 // PolicySelectionInput is the per-request selection envelope. The
@@ -908,11 +901,8 @@ func (m *managerImpl) ListConsumption(ctx context.Context, accountID, userID str
 
 // ListAccessLogs returns a paginated, server-side-filtered page of
 // agent-network access logs plus the total count matching the filter.
-// Callers without the account-wide logs grant get a self-scoped page —
-// only their own requests — instead of a denial.
 func (m *managerImpl) ListAccessLogs(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLog, int64, error) {
-	filter, err := m.scopeFilterToCaller(ctx, accountID, userID, modules.AgentNetworkLogs, filter)
-	if err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkLogs, operations.Read); err != nil {
 		return nil, 0, err
 	}
 	return m.store.GetAgentNetworkAccessLogs(ctx, store.LockingStrengthNone, accountID, filter)
@@ -920,23 +910,18 @@ func (m *managerImpl) ListAccessLogs(ctx context.Context, accountID, userID stri
 
 // ListAccessLogSessions returns a paginated, server-side-filtered page of
 // agent-network access logs grouped by session, plus the total number of
-// sessions matching the filter. Self-scoped like ListAccessLogs for
-// callers without the account-wide logs grant.
+// sessions matching the filter.
 func (m *managerImpl) ListAccessLogSessions(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLogSession, int64, error) {
-	filter, err := m.scopeFilterToCaller(ctx, accountID, userID, modules.AgentNetworkLogs, filter)
-	if err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkLogs, operations.Read); err != nil {
 		return nil, 0, err
 	}
 	return m.store.GetAgentNetworkAccessLogSessions(ctx, store.LockingStrengthNone, accountID, filter)
 }
 
 // GetUsageOverview returns the filtered usage rows aggregated into time buckets
-// at the requested granularity, oldest-first. Callers without the
-// account-wide usage grant get their own rows aggregated instead of a
-// denial, so the dashboard serves "my usage" from the same endpoint.
+// at the requested granularity, oldest-first.
 func (m *managerImpl) GetUsageOverview(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter, granularity types.UsageGranularity) ([]*types.AgentNetworkUsageBucket, error) {
-	filter, err := m.scopeFilterToCaller(ctx, accountID, userID, modules.AgentNetworkUsage, filter)
-	if err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkUsage, operations.Read); err != nil {
 		return nil, err
 	}
 	rows, err := m.store.GetAgentNetworkUsageRows(ctx, store.LockingStrengthNone, accountID, filter)
@@ -946,25 +931,6 @@ func (m *managerImpl) GetUsageOverview(ctx context.Context, accountID, userID st
 	return types.AggregateUsageByGranularity(rows, granularity), nil
 }
 
-// scopeFilterToCaller applies the account-wide read gate for module and,
-// when the caller lacks the grant, pins the filter to the caller instead
-// of denying: their own user id replaces any requested one and group
-// filters are dropped. A caller may always see their own rows — strictly
-// tighter than any role gate — which is what lets every authenticated
-// user read their usage and requests through the regular endpoints.
-// Validation errors (not denials) still fail closed.
-func (m *managerImpl) scopeFilterToCaller(ctx context.Context, accountID, userID string, module modules.Module, filter types.AgentNetworkAccessLogFilter) (types.AgentNetworkAccessLogFilter, error) {
-	ok, _, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, module, operations.Read)
-	if err != nil {
-		return filter, status.NewPermissionValidationError(err)
-	}
-	if !ok {
-		filter.UserID = &userID
-		filter.GroupIDs = nil
-	}
-	return filter, nil
-}
-
 // StartAccessLogCleanup launches a background sweep that periodically deletes
 // each account's agent-network access-log rows older than that account's
 // AccessLogRetentionDays. Usage records are never swept. A non-positive

management/internals/modules/agentnetwork/setup.go

@@ -1,239 +0,0 @@
-package agentnetwork
-
-import (
-	"context"
-	"fmt"
-	"sort"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/server/store"
-)
-
-// GetSetupForUser returns the Agent Network setup the calling user's
-// groups authorize. It deliberately performs no role permission check:
-// the result is scoped to the caller's own groups, which is strictly
-// tighter than any role gate, so every authenticated user (any role) may
-// read it. Peers and users carry the same groups, so the answer matches
-// what the proxy enforces for the caller's machines at request time.
-func (m *managerImpl) GetSetupForUser(ctx context.Context, accountID, userID string) (*types.EffectiveSetup, error) {
-	user, err := m.store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
-	if err != nil {
-		return nil, fmt.Errorf("get user: %w", err)
-	}
-	return m.effectiveSetupForGroups(ctx, accountID, user.AutoGroups)
-}
-
-// effectiveSetupForGroups computes the effective Agent Network setup for
-// a set of caller groups: the account endpoint plus, per authorized
-// provider, the effective model set. It mirrors what the proxy enforces
-// at request time — the policy filter matches filterApplicablePolicies,
-// the model logic matches policyPermitsModel, and orphan providers
-// (enabled but referenced by no applicable policy) are omitted just like
-// the router synthesizer omits them — so the answer never advertises
-// anything the proxy would refuse.
-//
-// Every "nothing available" shape returns Configured=false rather than
-// an error, and "account not set up" is indistinguishable from "caller
-// has no access" by design: the response must not leak what exists for
-// others.
-func (m *managerImpl) effectiveSetupForGroups(ctx context.Context, accountID string, groupIDs []string) (*types.EffectiveSetup, error) {
-	notConfigured := &types.EffectiveSetup{Providers: []types.EffectiveProvider{}}
-
-	settings, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
-	switch {
-	case err == nil:
-	case isNotFound(err):
-		return notConfigured, nil
-	default:
-		return nil, fmt.Errorf("get agent network settings: %w", err)
-	}
-	if settings.Endpoint() == "" {
-		return notConfigured, nil
-	}
-
-	policies, err := m.store.GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, accountID)
-	if err != nil {
-		return nil, fmt.Errorf("list account policies: %w", err)
-	}
-	applicable := filterPoliciesByGroups(policies, groupIDs)
-	if len(applicable) == 0 {
-		return notConfigured, nil
-	}
-
-	providers, err := m.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, accountID)
-	if err != nil {
-		return nil, fmt.Errorf("list account providers: %w", err)
-	}
-
-	var guardrailsByID map[string]*types.Guardrail
-	if anyPolicyHasGuardrails(applicable) {
-		guardrailsByID, err = m.loadGuardrailsByID(ctx, accountID)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	authorized := make([]*types.Provider, 0, len(providers))
-	for _, p := range providers {
-		if p == nil || !p.Enabled {
-			continue
-		}
-		if len(policiesForProvider(applicable, p.ID)) == 0 {
-			continue
-		}
-		authorized = append(authorized, p)
-	}
-	if len(authorized) == 0 {
-		return notConfigured, nil
-	}
-	// created_at order, ID tiebreak — same deterministic order the router
-	// synthesizer presents.
-	sort.SliceStable(authorized, func(i, j int) bool {
-		if !authorized[i].CreatedAt.Equal(authorized[j].CreatedAt) {
-			return authorized[i].CreatedAt.Before(authorized[j].CreatedAt)
-		}
-		return authorized[i].ID < authorized[j].ID
-	})
-
-	out := &types.EffectiveSetup{
-		Configured: true,
-		Endpoint:   "https://" + settings.Endpoint(),
-		Providers:  make([]types.EffectiveProvider, 0, len(authorized)),
-	}
-	for _, p := range authorized {
-		allAllowed, models := effectiveModelsForProvider(p, policiesForProvider(applicable, p.ID), guardrailsByID)
-		flavor := ""
-		if entry, ok := catalog.Lookup(p.ProviderID); ok {
-			flavor = entry.ParserID
-		}
-		out.Providers = append(out.Providers, types.EffectiveProvider{
-			Name:             p.Name,
-			CatalogID:        p.ProviderID,
-			APIFlavor:        flavor,
-			AllModelsAllowed: allAllowed,
-			Models:           models,
-		})
-	}
-	return out, nil
-}
-
-// filterPoliciesByGroups returns the enabled policies whose SourceGroups
-// intersect the caller's groups. Same group matching as
-// filterApplicablePolicies, without the per-provider filter — the setup
-// answer spans every provider the caller can reach.
-func filterPoliciesByGroups(policies []*types.Policy, groupIDs []string) []*types.Policy {
-	groupSet := make(map[string]struct{}, len(groupIDs))
-	for _, g := range groupIDs {
-		if g != "" {
-			groupSet[g] = struct{}{}
-		}
-	}
-	out := make([]*types.Policy, 0, len(policies))
-	for _, p := range policies {
-		if p == nil || !p.Enabled {
-			continue
-		}
-		if !anyGroupMatches(p.SourceGroups, groupSet) {
-			continue
-		}
-		out = append(out, p)
-	}
-	return out
-}
-
-// policiesForProvider returns the subset of policies targeting the
-// provider, order preserved.
-func policiesForProvider(policies []*types.Policy, providerID string) []*types.Policy {
-	out := make([]*types.Policy, 0, len(policies))
-	for _, p := range policies {
-		if sliceContains(p.DestinationProviderIDs, providerID) {
-			out = append(out, p)
-		}
-	}
-	return out
-}
-
-// effectiveModelsForProvider derives the caller's effective model set for
-// one provider from the applicable policies that target it, mirroring
-// policyPermitsModel: a policy with no allowlist-enabled guardrail is
-// unrestricted, and one unrestricted policy makes the whole provider
-// unrestricted (the proxy would admit any model through it). Otherwise
-// the union of the policies' allowlists applies, intersected with the
-// provider's declared models when the operator declared any — the router
-// only claims declared models, so an allowlisted-but-undeclared model is
-// unreachable and must not be advertised. With no declared models the
-// router claims every model, so the allowlist union stands alone.
-func effectiveModelsForProvider(provider *types.Provider, policies []*types.Policy, guardrailsByID map[string]*types.Guardrail) (bool, []string) {
-	restricted := true
-	union := make([]string, 0)
-	seen := make(map[string]struct{})
-	for _, p := range policies {
-		policyRestricted := false
-		for _, gID := range p.GuardrailIDs {
-			g, ok := guardrailsByID[gID]
-			if !ok || g == nil || !g.Checks.ModelAllowlist.Enabled {
-				continue
-			}
-			policyRestricted = true
-			for _, model := range g.Checks.ModelAllowlist.Models {
-				key := normaliseModelID(model)
-				if key == "" {
-					continue
-				}
-				if _, dup := seen[key]; dup {
-					continue
-				}
-				seen[key] = struct{}{}
-				union = append(union, key)
-			}
-		}
-		if !policyRestricted {
-			restricted = false
-		}
-	}
-
-	declared := declaredModelIDs(provider)
-	if !restricted {
-		return true, declared
-	}
-	if len(provider.Models) == 0 {
-		// No operator declaration: the router claims every model, so the
-		// allowlist union is the effective set as-is.
-		return false, union
-	}
-	out := make([]string, 0, len(declared))
-	for _, id := range declared {
-		if _, ok := seen[normaliseModelID(id)]; ok {
-			out = append(out, id)
-		}
-	}
-	return false, out
-}
-
-// declaredModelIDs returns the models a provider exposes: the operator's
-// curated list when present, otherwise the catalog entry's models (an
-// empty operator list means "all catalog models"). Gateway/custom catalog
-// entries declare no models, so the result may be empty.
-func declaredModelIDs(provider *types.Provider) []string {
-	if ids := providerModelIDs(provider); len(ids) > 0 {
-		return ids
-	}
-	entry, ok := catalog.Lookup(provider.ProviderID)
-	if !ok {
-		return []string{}
-	}
-	out := make([]string, 0, len(entry.Models))
-	for _, m := range entry.Models {
-		if m.ID != "" {
-			out = append(out, m.ID)
-		}
-	}
-	return out
-}
-
-// GetSetupForUser on the mock manager reports "not configured" so tests
-// that don't care about setup still compile.
-func (*mockManager) GetSetupForUser(_ context.Context, _, _ string) (*types.EffectiveSetup, error) {
-	return &types.EffectiveSetup{Providers: []types.EffectiveProvider{}}, nil
-}

management/internals/modules/agentnetwork/setup_realstore_test.go

@@ -1,324 +0,0 @@
-package agentnetwork
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
-	"github.com/netbirdio/netbird/management/server/permissions"
-	"github.com/netbirdio/netbird/management/server/store"
-	nbtypes "github.com/netbirdio/netbird/management/server/types"
-)
-
-// These tests drive the effective-setup computation through the real
-// sqlite store, mirroring the policyselect realstore suite: assert on
-// observable answers (configured / providers / models), not on which
-// store methods get called. The computation must agree with what the
-// proxy enforces — policy filtering matches filterApplicablePolicies,
-// model logic matches policyPermitsModel, and orphan providers are
-// omitted like the router synthesizer omits them.
-
-func newSetupTestMgr(t *testing.T) (*managerImpl, store.Store) {
-	t.Helper()
-	ctx := context.Background()
-	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
-	require.NoError(t, err, "real sqlite test store must come up")
-	t.Cleanup(cleanup)
-	return &managerImpl{store: s}, s
-}
-
-// newSetupTestGuardrail returns an allowlist-enabled guardrail.
-func newSetupTestGuardrail(id string, models ...string) *types.Guardrail {
-	return &types.Guardrail{
-		ID:        id,
-		AccountID: testAccountID,
-		Name:      "allowlist " + id,
-		Checks: types.GuardrailChecks{
-			ModelAllowlist: types.GuardrailModelAllowlist{Enabled: true, Models: models},
-		},
-	}
-}
-
-func TestEffectiveSetup_RealStore_NoSettingsRow(t *testing.T) {
-	mgr, _ := newSetupTestMgr(t)
-
-	setup, err := mgr.effectiveSetupForGroups(context.Background(), testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	assert.False(t, setup.Configured, "account without settings must read as not configured")
-	assert.Empty(t, setup.Endpoint)
-	assert.Empty(t, setup.Providers)
-}
-
-func TestEffectiveSetup_RealStore_NoApplicablePolicy(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-other"})
-	require.NoError(t, err)
-	assert.False(t, setup.Configured, "caller outside every policy's source groups must read as not configured")
-	assert.Empty(t, setup.Endpoint, "no-access answer must not leak the endpoint")
-	assert.Empty(t, setup.Providers)
-}
-
-func TestEffectiveSetup_RealStore_UnrestrictedPolicyListsDeclaredModels(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	assert.True(t, setup.Configured)
-	assert.Equal(t, "https://"+testEndpoint, setup.Endpoint)
-	require.Len(t, setup.Providers, 1)
-	p := setup.Providers[0]
-	assert.Equal(t, "OpenAI", p.Name)
-	assert.Equal(t, "openai_api", p.CatalogID)
-	assert.Equal(t, "openai", p.APIFlavor)
-	assert.True(t, p.AllModelsAllowed, "policy without allowlist guardrail is unrestricted")
-	assert.Equal(t, []string{"gpt-5.4"}, p.Models, "declared models listed as a courtesy")
-}
-
-func TestEffectiveSetup_RealStore_AllowlistIntersectsDeclaredModels(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	provider.Models = []types.ProviderModel{{ID: "gpt-5.4"}, {ID: "gpt-4o"}}
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	// Allowlist admits gpt-5.4 (declared, odd casing/spacing) and gpt-4.1
-	// (NOT declared — the router would never route it, so it must not be
-	// advertised).
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", " GPT-5.4 ", "gpt-4.1")))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 1)
-	p := setup.Providers[0]
-	assert.False(t, p.AllModelsAllowed)
-	assert.Equal(t, []string{"gpt-5.4"}, p.Models, "allowlist ∩ declared, in declared order and casing")
-}
-
-func TestEffectiveSetup_RealStore_UnrestrictedPolicyWinsOverRestricted(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", "gpt-5.4")))
-	restricted := newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, restricted))
-	open := newSynthTestPolicy(provider.ID, "grp-eng", "")
-	open.ID = "pol-2"
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, open))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 1)
-	assert.True(t, setup.Providers[0].AllModelsAllowed,
-		"one applicable policy without an allowlist makes the provider unrestricted — the proxy would admit any model through it")
-}
-
-func TestEffectiveSetup_RealStore_AllowlistUnionAcrossPolicies(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	provider.Models = []types.ProviderModel{{ID: "gpt-5.4"}, {ID: "gpt-4o"}, {ID: "o4-mini"}}
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", "gpt-5.4")))
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-2", "gpt-4o")))
-	p1 := newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, p1))
-	p2 := newSynthTestPolicy(provider.ID, "grp-eng", "guard-2")
-	p2.ID = "pol-2"
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, p2))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 1)
-	p := setup.Providers[0]
-	assert.False(t, p.AllModelsAllowed)
-	assert.ElementsMatch(t, []string{"gpt-5.4", "gpt-4o"}, p.Models, "union of allowlists across applicable policies")
-}
-
-func TestEffectiveSetup_RealStore_OrphanAndDisabledProvidersOmitted(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	// Orphan: enabled but referenced by no policy.
-	orphan := newSynthTestProvider()
-	orphan.ID = "prov-orphan"
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, orphan))
-	// Disabled but referenced by an applicable policy.
-	disabled := newSynthTestProvider()
-	disabled.ID = "prov-disabled"
-	disabled.Enabled = false
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, disabled))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(disabled.ID, "grp-eng", "")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	assert.False(t, setup.Configured, "neither an orphan nor a disabled provider is reachable, so nothing is configured for the caller")
-	assert.Empty(t, setup.Providers)
-}
-
-func TestEffectiveSetup_RealStore_DisabledPolicyIgnored(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	policy := newSynthTestPolicy(provider.ID, "grp-eng", "")
-	policy.Enabled = false
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, policy))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	assert.False(t, setup.Configured)
-}
-
-func TestEffectiveSetup_RealStore_UndeclaredModelsUseAllowlistAsIs(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	// Gateway-style provider: no declared models — the router claims every
-	// model, so the allowlist union is the effective set on its own.
-	provider := newSynthTestProvider()
-	provider.ProviderID = "litellm_proxy"
-	provider.Name = "LiteLLM"
-	provider.Models = nil
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", "claude-sonnet-4-5")))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 1)
-	p := setup.Providers[0]
-	assert.False(t, p.AllModelsAllowed)
-	assert.Equal(t, []string{"claude-sonnet-4-5"}, p.Models)
-}
-
-func TestEffectiveSetup_RealStore_ProvidersInCreatedAtOrder(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	newer := newSynthTestProvider()
-	newer.ID = "prov-newer"
-	newer.Name = "Newer"
-	newer.CreatedAt = time.Date(2026, 2, 1, 0, 0, 0, 0, time.UTC)
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, newer))
-	older := newSynthTestProvider()
-	older.ID = "prov-older"
-	older.Name = "Older"
-	older.CreatedAt = time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, older))
-
-	policy := newSynthTestPolicy(newer.ID, "grp-eng", "")
-	policy.DestinationProviderIDs = []string{newer.ID, older.ID}
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, policy))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 2)
-	assert.Equal(t, "Older", setup.Providers[0].Name)
-	assert.Equal(t, "Newer", setup.Providers[1].Name)
-}
-
-// TestGetSetupForUser_RealStore pins the self-service entry point: the
-// user's group memberships (AutoGroups — the same groups the user's peers
-// carry) scope the answer, and users outside every policy get the
-// indistinguishable not-configured shape.
-func TestGetSetupForUser_RealStore(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
-
-	// users.account_id is a foreign key into accounts, enforced on
-	// MySQL/Postgres, so the account row must exist before its users.
-	require.NoError(t, s.SaveAccount(ctx, &nbtypes.Account{Id: testAccountID}))
-	require.NoError(t, s.SaveUser(ctx, &nbtypes.User{
-		Id: "user-in", AccountID: testAccountID, Role: nbtypes.UserRoleUser, AutoGroups: []string{"grp-eng"},
-	}))
-	require.NoError(t, s.SaveUser(ctx, &nbtypes.User{
-		Id: "user-out", AccountID: testAccountID, Role: nbtypes.UserRoleUser, AutoGroups: []string{"grp-other"},
-	}))
-
-	setupIn, err := mgr.GetSetupForUser(ctx, testAccountID, "user-in")
-	require.NoError(t, err)
-	assert.True(t, setupIn.Configured)
-	require.Len(t, setupIn.Providers, 1)
-
-	setupOut, err := mgr.GetSetupForUser(ctx, testAccountID, "user-out")
-	require.NoError(t, err)
-	assert.False(t, setupOut.Configured, "user outside the policy's source groups gets the not-configured answer")
-}
-
-// TestGetUsageOverview_RealStore_SelfScoped pins the self-scope fallback:
-// a caller without the account-wide usage grant gets the same aggregation
-// the admin overview serves, but only ever their own rows — a user_id
-// filter for someone else must be overridden, not honored, and never
-// denied. A caller holding the grant keeps the account-wide view.
-func TestGetUsageOverview_RealStore_SelfScoped(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	mgr.permissionsManager = permissions.NewManager(s)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	require.NoError(t, s.SaveAccount(ctx, &nbtypes.Account{Id: testAccountID}))
-	require.NoError(t, s.SaveUser(ctx, &nbtypes.User{
-		Id: "user-a", AccountID: testAccountID, Role: nbtypes.UserRoleUser,
-	}))
-	require.NoError(t, s.SaveUser(ctx, &nbtypes.User{
-		Id: "admin", AccountID: testAccountID, Role: nbtypes.UserRoleAdmin,
-	}))
-
-	own1 := newIngestTestEntry()
-	own1.ID, own1.UserId = "log-own-1", "user-a"
-	own2 := newIngestTestEntry()
-	own2.ID, own2.UserId = "log-own-2", "user-a"
-	other := newIngestTestEntry()
-	other.ID, other.UserId = "log-other", "user-b"
-	for _, e := range []*accesslogs.AccessLogEntry{own1, own2, other} {
-		require.NoError(t, IngestAccessLog(ctx, s, e))
-	}
-
-	otherID := "user-b"
-	filter := types.AgentNetworkAccessLogFilter{UserID: &otherID}
-	buckets, err := mgr.GetUsageOverview(ctx, testAccountID, "user-a", filter, types.ParseUsageGranularity(""))
-	require.NoError(t, err)
-	require.Len(t, buckets, 1, "same-day rows aggregate into one daily bucket")
-	assert.Equal(t, int64(200), buckets[0].InputTokens, "only the caller's two rows count — the foreign user_id filter is overridden")
-	assert.Equal(t, int64(100), buckets[0].OutputTokens)
-
-	adminBuckets, err := mgr.GetUsageOverview(ctx, testAccountID, "admin", types.AgentNetworkAccessLogFilter{}, types.ParseUsageGranularity(""))
-	require.NoError(t, err)
-	require.Len(t, adminBuckets, 1)
-	assert.Equal(t, int64(300), adminBuckets[0].InputTokens, "the account-wide grant keeps the unscoped view")
-}

management/internals/modules/agentnetwork/types/setup.go

@@ -1,40 +0,0 @@
-package types
-
-// EffectiveSetup is the caller-scoped answer to "what may this caller
-// use on the Agent Network?" — the account's proxy endpoint plus the
-// providers and models the caller's groups authorize. It intentionally
-// carries display metadata only: no keys, no upstream URLs, no policy or
-// guardrail structure, and no hint of providers the caller cannot reach.
-type EffectiveSetup struct {
-	// Configured is false when the account has no Agent Network set up or
-	// when nothing is authorized for the caller's groups — the two cases
-	// are deliberately indistinguishable so the response leaks nothing
-	// about what exists for others.
-	Configured bool
-	// Endpoint is the account's proxy base URL
-	// ("https://<subdomain>.<cluster>"), reachable over the NetBird tunnel
-	// only. Empty when Configured is false.
-	Endpoint string
-	// Providers lists the providers at least one applicable policy
-	// authorizes for the caller, in the account's created_at order.
-	Providers []EffectiveProvider
-}
-
-// EffectiveProvider is one authorized provider in an EffectiveSetup.
-type EffectiveProvider struct {
-	// Name is the operator-assigned label, e.g. "Bedrock prod".
-	Name string
-	// CatalogID names the catalog entry, e.g. "anthropic_api".
-	CatalogID string
-	// APIFlavor is the request-body shape the provider speaks — the
-	// catalog entry's parser id ("anthropic", "openai"); empty when the
-	// proxy dispatches the provider by URL path instead.
-	APIFlavor string
-	// AllModelsAllowed is true when no model allowlist restricts this
-	// provider for the caller. Models then lists the declared/catalog
-	// models as a courtesy (possibly none for gateway-style providers).
-	AllModelsAllowed bool
-	// Models is the effective model allowlist for the caller, or the
-	// declared/catalog models when AllModelsAllowed is true.
-	Models []string
-}

management/server/permissions/agent_network_roles_test.go

@@ -1,140 +0,0 @@
-package permissions
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/server/permissions/modules"
-	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	"github.com/netbirdio/netbird/management/server/permissions/roles"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-var allOps = []operations.Operation{operations.Read, operations.Create, operations.Update, operations.Delete}
-
-// TestAgentNetworkAdminRole pins the delegated-admin contract: full control
-// over the whole agent_network area (parent grant cascades to every
-// submodule), read-only on the account objects needed to build policies,
-// and nothing else in the account.
-func TestAgentNetworkAdminRole(t *testing.T) {
-	manager := NewManager(nil)
-	ctx := context.Background()
-
-	role, ok := roles.RolesMap[types.UserRoleAgentNetworkAdmin]
-	require.True(t, ok, "agent_network_admin must exist in RolesMap")
-
-	agentNetworkModules := []modules.Module{
-		modules.AgentNetwork,
-		modules.AgentNetworkProviders,
-		modules.AgentNetworkPolicies,
-		modules.AgentNetworkGuardrails,
-		modules.AgentNetworkBudgets,
-		modules.AgentNetworkUsage,
-		modules.AgentNetworkLogs,
-		modules.AgentNetworkSettings,
-	}
-	for _, m := range agentNetworkModules {
-		for _, op := range allOps {
-			assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
-				"agent_network_admin must have %s on %s", op, m)
-		}
-	}
-
-	// Settings read rides along because GET /api/accounts (which the
-	// dashboard needs to boot) validates it, like network_admin.
-	for _, m := range []modules.Module{modules.Users, modules.Groups, modules.Peers, modules.Accounts, modules.Settings} {
-		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, operations.Read),
-			"agent_network_admin must read %s to build policies and load the dashboard", m)
-		for _, op := range []operations.Operation{operations.Create, operations.Update, operations.Delete} {
-			assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
-				"agent_network_admin must not have %s on %s", op, m)
-		}
-	}
-
-	for _, m := range []modules.Module{modules.Networks, modules.Dns, modules.SetupKeys, modules.Routes} {
-		for _, op := range allOps {
-			assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
-				"agent_network_admin must not have %s on %s", op, m)
-		}
-	}
-}
-
-// TestUsageViewerRole pins the least-privilege cost role: read on the
-// aggregated usage overview plus read-only on the resources its filters
-// and display columns resolve against (users, groups, peers, the provider
-// list) — no policies, no request-level logs (which can contain captured
-// prompts), nothing else in the account.
-func TestUsageViewerRole(t *testing.T) {
-	manager := NewManager(nil)
-	ctx := context.Background()
-
-	role, ok := roles.RolesMap[types.UserRoleUsageViewer]
-	require.True(t, ok, "usage_viewer must exist in RolesMap")
-
-	readOnly := []modules.Module{
-		modules.AgentNetworkUsage,
-		modules.AgentNetworkProviders,
-		modules.Users,
-		modules.Groups,
-		modules.Peers,
-	}
-	for _, m := range readOnly {
-		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, operations.Read),
-			"usage_viewer must read %s for the usage view and its filters", m)
-		for _, op := range []operations.Operation{operations.Create, operations.Update, operations.Delete} {
-			assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
-				"usage_viewer must not have %s on %s", op, m)
-		}
-	}
-
-	denied := []modules.Module{
-		modules.AgentNetwork,
-		modules.AgentNetworkPolicies,
-		modules.AgentNetworkGuardrails,
-		modules.AgentNetworkBudgets,
-		modules.AgentNetworkLogs,
-		modules.AgentNetworkSettings,
-		modules.Networks,
-		modules.SetupKeys,
-	}
-	for _, m := range denied {
-		for _, op := range allOps {
-			assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
-				"usage_viewer must not have %s on %s", op, m)
-		}
-	}
-}
-
-// TestBillingAdminRoleResolves pins that billing_admin has a proper entry
-// in the permission map. Its plan/seat/invoice permissions are enforced
-// outside this map; management-side it carries the regular User baseline
-// instead of failing role resolution.
-func TestBillingAdminRoleResolves(t *testing.T) {
-	manager := NewManager(nil)
-	ctx := context.Background()
-
-	role, ok := roles.RolesMap[types.UserRoleBillingAdmin]
-	require.True(t, ok, "billing_admin must exist in RolesMap")
-
-	permissions, err := manager.GetPermissionsByRole(ctx, types.UserRoleBillingAdmin)
-	require.NoError(t, err, "billing_admin role must resolve")
-	require.NotEmpty(t, permissions)
-
-	for _, m := range []modules.Module{modules.AgentNetwork, modules.Networks, modules.Users, modules.Peers} {
-		for _, op := range allOps {
-			assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
-				"billing_admin must not have %s on %s", op, m)
-		}
-	}
-}
-
-// TestNewRolesParse pins the API role strings, which are permanent once
-// released.
-func TestNewRolesParse(t *testing.T) {
-	assert.Equal(t, types.UserRoleAgentNetworkAdmin, types.StrRoleToUserRole("agent_network_admin"))
-	assert.Equal(t, types.UserRoleUsageViewer, types.StrRoleToUserRole("usage_viewer"))
-	assert.Equal(t, types.UserRoleBillingAdmin, types.StrRoleToUserRole("billing_admin"))
-}

management/server/permissions/roles/agent_network_admin.go

@@ -1,62 +0,0 @@
-package roles
-
-import (
-	"github.com/netbirdio/netbird/management/server/permissions/modules"
-	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// AgentNetworkAdmin is the delegated administrator for the Agent Network
-// area: full control over providers, policies, guardrails, budgets, usage,
-// logs, and its settings, plus read-only visibility into the account
-// objects needed to build policies (users, groups, peers) and the account
-// settings/meta read the dashboard needs to boot (GET /api/accounts
-// validates Settings read, same as network_admin). Nothing else in the
-// account is visible.
-var AgentNetworkAdmin = RolePermissions{
-	Role: types.UserRoleAgentNetworkAdmin,
-	AutoAllowNew: map[operations.Operation]bool{
-		operations.Read:   false,
-		operations.Create: false,
-		operations.Update: false,
-		operations.Delete: false,
-	},
-	Permissions: Permissions{
-		modules.AgentNetwork: {
-			operations.Read:   true,
-			operations.Create: true,
-			operations.Update: true,
-			operations.Delete: true,
-		},
-		modules.Users: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-		modules.Groups: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-		modules.Peers: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-		modules.Accounts: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-		modules.Settings: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-	},
-}

management/server/permissions/roles/billing_admin.go

@@ -1,20 +0,0 @@
-package roles
-
-import (
-	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// BillingAdmin manages plans, seats, and invoices, which are enforced
-// outside this permission map (NetBird Cloud). Management-side it carries
-// the regular User baseline; the explicit entry keeps role resolution from
-// failing with a role-not-found error.
-var BillingAdmin = RolePermissions{
-	Role: types.UserRoleBillingAdmin,
-	AutoAllowNew: map[operations.Operation]bool{
-		operations.Read:   false,
-		operations.Create: false,
-		operations.Update: false,
-		operations.Delete: false,
-	},
-}

management/server/permissions/roles/role_permissions.go

@@ -15,12 +15,9 @@ type RolePermissions struct {
 type Permissions map[modules.Module]map[operations.Operation]bool
 
 var RolesMap = map[types.UserRole]RolePermissions{
-	types.UserRoleOwner:             Owner,
-	types.UserRoleAdmin:             Admin,
-	types.UserRoleUser:              User,
-	types.UserRoleAuditor:           Auditor,
-	types.UserRoleNetworkAdmin:      NetworkAdmin,
-	types.UserRoleAgentNetworkAdmin: AgentNetworkAdmin,
-	types.UserRoleUsageViewer:       UsageViewer,
-	types.UserRoleBillingAdmin:      BillingAdmin,
+	types.UserRoleOwner:        Owner,
+	types.UserRoleAdmin:        Admin,
+	types.UserRoleUser:         User,
+	types.UserRoleAuditor:      Auditor,
+	types.UserRoleNetworkAdmin: NetworkAdmin,
 }

management/server/permissions/roles/usage_viewer.go

@@ -1,56 +0,0 @@
-package roles
-
-import (
-	"github.com/netbirdio/netbird/management/server/permissions/modules"
-	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// UsageViewer is the regular User baseline plus read access to the
-// aggregated Agent Network usage and cost overview, and read-only access
-// to the resources the usage filters and display columns resolve against:
-// users and groups (identity filters and name resolution), peers (agent
-// principals in the caller column), and the provider list (provider and
-// model filter options). It sees no policies and no request-level access
-// logs (which can contain captured prompts).
-var UsageViewer = RolePermissions{
-	Role: types.UserRoleUsageViewer,
-	AutoAllowNew: map[operations.Operation]bool{
-		operations.Read:   false,
-		operations.Create: false,
-		operations.Update: false,
-		operations.Delete: false,
-	},
-	Permissions: Permissions{
-		modules.AgentNetworkUsage: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-		modules.AgentNetworkProviders: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-		modules.Users: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-		modules.Groups: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-		modules.Peers: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-	},
-}

management/server/types/user.go

@@ -11,15 +11,13 @@ import (
 )
 
 const (
-	UserRoleOwner             UserRole = "owner"
-	UserRoleAdmin             UserRole = "admin"
-	UserRoleUser              UserRole = "user"
-	UserRoleUnknown           UserRole = "unknown"
-	UserRoleBillingAdmin      UserRole = "billing_admin"
-	UserRoleAuditor           UserRole = "auditor"
-	UserRoleNetworkAdmin      UserRole = "network_admin"
-	UserRoleAgentNetworkAdmin UserRole = "agent_network_admin"
-	UserRoleUsageViewer       UserRole = "usage_viewer"
+	UserRoleOwner        UserRole = "owner"
+	UserRoleAdmin        UserRole = "admin"
+	UserRoleUser         UserRole = "user"
+	UserRoleUnknown      UserRole = "unknown"
+	UserRoleBillingAdmin UserRole = "billing_admin"
+	UserRoleAuditor      UserRole = "auditor"
+	UserRoleNetworkAdmin UserRole = "network_admin"
 
 	UserStatusActive   UserStatus = "active"
 	UserStatusDisabled UserStatus = "disabled"
@@ -44,10 +42,6 @@ func StrRoleToUserRole(strRole string) UserRole {
 		return UserRoleAuditor
 	case "network_admin":
 		return UserRoleNetworkAdmin
-	case "agent_network_admin":
-		return UserRoleAgentNetworkAdmin
-	case "usage_viewer":
-		return UserRoleUsageViewer
 	default:
 		return UserRoleUnknown
 	}
@@ -146,7 +140,7 @@ func (u *User) IsRegularUser() bool {
 
 // IsRestrictable checks whether a user is in a restrictable role.
 func (u *User) IsRestrictable() bool {
-	return u.Role == UserRoleUser || u.Role == UserRoleBillingAdmin || u.Role == UserRoleUsageViewer
+	return u.Role == UserRoleUser || u.Role == UserRoleBillingAdmin
 }
 
 // ToUserInfo converts a User object to a UserInfo object.

shared/management/http/api/openapi.yml

@@ -5729,57 +5729,6 @@ components:
       required:
         - name
         - checks
-    AgentNetworkMeSetup:
-      type: object
-      description: The caller-scoped Agent Network connection info backing the "My Agent Network" self-service view. Available to every authenticated user; the answer is computed from the caller's own groups and carries display metadata only.
-      properties:
-        configured:
-          type: boolean
-          description: False when the account has no Agent Network set up or the caller's groups authorize none of it. The two cases are deliberately indistinguishable.
-        endpoint:
-          type: string
-          description: The account's Agent Network base URL, reachable over the NetBird tunnel only. Empty when configured is false.
-          example: https://calm-otter.proxy.example.com
-        providers:
-          type: array
-          description: The providers at least one of the caller's policies authorizes, in creation order.
-          items:
-            $ref: '#/components/schemas/AgentNetworkMeProvider'
-      required:
-        - configured
-        - endpoint
-        - providers
-    AgentNetworkMeProvider:
-      type: object
-      description: One provider the caller may use, reduced to what a local tool needs for configuration.
-      properties:
-        name:
-          type: string
-          description: Operator-assigned provider label.
-          example: Bedrock prod
-        catalog_id:
-          type: string
-          description: Catalog entry id naming the provider type.
-          example: bedrock_api
-        api_flavor:
-          type: string
-          description: Request-body shape the provider speaks ("anthropic", "openai"). Empty when the gateway dispatches it by URL path instead.
-          example: anthropic
-        all_models_allowed:
-          type: boolean
-          description: True when no model allowlist restricts this provider for the caller; models then lists the declared or catalog models as a courtesy.
-        models:
-          type: array
-          description: The effective model allowlist for the caller (or the declared/catalog models when all_models_allowed is true).
-          items:
-            type: string
-          example: [ "anthropic.claude-sonnet-4-5" ]
-      required:
-        - name
-        - catalog_id
-        - api_flavor
-        - all_models_allowed
-        - models
     AgentNetworkConsumption:
       type: object
       description: One per-(dimension, window) consumption counter row. The proxy ticks one row per dimension on every served LLM request; the dashboard reads this listing to surface live counter growth.
@@ -13444,7 +13393,7 @@ paths:
   /api/agent-network/access-logs:
     get:
       summary: List Agent Network access logs
-      description: Returns a paginated, server-side-filtered list of agent-network (LLM) access log entries. Available only when the account has log collection enabled; otherwise entries are not retained. Callers without the account-wide grant are not denied - the response is scoped to their own requests (any user_id or group_id filter is overridden).
+      description: Returns a paginated, server-side-filtered list of agent-network (LLM) access log entries. Available only when the account has log collection enabled; otherwise entries are not retained.
       tags: [ Agent Network ]
       security:
         - BearerAuth: [ ]
@@ -13559,7 +13508,7 @@ paths:
   /api/agent-network/access-log-sessions:
     get:
       summary: List Agent Network access logs grouped by session
-      description: Returns a paginated, server-side-filtered list of agent-network (LLM) access logs grouped by session. The page unit is a session (total_records counts sessions); each session carries an aggregate summary and its ordered entries. Requests the client sent no session id for each form their own singleton group. Accepts the same filters as the flat access-logs endpoint. Available only when the account has log collection enabled. Callers without the account-wide grant are not denied - the response is scoped to their own requests (any user_id or group_id filter is overridden).
+      description: Returns a paginated, server-side-filtered list of agent-network (LLM) access logs grouped by session. The page unit is a session (total_records counts sessions); each session carries an aggregate summary and its ordered entries. Requests the client sent no session id for each form their own singleton group. Accepts the same filters as the flat access-logs endpoint. Available only when the account has log collection enabled.
       tags: [ Agent Network ]
       security:
         - BearerAuth: [ ]
@@ -13674,7 +13623,7 @@ paths:
   /api/agent-network/usage/overview:
     get:
       summary: Agent Network usage overview
-      description: Returns agent-network token and cost usage aggregated into time buckets, server-side filtered. Usage is always collected (independent of log collection). Callers without the account-wide grant are not denied - the response is scoped to their own usage (any user_id or group_id filter is overridden).
+      description: Returns agent-network token and cost usage aggregated into time buckets, server-side filtered. Usage is always collected (independent of log collection).
       tags: [ Agent Network ]
       security:
         - BearerAuth: [ ]
@@ -13774,25 +13723,6 @@ paths:
           "$ref": "#/components/responses/forbidden"
         '500':
           "$ref": "#/components/responses/internal_error"
-  /api/agent-network/me/setup:
-    get:
-      summary: Retrieve the caller's Agent Network setup
-      description: Returns everything the caller needs to configure a local AI tool and nothing more - the account's Agent Network endpoint plus the providers and models the caller's own policies allow. Available to every authenticated user regardless of role; the response never contains provider credentials, policy or guardrail configuration, or providers the caller cannot reach.
-      tags: [ Agent Network ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      responses:
-        '200':
-          description: The caller-scoped Agent Network connection info
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/AgentNetworkMeSetup'
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '500':
-          "$ref": "#/components/responses/internal_error"
   /api/agent-network/settings:
     get:
       summary: Retrieve Agent Network settings

shared/management/http/api/types.gen.go

@@ -2167,36 +2167,6 @@ type AgentNetworkGuardrailRequest struct {
 	Name string `json:"name"`
 }
 
-// AgentNetworkMeProvider One provider the caller may use, reduced to what a local tool needs for configuration.
-type AgentNetworkMeProvider struct {
-	// AllModelsAllowed True when no model allowlist restricts this provider for the caller; models then lists the declared or catalog models as a courtesy.
-	AllModelsAllowed bool `json:"all_models_allowed"`
-
-	// ApiFlavor Request-body shape the provider speaks ("anthropic", "openai"). Empty when the gateway dispatches it by URL path instead.
-	ApiFlavor string `json:"api_flavor"`
-
-	// CatalogId Catalog entry id naming the provider type.
-	CatalogId string `json:"catalog_id"`
-
-	// Models The effective model allowlist for the caller (or the declared/catalog models when all_models_allowed is true).
-	Models []string `json:"models"`
-
-	// Name Operator-assigned provider label.
-	Name string `json:"name"`
-}
-
-// AgentNetworkMeSetup The caller-scoped Agent Network connection info backing the "My Agent Network" self-service view. Available to every authenticated user; the answer is computed from the caller's own groups and carries display metadata only.
-type AgentNetworkMeSetup struct {
-	// Configured False when the account has no Agent Network set up or the caller's groups authorize none of it. The two cases are deliberately indistinguishable.
-	Configured bool `json:"configured"`
-
-	// Endpoint The account's Agent Network base URL, reachable over the NetBird tunnel only. Empty when configured is false.
-	Endpoint string `json:"endpoint"`
-
-	// Providers The providers at least one of the caller's policies authorizes, in creation order.
-	Providers []AgentNetworkMeProvider `json:"providers"`
-}
-
 // AgentNetworkPolicy defines model for AgentNetworkPolicy.
 type AgentNetworkPolicy struct {
 	// CreatedAt Timestamp when the policy was created.