feat: enforce AI access before LiteLLM inference

[danielkov]

Summary

• Add a Gram-signed, short-lived acting-principal contract for managed LiteLLM inference requests.
• Enforce ai_access through the fail-closed Generic Guardrail checkpoint before provider inference, with authoritative tenant, project, instance, key, invocation, and membership validation.
• Publish a pinned LiteLLM 1.94.0 fail-closed configuration and restrict coverage claims to the verified synchronous guardrail boundary.

Impact

Qualifying requests routed through the approved managed LiteLLM configuration can now be denied before provider inference. Unsigned identity metadata, API-key ownership, unmanaged or fail-open deployments, direct provider traffic, and post-call processing remain outside the enforcement claim.

Technical details

Acting-principal trust boundary

Authenticated Gram users mint assertions bound to the active managed instance and integration key. The guardrail revalidates those bindings and organization membership on every callback; correlation state never authorizes an allow decision.

Failure behavior

Matched prescriptions return LiteLLM's native BLOCKED action with the selected external note. Identity, resource, and evaluator failures remain fail closed without being reported as prescription matches.

Closes DNO-990

---

Summary by cubic

Enforces ai_access before managed LiteLLM provider inference. Managed requests now require a Gram-minted, invocation-bound acting-principal assertion that is revalidated fail-closed before content processing; previously LiteLLM callbacks ran post-inference without acting identity.

Key changes

• Adds mintActingPrincipal, which signs a 60-second assertion for one invocation, instance, and integration key using the existing JWT signing key; only ordinary authenticated Gram user sessions can mint.
• The guardrail re-derives the instance from an uncached project-scoped lookup of the current managed key; caller-supplied LiteLLM metadata is never trusted.
• The pinned LiteLLM 1.94.0 config forwards the assertion headers and fails closed when the guardrail is unreachable.
• Matched prescriptions block with LiteLLM's native BLOCKED action; identity, resource, and evaluator failures block without presenting as prescription matches.
• New instances must be fail_closed; the fail_open posture is removed and unmanaged or existing fail-open deployments remain outside the enforcement claim.
• LiteLLM callbacks no longer derive external_user_id from the callback email address.
• Only the synchronous guardrail boundary is covered; direct provider traffic and post-call processing are unaffected.

Closes DNO-990.

^{Written for commit aae4169. Summary will update on new commits.}

[linear-code]

DNO-990

[changeset-bot]

🦋 Changeset detected

Latest commit: 72a1ba0

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
server	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cubic-dev-ai]

Running ultrareview automatically — This PR enforces authorization before managed LiteLLM inference via a new signed acting-principal contract, fail-closed posture, and removal of fail-open options—security-critical, cross-cutting changes that could cause unauthorized access or service disruption if a subtle bug slips through.. I'll post findings when complete.

[cubic-dev-ai]

Ultrareview completed in 14m 29s

All reported issues were addressed across 53 files

Linked issue analysis

Linked issue: DNO-990: feat: enforce ai_access before LiteLLM inference

Status	Acceptance criteria	Notes
✅	Define and verify a signed acting-principal assertion bound to the tenant, project, managed instance, integration key, and invocation	The PR adds a short-lived signer, minting endpoint, binding claims, and revalidation logic for ordinary authenticated Gram user sessions.
✅	Evaluate ai_access in the LiteLLM pre-inference guardrail and map matches to LiteLLM BLOCKED with the selected note	The PR adds the LiteLLM ai_access checkpoint and documents native BLOCKED handling; the implementation is wired during server startup.
✅	Exclude API-key ownership and reject unsigned, missing, spoofed, or cross-tenant identity claims	The acting-principal path requires ordinary validated user-session provenance, explicitly rejects API-key and alternate provenance, and validates current tenant/resource bindings.
✅	Use fail-closed behavior for identity, resource, evaluator, and unreachable-guardrail failures	Managed integrations now accept only fail_closed, and the pinned configuration sets fail_on_error and unreachable_fallback: fail_closed.
✅	Keep correlation/retry state from authorizing allow decisions	The PR describes correlation state as attribution-only and implements per-callback validation; retry behavior and attribution changes are covered in the added and updated tests.
✅	Restrict the enforcement claim to the verified synchronous managed LiteLLM guardrail boundary	The PR explicitly excludes unmanaged or fail-open deployments, direct provider traffic, and post-call processing, while adding the pinned LiteLLM 1.94.0 configuration and contract fixtures.

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 17 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>