04-tenant-not-configured
Unknown business unit uses AI
Tenant not configured
Valid JWT for a tenant that Shield has not registered in data.customer.tenants. The model_allowlist policy denies with model.tenant_not_configured.
model-allowlistdenytenant
FIXTURE
tenant_id"ghost-tenant"
home_region"tst"
scopes
ai.chat.write
Defaults: iss = http://localhost/tst-issuer, aud = edge, exp = now+1h, kid = tester-rs256
EXPECTED OUTCOME
HTTP STATUS403
X-POLICY-DECISIONdeny
X-POLICY-REASONmodel.tenant_not_configured
OPA EXPECTATION
OPA.ALLOWfalse
DENY_REASONmodel.tenant_not_configured
DENY_CATEGORYmodel
What this demonstrates
A tenant with no configured policy tries to use AI. Denying by default prevents 'shadow AI' — usage nobody set rules for.
Governance baseline / shadow AI risk
RUNNER
Execute scenario
Mints a JWT, sends the request through the live Envoy, and compares the response against the expected outcome.
Requires the PolicyGate stack reachable on host ports 10000 / 8181.
WHY THIS MATTERS
Proves that requests for unprovisioned tenants fail closed at the policy layer.