05-model-not-allowed

Unapproved AI model

Model not in tenant allowlist

Valid JWT for a configured tenant, but the requested model is not in the tenant's allowed_models list. The model_allowlist policy denies with model.not_allowed.

model-allowlistdenymodel

FIXTURE

tenant_id"acme-turkiye"

home_region"tst"

scopes

ai.chat.write

Defaults: iss = http://localhost/tst-issuer, aud = edge, exp = now+1h, kid = tester-rs256

EXPECTED OUTCOME

HTTP STATUS403

X-POLICY-DECISIONdeny

X-POLICY-REASONmodel.not_allowed

OPA EXPECTATION

OPA.ALLOWfalse

DENY_REASONmodel.not_allowed

DENY_CATEGORYmodel

What this demonstrates

A request targets a model the organization hasn't approved. Model allowlists are how companies control which providers see their data and which model versions make decisions.

Vendor risk managementEU AI Act Art. 26

RUNNER

Execute scenario

Mints a JWT, sends the request through the live Envoy, and compares the response against the expected outcome.

Requires the PolicyGate stack reachable on host ports 10000 / 8181.

WHY THIS MATTERS

Proves per-tenant model gating actually gates.