Model Vendor Routing Through 2 Admission Gates (When Tenants Pin or Exclude)
Consider a proposed page for a gaming service: a tenant's scoped key has been revoked, but its previously admitted model requests still hold budget reservations. The responder sees refused requests alongside reserved spending, while the routing constraint says to pin a vendor or exclude one. Which decision stopped traffic? This is a design exercise, not an account of a production incident. Short…
When a tenant's scoped key is revoked, but the model requests using that key are still admitted, the routing constraint requires the responder to either pin a vendor or exclude one. Pinning is preferable when permission applies to a single provider, as adding more destinations would necessitate an explicit policy change. Exclusion, on the other hand, is better when permission applies to multiple destinations, as adding another provider requires no policy modification.
Both rules do not enforce the tenant's spend ceiling or revoke their key. Instead, these decisions should be handled separately and recorded in distinct gates, indicating which gate refused the request. The operational question focuses on why traffic stopped and whether the service can maintain its spending commitment during the stoppage.
The proposed design suggests creating a page that identifies the tenant, credential identifier, policy revision, and admission decision, without exposing the actual secret. Refusing requests with revoked keys confirms that the boundary works, but paging on every refusal would be unnecessary. Instead, investigate if a policy update exists but the admission point still reports an older revision. This mismatch should be flagged as a precursor signal.
Whether to treat revocation, lifecycle management, and auditing as explicit responsibilities can be determined using OWASP's secrets-management guidance. A separate account of what happened to admitted work is necessary, as revocation only prevents new admissions and does not affect previously admitted traffic. The boundary for revocation should be defined in the service contract, with new admissions prohibited after the revocation transaction commits at the authoritative admission service.
Separate the credential containment from budget admission. A scoped key should identify a tenant and reference enforced permissions, while rotating it should not create a new spending allowance unless explicitly requested. Revoking a key should not erase budget reservations or accounting records. Store the credential identifier and lifecycle state alongside audit information, following the OWASP guidelines.
Use a hypothetical budget expressed in internal accounting units, and admit more work based on the available amount, not the settled usage.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
