Decision order
- Identify the consumer from its key metadata
- Match the requested model, including prefix wildcards
- Evaluate whether the workload may leave
- Route to an approved provider or a local vLLM endpoint
Default deny
A boundary exists only when an allow-list must be extended deliberately. Moving between private, hybrid and public is a policy change, not a migration.