Ayaan Zaidi 6908e6a63b fix(gateway): allowlist default-model config edits and explain protected-path refusals ...

agents.list[].model was agent-tunable while agents.defaults.model was
refused — the same capability gated by config shape (partially reverts
the defaults-spelling removal from #90145; token/auth/exec paths stay
protected). The bare refusal string also caused agents to misread the
injection boundary as an authorization failure and argue with the owner;
it now states the contract, the remedy, and the agent-tunable paths.
Guard moved to gateway-config-guard.ts (gateway-tool.ts 652->390).

Closes #106059

2026-07-13 11:03:50 +05:30

..

audit-checks.md

feat(security): audit open ingress control-plane tool exposure (#100965)

2026-07-11 12:36:37 -07:00

exposure-runbook.md

docs: rewrite published docs grounded in current source (#100142)

2026-07-05 00:32:47 -04:00

index.md

fix(gateway): allowlist default-model config edits and explain protected-path refusals

2026-07-13 11:03:50 +05:30

secure-file-operations.md

docs: rewrite published docs grounded in current source (#100142)

2026-07-05 00:32:47 -04:00

shrinkwrap.md

refactor: extract reusable AI runtime package (#99059)

2026-07-05 01:56:40 -04:00