Access Boundaries

Access boundaries are promptless deny rules that block matching subject/resource combinations before provider, template, or tool egress.

Use an access boundary to add a business-specific prohibition after baseline Eden RBAC has allowed a request. They are not an allow-list or a replacement for RBAC.

What They Check

Input	Purpose
Subject	User, agent, auth group, or gateway key identity.
Resource	Endpoint, template, model route, tool, or governed resource label.
Work metadata	Workflow, environment, customer segment, or business process context.
Policy action	`block`; this is the only supported access-boundary action.

API Surface

text

GET    /api/v1/llm/access_boundaries
PUT    /api/v1/llm/access_boundaries
GET    /api/v1/llm/access_boundaries/{boundary_uuid}
DELETE /api/v1/llm/access_boundaries/{boundary_uuid}

Evaluation Order

Access boundaries run after Eden has resolved identity and request metadata, and before any provider or tool receives traffic. They complement RBAC:

Layer	Role
Eden RBAC	Determines whether the subject has baseline control-plane or data-plane access.
Access boundary	Blocks a matching business-specific subject/resource/work-metadata combination.
Provider or endpoint policy	Applies the backend's own permissions after Eden forwards allowed traffic.

A matching boundary blocks the request. No matching boundary leaves the request available to the normal RBAC, endpoint, and provider controls. Use RBAC or a separate resource grant when you need default-deny access.

Common Patterns

Block high-risk tools for exploratory agents or routes.
Block research routes for unapproved project groups.
Block production endpoints from developer or exploratory model routes.
Block a gateway key from using a sensitive endpoint when disallowed work metadata is present.
Keep model-router, tool-calling, and template execution decisions promptless.

Guarantees

Boundaries evaluate from safe request metadata and resource identifiers.
A matching boundary fails closed before egress.
An absent or non-matching boundary does not grant or revoke baseline Eden access.
Boundary telemetry records safe identifiers and decision counts, not prompt text.