nRouterのモデルカタログを読む:denyが常に優先されるRBAC設計 #AI - Qiita
@nrouter_ai1991

nRouter's Model Catalog: RBAC Design where deny always takes precedence

  • LLM
  • API
  • nrouter
  • AI
  • gateway
0
Posted at 2026-11-12

nRouter's "Models" guide explains the specification of a searchable catalog (/models) that collects all available LLMs and multimodal models. Corresponding providers are cross-cloud, reflecting live availability, and all models can be accessed through a single endpoint and one virtual key (sk-nrouter-*). Viewing the catalog itself is free.

Filter and Compare

You can filter by provider, modality (chat, embedding, vision, audio, video), and status, and compare specifications. You can star frequently used models to pin them to the top. If a needed model is not available, any signed-in member can request it through Request Model, and it will be reviewed within 24 hours according to the guide. You can also directly pass the ID of a fine-tuned model into the model field to call it.

Scope Hierarchy: Lower scopes only narrow down

Access control is evaluated across three scopes: Organization (master permission list) ▸ Team ▸ Personal (restrictions on virtual keys). The rules are monotonic. Lower scope can only narrow down the permissions of higher scopes, and cannot broaden them.

Allowlist and Denylist, and Priority

You can set an allowlist (models) and a denylist (denied_models) for each scope. The rule is clear in case of conflicts, and deny always takes precedence. Any model that matches a deny rule in either scope will be blocked with an HTTP 403 error (key_model_not_allowed or model_denied_by_*) regardless of whether it is in the allowlist, has wildcards assigned, or has its model alias rewritten. It is important that you cannot bypass the deny check even through aliases.

Passing "model": "nrouter/auto" routes the request to all valid chat models that the organization has permitted, but this is also a selection within the policy, not a bypass. Also, when calling a restricted model, the gateway returns an explicit error instead of silently routing to another model.

Full guide (English): https://nrouter.ai/docs/guides/models

0
0 comment
0
Go to list of comments0You can efficiently read back useful information
You can use dark theme
What you can do with signing up
Sign upLogin