[yordis]

• Every Agent sharing a connection could reach every model that connection allows, with nowhere to keep one Agent on a cheaper model.
• A ceiling narrows what the connection already authorizes instead of duplicating that authorization, so absence means no cap rather than a second grant to keep in sync.
• Ceilings follow the delegation lineage so an Agent limited to one model cannot reach another by delegating.

[cursor]

PR Summary

Medium Risk
New authorization-adjacent policy contracts affect model selection admission and audit reconstruction; scope is schema-only with no runtime in this PR.

Overview
Introduces model ceiling policy protos so administrators can cap which catalog models a policy subject’s sessions may select (narrowing connection-level authorization per ADR#0032).

The new policy.model_ceilings module defines ModelCeilingPolicy (unique model_id matchers), set/clear commands with Decider concurrency semantics, set/cleared events, fold state (missing vs history with optional cleared policy), and schema-only refusal templates. Ceilings compose conjunctively along delegation like holds and budgets.

PolicyRuleKind gains POLICY_RULE_KIND_MODEL_CEILING so admission and accounting can record which ceiling revision was evaluated via PolicyRuleRef.

^{Reviewed by Cursor Bugbot for commit 331aed9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: eacd841c-66df-4574-b5d2-2a3d801384a6

📥 Commits

Reviewing files that changed from the base of the PR and between 0d2819b and 331aed9.

📒 Files selected for processing: 9

• proto/trogonai/policy/model_ceilings/state/v1alpha1/state.proto
• proto/trogonai/policy/model_ceilings/v1alpha1/ceiling_policy.proto
• proto/trogonai/policy/model_ceilings/v1alpha1/clear_model_ceiling.proto
• proto/trogonai/policy/model_ceilings/v1alpha1/events.proto
• proto/trogonai/policy/model_ceilings/v1alpha1/faults.proto
• proto/trogonai/policy/model_ceilings/v1alpha1/model_ceiling_cleared.proto
• proto/trogonai/policy/model_ceilings/v1alpha1/model_ceiling_set.proto
• proto/trogonai/policy/model_ceilings/v1alpha1/set_model_ceiling.proto
• proto/trogonai/policy/subjects/v1alpha1/rule_ref.proto

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}