What probably matters to youSection of the release
What
The bundled claude gateway gains a cri config block. With cri.enabled: true it accepts Claude Enterprise callers presenting Anthropic-minted CRI tokens, checked against an organization allowlist you supply, and the oidc: sign-in block becomes optional so a gateway can run with no identity provider at all.
Details
cri.org_allowlist must list at least one Claude Enterprise organization UUID when cri.enabled is true, and entries are validated as UUID-shaped; startup fails otherwise.
The cri section also carries a policy webhook setting.
Discovery advertises cri_enabled, and responses are tagged with an x-cri-upstream-kind header.
Omitting oidc: is only permitted for a CRI-only deployment; otherwise config validation rejects it.
With no identity provider, the landing page prints Identity provider (none — customer-routed inference only), /oauth/callback returns 404, discovery reports grant_types_supported: [], and group and scope checks read through an optional oidc block.
Evidence
cri.org_allowlist must list at least one Claude Enterprise organization UUID when cri.enabled is true, oidc: not configured (customer-routed inference only), customer-routed-inference-only deployment (cri.enabled: true)
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
