Nothing to try yetTier: how much it should matter to you
2Useful: my rating, 1 to 5
4Signal: worth watching, 1 to 5
GatewayArea: what it touches
In DevelopmentKind: in v2.1.228,
What probably matters to youSection of the release
A cri config block with issuer, audience and org allowlist is validated but enabled defaults to false.
What
The gateway config schema now accepts a cri block for customer-routed inference, with enabled defaulting to false, plus audience, issuer, org allowlist and an optional policy webhook. Validation is strict: the issuer must be canonical https with no query, fragment or trailing slash, because the key URL is derived as {issuer}/jwks.json. Loopback issuers require CLAUDE_GATEWAY_ALLOW_LOOPBACK. Allowlist entries that are not UUIDs warn that every caller from that org will be denied.
Details
A cri: block present with enabled not set to true produces an explicit warning that the config is inert.
Evidence
cri.issuer must not end with '/'
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
