{"version":"2.1.228","anchor":"gateway-customer-routed-inference-config-disabled-by-default","canonical_anchor":"gateway-customer-routed-inference-config-disabled-by-default","heading":"Gateway customer-routed inference config, disabled by default","tier":"soon","area":"Gateway","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.228\/e\/gateway-customer-routed-inference-config-disabled-by-default","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.228","markdown":"### Gateway customer-routed inference config, disabled by default\n\nThe self-hosted gateway accepts a strict customer-routed inference config block, off unless you enable it.\n\n**What**\n\nThe gateway config schema now accepts a `cri` block for customer-routed inference, with `enabled` defaulting to false, plus audience, issuer, org allowlist and an optional policy webhook. Validation is strict: the issuer must be canonical https with no query, fragment or trailing slash, because the key URL is derived as `{issuer}\/jwks.json`. Loopback issuers require `CLAUDE_GATEWAY_ALLOW_LOOPBACK`. Allowlist entries that are not UUIDs warn that every caller from that org will be denied.\n\n**Details**\n\n- A `cri:` block present with `enabled` not set to true produces an explicit warning that the config is inert.\n\n**Evidence**\n\n`cri.issuer must not end with '\/'`\n\n- Area: Gateway\n- Names: `cri.enabled`, `CLAUDE_GATEWAY_ALLOW_LOOPBACK`\n- Tier: Nothing to try yet\n- Useful: 2\/5\n- Signal: 4\/5\n- Present in the build but not switched on"}