Nothing to try yetTier: how much it should matter to you
3Useful: my rating, 1 to 5
5Signal: worth watching, 1 to 5
GatewayArea: what it touches
In DevelopmentKind: in v2.1.228,
What probably matters to youSection of the release
A second admission path via the cri block is complete, including discovery and audit tagging, with cri.enabled false.
What
The self-hosted gateway can accept callers that present an external identity token rather than a user sign-in, configured by a new cri block with enabled, audience, issuer and org_allowlist. It is off by default (cri.enabled false). When on, discovery advertises cri_enabled: true, audit and inference records are tagged with upstream_kind, and these callers skip managed-settings policy matching entirely.
Details
Minted principals carry the claims sub, cri: true, org and act.
The group and email-domain policy matcher returns no policy at all for an identity marked cri === true, so managed settings do not apply to these callers.
A loopback jwks_url exists for tests only and has two distinct refusal messages.
Entirely new in this build.
Evidence
cri_enabled
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
