{"version":"2.1.228","anchor":"gateway-gains-a-second-admission-path-for-machine-identities","canonical_anchor":"gateway-gains-a-second-admission-path-for-machine-identities","heading":"Gateway gains a second admission path for machine identities","tier":"soon","area":"Gateway","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.228\/e\/gateway-gains-a-second-admission-path-for-machine-identities","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.228","markdown":"### Gateway gains a second admission path for machine identities\n\nThe self-hosted gateway can admit machine identities that skip managed-settings policy entirely, off by default.\n\n**What**\n\nThe self-hosted gateway can accept callers that present an external identity token rather than a user sign-in, configured by a new `cri` block with `enabled`, `audience`, `issuer` and `org_allowlist`. It is off by default (`cri.enabled` false). When on, discovery advertises `cri_enabled: true`, audit and inference records are tagged with `upstream_kind`, and these callers skip managed-settings policy matching entirely.\n\n**Details**\n\n- Minted principals carry the claims `sub`, `cri: true`, `org` and `act`.\n- The group and email-domain policy matcher returns no policy at all for an identity marked `cri === true`, so managed settings do not apply to these callers.\n- A loopback `jwks_url` exists for tests only and has two distinct refusal messages.\n- Entirely new in this build.\n\n**Evidence**\n\n`cri_enabled`\n\n- Area: Gateway\n- Names: `cri.enabled`\n- Tier: Nothing to try yet\n- Useful: 3\/5\n- Signal: 5\/5\n- Present in the build but not switched on"}