[github-actions]

agentgateway/agentgateway#4101 — docs: add note about advisor tools

Docs versions: standalone/main. Not planned for kubernetes/main: no page found there. Check whether the change applies in that mode too

What changes for users: No runtime behavior changes. Standalone API key allowedModels checks only the request's top-level model, so provider server-side tools such as the Anthropic advisor tool can use models outside the key's allowed list.

What the docs now say: The API Key authentication page and the per-key budgets guide now scope allowedModels to the top-level request model and call out that provider server-side tool models are not checked.

Not verified: No standalone run; the configuration and server-side-tool behavior are unrun.

How agentgateway-4101 was drafted, and what was not verified

• Code PR: docs: add note about advisor tools agentgateway#4101
• Code issue: none linked
• Product: agentgateway (upstream) → agentgateway/website
• Docs version: standalone/main
• Category: scoped-edit / pr

Plan, and what changed it

• Planned: Add the advisor-tool caveat to the standalone configuration page that owns API key model access.
• Learned: The offered _index.md and validation targets did not own the field; grepping the docs checkout found apikey-authn.md and per-key.md as the prose owners.
• Did: Updated those two standalone pages and left the generated configuration reference alone.

Why a documentation change is necessary

The code pull request adds a doc-comment and schema-reference caveat for allowedModels: only the request's top-level model is checked, not models used by provider server-side tools. The authored API key and per-key budget pages said that the key could reach or deny models without that boundary, which could make readers expect allowedModels to block an Anthropic advisor tool's model selection.

What changed on disk

• content/docs/standalone/main/documentation/configuration/security/apikey-authn.md: scopes allowedModels to the top-level request model and notes that provider server-side tool models are not checked.
• content/docs/standalone/main/documentation/llm/cost-controls/budget-limits/per-key.md: updates the field table, guide intro, rejection description, and access-mode table to use top-level-model wording.

How to verify this change

1. Follow the allowedModels configuration in the per-key budgets guide and start standalone agentgateway with agentgateway -f config.yaml.
2. Send a request with the documented API key for a top-level model outside the allowed patterns. The response should have HTTP status 403 and the model_not_allowed code.
3. To check the caveat, send a request whose top-level model matches allowedModels but whose provider server-side tool uses a different model. The API key policy should not reject the request with model_not_allowed because of the tool's model.

Proposed release note

No release note: this is a docs-only clarification of generated schema/reference text and authored guide prose. The dossier shows no runtime behavior, default, or upgrade action changed.

What was not verified

• The standalone configuration was not run.
• The provider server-side-tool case is unrun. The dossier contains the Rust doc comment and generated schema/reference text, but no runtime test fixture for that case.

How the pages were chosen (triage report)

Draft a documentation change

agentgateway/agentgateway#4101 — docs: add note about advisor tools

• Product: agentgateway (upstream) → agentgateway/website
• Docs version: standalone/main
• Summary (the title; the body has no description): add note about advisor tools
• Not tested: standalone configuration needs no cluster; whole config files the draft adds are validated with --validate-only after drafting, and commands are unrun

Draft branch: pr-tracker-draft-agentgateway-4101

[cloudflare-workers-and-pages]

Deploying agentproxy with    Cloudflare Pages

Latest commit:	b200bbe
Status:	⚡️  Build in progress...

View logs