Scope keys are derived from signed JWT claims, never from any field the caller supplies in the request body. A caller that sets tenant_id in the payload is ignored; the claim decides. That is what makes NFR7 enforceable rather than advisory.
The illustrative /v1/authorize payload in the brief carries tenant_id and user_id. In this design those are read from the token and the body fields are accepted only for logging, with a mismatch treated as a 401.
Keycloak realms are per tenant, so a token issued for one tenant is not merely unauthorised elsewhere — it fails signature-audience validation.
Credential handling
Provider API keys are leased per tenant from Vault with a 15-minute TTL. Rotation and revocation require no redeploy and no restart.
Client credentials tokens are 10-minute lived; JWKS is cached at the edge for 5 minutes with a forced refresh on unknown kid.
Nothing in the decision plane ever holds a provider credential — only llm-gateway does.
Risks
A compromised tenant credential lets an attacker consume that tenant's quota and budget. It cannot reach another tenant's, and the per-tenant budget cap bounds the financial loss.
Keycloak is on the critical path for new tokens. Its failure does not affect requests using an already-issued token, and the edge serves from cached JWKS for the cache lifetime.
Noisy-neighbour isolation is quota-based, not compute-isolated. A tenant within its quota that sends pathological request shapes still shares limiterd CPU; per-tenant concurrency caps bound this.
