fix(agents): preserve delegated team authorization context

[joshua-berri]

TLDR

Problem this solves:

• Delegated agents borrow permissions from a differently restricted team

How it solves it:

• Carry the granting team into existing authorization and billing
• Restrict delegated target grants to that team and user
• Preserve JWT team claims and aliases as authorization bounds unless database-team fallback is explicitly enabled

User Flow

Before: a user can invoke an agent using another team's restrictions

1. The user belongs to teams A and B; only A grants the agent
2. They call POST /v1/chat/completions with the delegated agent token and select B
3. A model forbidden by A runs under B's restrictions

After: a team grant carries that team's restrictions

1. The user belongs to teams A and B; only A grants the agent
2. They call POST /v1/chat/completions with the delegated agent token and select B
3. The request is denied; selecting A applies A's existing model and budget checks

Without an explicit selector, a granting team is used, including when JWT configuration supplies an unrelated default team. Direct user grants preserve existing team selection. If multiple teams grant access, an already resolved granting team is retained; otherwise the first team in stable ID order is used. Its restrictions and billing apply, and an explicit selector must name a granting team. Autonomous agents are unchanged

Relevant issues

Stack 4 of 4, depends on #43230. Addresses the delegated-team finding in #43149: #43149 (comment)

Affected release

Linear ticket

Pre-Submission checklist

• I have added meaningful tests
• Focused tests and live verification pass on Devin
• My PR passes all required CI/CD checks
• My PR's scope is isolated to delegated team authorization
• Greptile confidence is at least 4/5

Screenshots / Proof of Fix

Actual Entra delegated tokens were tested against matched live gateways. The final published authorization code matches the tested source; the latest collection-only lint repair is undergoing focused verification

Before (0d49d9a)

1. Send POST /v1/chat/completions with the delegated token and select a team that does not grant the agent
2. The request returns 200 and charges that unrelated team
3. With only /v1/embeddings permitted for team routes, omit the team selector and send the same chat request; it returns 200

After (authorization source 47a67bc)

1. Send the same request selecting the unrelated team; it returns 403
2. Select the granting team and an allowed model; it returns 200 and charges that team. A forbidden model or exhausted granting team returns 403
3. With only /v1/embeddings permitted for team routes, omit the selector and send the same chat request; it returns 403

Direct user grants retain their existing behavior. Focused permission/admission tests passed 168 cases at 750b261, whose authorization source matches the live-tested version. Current CI and the remaining focused checks are still pending

Current repair at 27869aa: seven signed-JWT regression cases pass, including team claims, aliases, explicit DB fallback, and claimless compatibility. Canonical focused Ruff checks pass; type diagnostics decrease. Current-tip CI and automated reviews are pending.

Current scoped repair at 4d25f3c: delegated team selection uses separate immutable context values. 76 JWT and 168 permission/admission tests pass on the behavior-equivalent revision; subsequent commits change annotations/format only. Full canonical lint/type gates pass at this exact tip, with no new type diagnostics. Current-tip CI, coverage and bot reviews are pending; additional live checks are running in parallel.

Type

Bug Fix

• Current CI is blocked by unrelated Google Interactions OpenAPI drift; upstream fix: test(interactions): pin and refresh OpenAPI compliance contract #43532. No Interactions files changed in this PR.

Caveats (if any)

High

• Verification and current-tip automated reviews remain pending

Final Attestation

• Tests cover the reported bypass and compatibility boundaries

[joshua-berri]

@greptileai @veria-ai Please review current tip cab10bd. The stack now has four PRs; delegated-team authorization is isolated in #43459. Focused remote verification runs alongside CI. Please check prior findings and current diff

[greptile-apps]

Confidence Score: 5/5

[Critical risk] Changes how delegated agent authorization is verified and enforced.

The PR appears safe to merge based on the reviewed changes

Summary

This PR carries the granting team through delegated-agent authorization, team policy, and billing. The latest changes replace team-context rebinding with derived values and use immutable empty sequences in SCIM calls

_{Reviews (6) · Last reviewed commit: "fix(auth): declare fallback team result ..."}

[veria-ai]

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 2 · PR risk: 0/10

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[joshua-berri]

@greptileai @veria-ai Please review the current tip. The optional team-selector cleanup is absent from all four merge-base diffs; those six UI files match the original main merge-base, so incomplete group discovery is pre-existing and deferred. Identity now retains authoritative target rate policy; budgets bind explicit A2A billing to the path; PR4 preserves grant-team authority and consumes JWT verification once. Focused tests/live checks run in parallel with CI

[joshua-berri]

@greptileai @veria-ai Please review the current tip and confirm resolution of the focused findings. Actor/target token settlement now reuses recorded reservation scopes; delegated tests use module-boundary isolation. No unrelated features or selector cleanup were added. Fresh verification runs in parallel with CI

[joshua-berri]

@greptileai @veria-ai Current tip 0e358de applies the exact Ruff formatting correction only; behavioral patches are unchanged. Focused delegated tests168pass, rate settlement2pass, and actual Entra before/after confirm grant-team model, route and budget denial. Please confirm current-tip review outcomes; remaining live controls and CI are pending

[joshua-berri]

@greptileai @veria-ai Please review 4d25f3c: selected team context is immutable, with explicit fallback types. Focused regressions and all canonical gates pass.