Core Concepts
Scopes
How Spineforge ensures each gateway key can only reach the providers and models it was authorized for.
Scopes on a gateway key
Every gateway key carries a set of scopes, configured in the dashboard under Governance & Scopes. They define the ceiling of what that key can ever call: there is no runtime escalation.
Built-in gateway scopes
| Scope | What it grants |
|---|---|
gateway:* | Universal Gateway Access: allows the agent to route traffic through the proxy to any provider or model. |
Custom gateway scopes
To restrict an agent to specific models or providers, disable the gateway:* universal scope and define granular custom scopes:
gateway:<provider>(e.g.,gateway:openai): grants access to all models from a specific provider.gateway:model:<model_name>(e.g.,gateway:model:gpt-4o): grants access only to a specific model.
Scope enforcement: set membership
Validation is pure set membership: the gateway checks that what a request needs is in the key's granted scopes. There is no partial grant and no negotiation at runtime. A request for a provider or model outside the granted set is rejected before it reaches the provider.
Examples
| Goal | Scopes to grant |
|---|---|
| Full access for a trusted internal agent | gateway:* |
| Only OpenAI models | gateway:openai |
| Only one model for a coding assistant | gateway:model:gpt-4o |
| OpenAI and Groq, nothing else | gateway:openai, gateway:groq |
Scopes work together with budget caps and rate limits: scopes decide what a key can call, budgets and limits decide how much.
Next steps
- Gateway Keys & Vault
- Model Naming: the names used in model scopes
- Security Model: scopes in the full request lifecycle