Per-user attribution, audit trails, tenant content policy, and gated retention

Cargo.toml

@@ -76,10 +76,12 @@ gw-task = { path = "crates/task" }
 gw-views = { path = "crates/views" }
 base64 = "0.22"
 tiktoken-rs = "0.12"
-# pure-compute crypto (SigV4 signing, cache keys) — no network capability
+# pure-compute crypto (SigV4 signing, cache keys, content-at-rest AEAD) — no network capability
 sha2 = "0.10"
 hmac = "0.12"
 hex = "0.4"
+chacha20poly1305 = "0.10"
+regex = "1"
 
 # Faster iterative builds; keep release optimized.
 [profile.dev]

README.md

@@ -13,6 +13,7 @@ key-based auth, quotas, rate limits, failover, and a billing ledger.
 - **Staged request pipeline** — a 4-layer DAG per request: model resolve / quota / cache lookup → account selection (priority, PTU-first, failover) → rate limits + engine call (retry on upstream 5xx) → usage extraction, billing, cache store
 - **Governance built in** — access-key auth, daily token quotas, QPS / QPM / TPM limits at key, product, and model level, request-level TTL cache, account cooldown and recovery, DLP redaction and blocklist plugins. Admission reserves then settles, so concurrent requests can't overshoot a quota
 - **Multi-tenant** — keys carry a tenant; tenants get a pooled QPS bucket, a model entitlement allowlist, per-(key, model) quota defaults with an optional fallback-model degrade, key lifecycle (expiry/ban), and tenant-scoped admin tokens. Billing records charged cost and (optionally) vendor cost per row, so margin is queryable per tenant × model
+- **Per-user billing & enterprise audit** — every ledger row attributes to an effective end user (the key's `owner`, else the request's `x-gw-user` / `user` hint) with a `request_id`, so cost rolls up per user (`/admin/usage/users`) and a soft per-user daily budget applies on every surface. Per-tenant content policy adds blocklist action tiers (block / flag / shadow), regex recognizers, secret masking, and an external-moderation seam; every hit is recorded without prompt text. An admin-operation trail (key CRUD / config / reload, with source IP) and optional at-rest content retention complete the audit surfaces (`/admin/audit/*`)
 - **Fleet-ready** — run N instances behind a load balancer: Postgres shares config (versioned + a change feed), the access-key table, the ledger/files/batches store, and a distributed batch queue any instance drains; Redis shares rate/quota/TPM counters, account health, and optionally the response cache. Single-node stays zero-dependency
 - **Providers behind traits** — engines talk to upstreams through a `Transport` seam; accounts with a real endpoint go over HTTP (reqwest + rustls), accounts without one are served by a deterministic in-process mock; AWS SigV4 signing included
 - **Observability built in** — Prometheus `/metrics` (per-route request/status counters, per-pipeline-stage latency, token counters), structured access logs

conf/gateway.yaml

@@ -86,6 +86,17 @@ tenants:
     fallback_model: gpt-4o-mini
     model_prices: # e2e: tenant pays a premium over the list price
       gpt-4o: {input_price_per_1k_micros: 5000, output_price_per_1k_micros: 20000}
+    # Optional per-tenant knobs (enterprise audit/compliance):
+    # user_daily_token_quota: 100000   # soft per-end-user daily cap
+    # retention: {content: redacted, days: 30}   # none | redacted | full (full needs GW_CONTENT_KEY)
+    # security:                        # overrides the global `security:` for this tenant
+    #   blocklist: ["forbidden"]
+    #   blocklist_action: flag         # block | flag | shadow
+    #   dlp_redact: true
+    #   detect_secrets: true           # mask API keys / credentials
+    #   moderate: false                # route to the wired external moderator
+    #   regex_rules:
+    #     - {name: ssn, pattern: '\d{3}-\d{2}-\d{4}', action: block}
 
 # Public model name → wire protocol, optional provider binding (only that
 # provider's accounts serve the model), plus demo prices (micros per 1k tokens).

crates/config/Cargo.toml

@@ -11,6 +11,8 @@ gw-consts = { workspace = true }
 serde = { workspace = true }
 serde_yaml = { workspace = true }
 thiserror = { workspace = true }
+regex = { workspace = true }
+tracing = { workspace = true }
 
 [lints]
 workspace = true