Module policy_gate 

Org-policy gateway gate (enterprise#25) — model ceiling + hard budgets, enforced in the forward path only under a signed, trusted, enforced = true org policy (crate::core::policy::org).

Three governance controls, all from the policy’s new sections (Doc 08 §4.3):

1. Model ceiling ([routing].allowed_models) — a request whose requested model matches no allowlist pattern is refused with 403 before it leaves the gateway.
2. Hard budgets ([budgets]) — measured spend per person/UTC-day and per project/UTC-month; a breached cap refuses further requests with 429 until the window rolls over.
3. Per-person rate limit ([budgets].max_requests_per_minute_per_person, enterprise#66) — accepted requests per person per UTC minute; the excess is refused with 429 + Retry-After until the minute rolls. Counted in-process (per replica), which is the right blast-radius control against a single runaway agent without cross-replica chatter.

Spend accounting feeds from the same choke-point as all metering (super::usage_meter::record) and is seeded from the central usage store when the gateway runs with Postgres, so budgets survive restarts and cover multi-replica deployments to the seeding interval’s precision.

Design guarantees:

• Local-free invariant: without an installed + pinned + enforced org policy this module is a no-op — a solo user’s traffic is never gated.
• Fail-open on infrastructure: seeding errors only degrade precision (in-process counting continues); they never block traffic.
• O(1) per request: the policy snapshot is cached with a short TTL; budget lookups are two hash-map reads.

Structs

GateRules

The governance subset of the active org policy the gate enforces.

Enums

Refusal

Why the gate refused a request.

Functions

active_rules

The active governance rules, from cache or a fresh policy load. None = no enforced org governance → the gate is a no-op.

blocked_counters

(model-ceiling blocks, budget blocks, rate-limit blocks) since process start.

downgrade_forbidden

Whether the router must not downgrade this project’s requests.

enforce

The full gate: model ceiling, then budgets, then the per-person rate limit. Ok(()) forwards (and counts the request against the rate window); a refusal carries everything needed to render the wire-shape error.

model_allowed

Whether the requested model passes the ceiling. An empty allowlist means “no restriction”.

record_spend

Records one measured turn’s cost against the budget windows. Called from the metering choke-point; cheap (two hash-map bumps) and never blocking.

refusal_response

Renders a refusal as the wire-shape error the client’s SDK understands. Model blocks → 403, budget blocks → 429 with Retry-After.

seed_from_store

Replaces the seeded baselines with fresh sums from the central usage store (gateway-server mode). The live deltas reset — the store query already includes everything this process pushed through the usage sink.