mirror of
https://github.com/netbirdio/netbird.git
synced 2026-07-28 02:12:33 -04:00
denyFromManagement returned the generic "LLM policy limit exceeded" for every deny code. Map llm_policy.model_blocked / model_unknown to the same model-specific messages the local guardrail uses, keeping other codes generic so internal quota detail never leaks. Document the fail-open trade-off: the proxy backstop carries the union of restricting policies' models, so per-group narrowing is lost during a CheckLLMPolicyLimits outage.