Routing predicates on request size and caller identity, and a data-residency constraint

Description

Routing within a model group supports weighted/round-robin, failover, least-cost, least-latency, least-busy, a semantic router steering on prompt content, and tag-conditional routing (ModelRoutingTarget.tags filtered by the caller-supplied x-aisix-routing-tags header, shipped end to end including CP schema and dashboard — the tag-based half of #54). Four gaps remain:

• (a) Request size is never a routing input. No predicate on estimated input tokens or prompt length, so "short prompts to a small cheap model, long ones to a large-context model" is not expressible.
• (b) Routing tags are caller-asserted, not identity-derived. Nothing binds tags to a key or team; team_id/user_id feed only rate-limit scope matching and telemetry. Tags are therefore a steering hint the caller controls, not a policy the operator enforces — a caller can assert any tag.
• (c) There is no region/residency attribute on a model target. region exists only as provider-credential plumbing and is an explicitly rejected rate-limit scope.
• (d) Access decisions bind to the requested model name, never the chosen target. Both allowed_models and allowed_cidrs reject on the requested name, so no group-internal placement constraint is expressible; a tag mismatch silently falls back to default-tagged targets by design.

Requested: routing predicates on estimated input tokens / prompt length and on caller identity attributes; a region attribute on targets; and a policy binding a key or team to an allowed region set, enforced against the chosen target with a hard reject rather than a silent fallback.

Why

Regulated workloads must prove prompts never leave a jurisdiction. Steering by region tag works today, but it is caller-asserted and silently falls back, so it is not a control an auditor accepts — and because enforcement binds to the requested model name, nothing prevents a region-scoped caller from being served by an out-of-region target inside a mixed-region group. That target-level blind spot is the novel gap here.

Request-size and identity predicates are separately the standard cost lever expected of an AI gateway. Note (a) and (b) may be cheaper framed as extensions of tag routing — bind tags to a key/team, add a strict no-fallback mode — than as a new predicate system; (c) and (d) are the genuinely new ask. Related: #54, api7/AISIX-Cloud#559.

Priority

Medium, rising to High for regulated deployments.

Prior art

No peer offers all three legs; the residency hard-reject looks unclaimed.

_{Surveyed 2026-07-15; every claim rests on a fetched docs/source page.}