[Bug]: Model access being off by default is easy to miss; update when stacklok-enterprise-platform#5754 lands #1284

Page or section

• docs/ai-gateway/control-model-access.mdx, "Turn on model access"
• docs/ai-gateway/index.mdx, "Administer an installed gateway", step 3 ("If model access is on, …")
• docs/platform/enterprise-platform/configure-ai-gateway.mdx

What's wrong?

Model access enforcement is off unless modelAccess.enabled is set in the AI Gateway Helm values. The docs say so, but only as a step in the model access guide and a conditional in the index ("If model access is on"). The console doesn't warn either: admins can create Model Sets, grant them to groups and narrow All Users, and none of it applies.

That happened on the demo cluster. A Frontier set granted only to Engineering, with those models removed from All Users, still let a non-Engineering user call them until the Helm value was set. People who work on the platform daily didn't know this was a separate switch.

The platform team plans to make model access always on (stacklok/stacklok-enterprise-platform#5754).

Suggested fix

• If #5754 ships soon: update all three pages to match. Remove the "turn on model access" step and the "If model access is on" conditional, and describe what changes on upgrade: All Users starts with every model, so nothing changes until an admin narrows it. Add release-notes or upgrade-note coverage too.
• If it doesn't: in the meantime, add a prominent note at the top of control-model-access.mdx and in configure-ai-gateway.mdx that Model Sets have no effect until modelAccess.enabled is set. Make step 3 in the index unconditional ("Turn on model access, then grant the model…").

Additional context

Found while walking through the model access demo flow on the demo cluster, October 27, 2026.

Fully or partially written by an AI agent.