Model Residency Matrix¶
Model residency is a deployment property, not a model-name promise. Confirm the cluster location, the selected provider, the provider account's contracting entity and processing region, support access, telemetry, backups, and subprocessors before approving real data. The model_allowed_classification value is a routing ceiling rather than a compliance certification.
Shipped deployment profiles¶
| Profile | Where prompts go | Jurisdiction boundary | Does a model credential leave the cluster? |
|---|---|---|---|
demo |
To the in-cluster deterministic response stub only. This is a protocol fixture, not a language model, and returns canned test replies. | The operator's disposable cluster; no model provider processes the prompt. | No; the stub has no model credential. |
local |
By tracked default, to Vertex AI google/gemini-2.5-flash; selecting a provider profile changes this boundary. |
Google and the configured GCP project/region, plus the local cluster operator's jurisdiction. The tracked region does not alone establish contractual EU-only processing. | Yes. ADC exchanges a short-lived Google credential with Google; no credential is given to an agent. |
gcp |
By tracked default, to self-hosted vLLM using Qwen/Qwen2.5-7B-Instruct inside the GKE cluster. |
The cluster operator and selected GCP region. An EU-region deployment keeps serving-time prompts in that EU cluster, subject to the operator's support, logging, backup, and access choices. | No model credential. The one-shot model bootstrap downloads public weights; live funded-GPU acceptance remains open under issue #10. |
The gcp row records the shipped default and policy decision. It does not claim that issue #10's funded 24 GiB GPU live-acceptance gate has run.
Shipped model-provider profiles¶
| Profile | Where prompts go | Provider / jurisdiction boundary | Does a model credential leave the cluster? |
|---|---|---|---|
vllm |
To the vLLM service inside the selected cluster; only the prompt-free bootstrap downloads pinned public model weights. | The cluster operator's chosen jurisdiction. Serving-time prompts remain in-cluster; an EU cluster can therefore keep them inside the EU. | No model credential. |
mistral |
To Mistral's hosted API. | Mistral AI, France/EU, subject to the account, endpoint, contract, support, and subprocessors selected by the operator. | Yes. Agentgateway presents the Mistral API key to the external service; agents never receive it. |
anthropic |
To Anthropic's hosted API. | Anthropic, United States; any available regional processing or transfer terms remain account and contract controls. | Yes. Agentgateway presents the Anthropic API key to the external service; agents never receive it. |
openai |
To the configured OpenAI API host. | OpenAI, United States by default. Eligible projects may select the European API host, but eligibility, storage, support access, and contractual scope still require operator verification. | Yes. Agentgateway presents the OpenAI API key to the external service; agents never receive it. |
azure-openai |
To the operator's Azure OpenAI resource. | The selected Azure region/data zone and the operator's Microsoft contracting boundary; configuration alone does not prove EU-only processing. | Yes. Agentgateway presents the Azure API key to the external service; agents never receive it. |
vertex |
To Vertex AI in the configured GCP project and region. | Google and the selected account/region; region selection alone does not prove contractual EU-only processing. | Yes. Workload Identity or ADC obtains a short-lived Google credential that agentgateway presents externally; agents never receive it. |
EU prompt boundary¶
The unambiguous in-repository EU path is vllm (including the gcp default) deployed in an EU cluster: serving-time prompts stay in that cluster. mistral is the shipped EU-hosted external API option, but prompts leave the cluster and the operator must validate the account's complete legal and processing boundary. openai, azure-openai, and vertex can expose EU region or data-zone controls; those controls are not treated here as proof that prompts remain exclusively inside the EU. demo has no prompt egress but is only a canned protocol fixture, not usable inference.
For provider configuration, model pins, and the self-hosted GPU render contract, see Model Provider Profiles. For room-classification admission and the NetworkPolicy backstop, see Security Boundaries.