litellm - ✅(Solved) Fix [Bug]: Per-member allowed_models does not resolve access groups for team-scoped DB models [1 pull requests, 1 participants]

litellm2026-05-06 16:13:18

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

BerriAI/litellm#27302•Fetched 2026-05-07 03:33:12

View on GitHub

Comments

Participants

Timeline

Reactions

Author

dibyom

Participants

dibyom

Timeline (top)

labeled ×2closed ×1cross-referenced ×1

Root Cause

Likely Root Cause

Fix Action

Fixed

Fixed by PR: Fix/member access group team (https://github.com/BerriAI/litellm/pull/27317)

PR fix notes

PR #27317: Fix/member access group team

Repository: BerriAI/litellm
Author: dibyom
State: closed | merged: True
Link: https://github.com/BerriAI/litellm/pull/27317

Description (problem / solution / changelog)

Relevant issues

Fixes #27302

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

I have Added testing in the tests/test_litellm/ directory, Adding at least 1 test is a hard requirement - see details
My PR passes all unit tests on make test-unit
My PR's scope is as isolated as possible, it only solves 1 specific problem
I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

CI (LiteLLM team)

CI status guideline:

50-55 passing tests: main is stable with minor issues.

45-49 passing tests: acceptable but needs attention

<= 40 passing tests: unstable; be careful with your merges and assess the risk.

Branch creation CI run
Link:
CI run for the last commit
Link:
Merge / cherry-pick CI run
Links:

Screenshots / Proof of Fix

Type

🐛 Bug Fix

Changes

fix(auth): pass team_id in member-level model access check

check_team_member_model_access calls can_object_call_model without team_id, so access groups defined via model_info.access_groups cannot resolve for team-scoped DB models (their internal router name is model_name<team><uuid>, not the public name). The team-level check already passes team_id; this mirrors that.

Eight tests covering _can_object_call_model and _check_team_member_model_access with team-scoped DB models:

access group resolves when team_id is passed
access group fails without team_id (pre-fix behavior)
literal model name still works with team_id (no regression)
denied model still denied with team_id
second model in group also reachable
end-to-end member access via access group (mocked membership)
end-to-end member denied for model not in allowed list
no-override member inherits team-level check

Changed files

litellm/proxy/auth/auth_checks.py (modified, +1/-0)
tests/test_litellm/proxy/auth/test_auth_checks.py (modified, +279/-0)

Code Example

_can_object_call_model(
    model=model,
    llm_router=llm_router,
    models=member_allowed_models,
    object_type="team",
    # team_id is missing here
)

---

_can_object_call_model(
    model=model,
    llm_router=llm_router,
    models=team_object.models if team_object else [],
    team_model_aliases=team_model_aliases,
    team_id=team_object.team_id if team_object else None,  # ← present
    object_type="team",
)

---

_can_object_call_model(
    model=model,
    llm_router=llm_router,
    models=member_allowed_models,
    object_type="team",
    team_id=team_object.team_id,  # add this
)

---

RAW_BUFFERClick to expand / collapse

Check for existing issues

I have searched the existing issues and checked that my issue is not a duplicate.

What happened?

When models are created via /model/new with model_info.team_id (team-scoped BYOK DB models), per-member allowed_models set via /team/member_add cannot use access group names — only literal model names work. The same access groups resolve correctly at the team level.

Likely Root Cause

In litellm/proxy/auth/auth_checks.py, the member-level check (can_team_member_access_model, ~line 3294) calls _can_object_call_model without passing team_id:

_can_object_call_model(
    model=model,
    llm_router=llm_router,
    models=member_allowed_models,
    object_type="team",
    # team_id is missing here
)

The team-level check (can_team_access_model, ~line 2837) does pass it:

_can_object_call_model(
    model=model,
    llm_router=llm_router,
    models=team_object.models if team_object else [],
    team_model_aliases=team_model_aliases,
    team_id=team_object.team_id if team_object else None,  # ← present
    object_type="team",
)

Without team_id, get_model_access_groups calls get_model_list(model_name=..., team_id=None), which can't find team-scoped DB models (their internal router name is model_name_<team>_<uuid>, not the public model name). So access_groups comes back empty and the group check fails.

Suggested Fix

Pass team_id in the member check:

_can_object_call_model(
    model=model,
    llm_router=llm_router,
    models=member_allowed_models,
    object_type="team",
    team_id=team_object.team_id,  # add this
)

Steps to Reproduce

Create a team with models: ["fast-models", "mock-power"]
Create DB models via /model/new with model_info.team_id set to that team, two of which have model_info.access_groups: ["fast-models"]
Add a member with allowed_models: ["fast-models"] via /team/member_add
Call a model in the fast-models group using that member's key → team_model_access_denied
Same call with no per-member override (inheriting team's models list) → succeeds

Expected Behavior

The member-level allowed_models check should resolve access group names the same way the team-level check does, by passing team_id so the router can find team-scoped DB models.

Relevant log output

What part of LiteLLM is this about?

Proxy

What LiteLLM version are you on ?

v.1.83.11-nightly

Twitter / LinkedIn details

No response

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

#prompt issue #agent setup #task chaining #parallel task #integration issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

litellm - ✅(Solved) Fix [Bug]: Per-member allowed_models does not resolve access groups for team-scoped DB models [1 pull requests, 1 participants]

Recommended Tools

GitHub issue graph ai analysis

Root Cause

Likely Root Cause

Fix Action

Fixed

PR fix notes

PR #27317: Fix/member access group team

Description (problem / solution / changelog)

Relevant issues

Linear ticket

Pre-Submission checklist

Delays in PR merge?

CI (LiteLLM team)

Screenshots / Proof of Fix

Type

Changes

Changed files

Code Example

Check for existing issues

What happened?

Likely Root Cause

Suggested Fix

Steps to Reproduce

Expected Behavior

Relevant log output

What part of LiteLLM is this about?

What LiteLLM version are you on ?

Twitter / LinkedIn details

Still need to ship something?

RELATED_DISCOVERY

TRENDING