From 4c4675744cc1e321c3515b6076399a274d64f726 Mon Sep 17 00:00:00 2001 From: Joshua Valluru <326636767+joshua-berri@users.noreply.github.com> Date: Tue, 29 Sep 2026 15:29:24 -0700 Subject: [PATCH] fix(agents): only consult the identity store for managed targets is_agent_allowed entered the identity-store path whenever a prisma client was configured, so an ordinary agent paired with an internal user returned 503 instead of 200. Classify the target from the registry first and fall back to the store only when the registry has no entry, so an unmanaged target never depends on the store being reachable. --- .../agent_endpoints/auth/agent_permission_handler.py | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/litellm/proxy/agent_endpoints/auth/agent_permission_handler.py b/litellm/proxy/agent_endpoints/auth/agent_permission_handler.py index 4a77bb277bd..4686796480e 100644 --- a/litellm/proxy/agent_endpoints/auth/agent_permission_handler.py +++ b/litellm/proxy/agent_endpoints/auth/agent_permission_handler.py @@ -161,13 +161,15 @@ class AgentRequestHandler: from litellm.types.proxy.agent_identity import AgentIdentityFailure registered: Final = global_agent_registry.get_agent_by_id(agent_id) - if prisma_client is not None or (registered is not None and registered.identity_managed): + registry_managed: Final = isinstance(registered, AgentResponse) and registered.identity_managed + if registry_managed or (registered is None and prisma_client is not None): target: Final = await AgentIdentityStore.from_client(prisma_client).agent(agent_id) if isinstance(target, AgentIdentityFailure): - raise_identity_failure(target) - if target is None and registered is not None and registered.identity_managed: + if registry_managed: + raise_identity_failure(target) + elif target is None and registry_managed: return False - if target is not None and target.identity_managed: + elif isinstance(target, AgentResponse) and target.identity_managed: if ( not target.enabled or target.identity is None