Isolate standalone key wallet handling

apps/aether-gateway/src/ai_pipeline/mod.rs

@@ -129,6 +129,7 @@ pub(crate) fn build_execution_runtime_auth_context(
         api_key_name: auth_context.api_key_name.clone(),
         balance_remaining: auth_context.balance_remaining,
         access_allowed: auth_context.access_allowed,
+        api_key_is_standalone: auth_context.api_key_is_standalone,
     }
 }
 

apps/aether-gateway/src/ai_pipeline/planner/report_context.rs

@@ -50,6 +50,10 @@ pub(crate) fn build_local_execution_report_context(
         "api_key_id".to_string(),
         Value::String(parts.auth_context.api_key_id.clone()),
     );
+    object.insert(
+        "api_key_is_standalone".to_string(),
+        Value::Bool(parts.auth_context.api_key_is_standalone),
+    );
     object.insert(
         "username".to_string(),
         parts

apps/aether-gateway/src/wallet_runtime/access.rs

@@ -22,7 +22,10 @@ pub(crate) async fn resolve_wallet_auth_gate(
             auth_snapshot.api_key_is_standalone,
         )
         .await?;
-    let is_admin = auth_snapshot.user_role.eq_ignore_ascii_case("admin");
+    let is_admin = wallet_auth_allows_admin_bypass(
+        &auth_snapshot.user_role,
+        auth_snapshot.api_key_is_standalone,
+    );
 
     Ok(Some(match wallet.as_ref() {
         Some(wallet) => map_wallet_snapshot(wallet).access_decision(is_admin),
@@ -60,12 +63,18 @@ fn map_wallet_snapshot(snapshot: &StoredWalletSnapshot) -> WalletSnapshot {
     }
 }
 
+fn wallet_auth_allows_admin_bypass(user_role: &str, api_key_is_standalone: bool) -> bool {
+    user_role.eq_ignore_ascii_case("admin") && !api_key_is_standalone
+}
+
 #[cfg(test)]
 mod tests {
     use aether_data::repository::wallet::StoredWalletSnapshot;
     use aether_wallet::{WalletAccessFailure, WalletLimitMode, WalletSnapshot, WalletStatus};
 
-    use super::{local_rejection_from_wallet_access, map_wallet_snapshot};
+    use super::{
+        local_rejection_from_wallet_access, map_wallet_snapshot, wallet_auth_allows_admin_bypass,
+    };
     use crate::control::GatewayLocalAuthRejection;
 
     #[test]
@@ -114,4 +123,10 @@ mod tests {
         assert!(decision.allowed);
         assert_eq!(decision.remaining, None);
     }
+
+    #[test]
+    fn standalone_key_never_uses_admin_wallet_bypass() {
+        assert!(wallet_auth_allows_admin_bypass("admin", false));
+        assert!(!wallet_auth_allows_admin_bypass("admin", true));
+    }
 }