In our previous post, we talked about the API key lifecycle in MaaS. In this article, we'll set up the governance layer those keys bind to, focusing on 2 core controls: managing token quotas (via MaaSSubscription) and defining model access rules (via MaaSAuthPolicy).Models-as-a-Service (MaaS), an integrated component of Red Hat Openshift AI, aims to give enterprises a flexible GitOps friendly way to set up their policy framework.Both attach to models through a MaaSModelRef:MaaSSubscription defines how much a user can consume in a given time window.MaaSAuthPolicy defines which models a user is permitted to call.Subscriptions: Quota-backed entitlementsA MaaSSubscription defines the quota. It declares an owner (groups or users) and defines how many tokens they can consume within a time window. When an application creates an API key, that key binds to a subscription. The bound subscription travels with every request the key makes. The platform enforces the limits continuously; administrators do not watch and adjust them by hand.A subscription can define a quota for a single model, or all the models across your enterprise. This gives enterprises flexibility in how they want to define the subscription and entitlement approach that maps people and workloads to specific models, instead of forcing a single "one size fits all" subscription shape. AuthPolicies: Access rulesA MaaSAuthPolicy defines access by naming a set of subjects (groups or users) and declaring which models they are permitted to reach. The separation from the subscription is intentional. A team can hold a premium subscription spanning many models while an auth policy limits them to a specific subset. They consume at premium rates; they see only what they are authorized to see. Because these configurations are independent, you can modify an auth policy to add a model without touching the subscription, or change the subscription's rate limits without affecting the policy. Each evolves on its own schedule.The 2-gate systemEvery request to a model passes through the MaaS API Gateway, where MaaSAuthPolicy (access) and MaaSSubscription (quota) are enforced in parallel per model. Both must pass before the request reaches the inference server.