support allow list and blocklist

server/routers/siteResource/createSiteResource.ts

@@ -90,7 +90,7 @@ const createSiteResourceSchema = z
             .array(resourceAiProviderAttachmentSchema)
             .optional()
             .describe(
-                "For inference-mode site resources: AI providers to attach. Each entry may set modelAccessMode (catalog or allowlist); defaults to catalog. Model keys must be unique across attached catalog providers."
+                "For inference-mode site resources: AI providers to attach. Providers are attached in inherit mode, using each provider's own allow/block lists. Effective allow model keys must be unique across attached providers."
             )
     })
     .strict()
@@ -350,9 +350,14 @@ export async function createSiteResource(
 
         let providerAttachments: ResourceAiProviderAttachment[] = [];
         if (mode === "inference") {
+            // A new site resource has no model selections yet, so providers
+            // always start in inherit mode; select can be enabled afterwards.
             const resolved = await resolveProviderAttachments({
                 orgId,
-                attachments: aiProviderInputs ?? [],
+                attachments: (aiProviderInputs ?? []).map((p) => ({
+                    providerId: p.providerId,
+                    accessMode: "inherit" as const
+                })),
                 requireAtLeastOne: false
             });
             if (isInferenceFieldsError(resolved)) {