## What happened?

The Bedrock passthrough routes under `/bedrock/model/{modelId}/...` **do not enforce** the `models` allowlist configured on the API key (`key.models`) or on the user (`user.models`). A virtual key scoped to a specific set of models can freely call **any** Bedrock model via these routes.

This is particularly impactful for Claude Code CLI users, because Claude Code has a first-class Bedrock integration (`CLAUDE_CODE_USE_BEDROCK=1` + `AWS_BEARER_TOKEN_BEDROCK=<litellm_virtual_key>`) that hits this exact path — so a key intended to grant access to only a limited set of models can be used to call frontier Bedrock models (e.g. `claude-opus-4-7`) without any warning.

## Repro

Tested against a deployment running `v1.83.3-stable.patch.2`. The code path exists unchanged on `main` (HEAD as of this writing).

### Setup

1. Define a model named `claude-opus-4-7` in `config.yaml` pointing at `bedrock/global.anthropic.claude-opus-4-7`. 2. Create a virtual key whose `models` list **does not** include `claude-opus-4-7` (e.g. it only contains an access group that does not cover this model).

### Step 1 — Standard routes correctly block (baseline)

All three standard entrypoints…