### What

Sync `Router._embedding` selects its deployment without forwarding `request_kwargs`, while every comparable path forwards it. The team filter and the model-access-group filter therefore never see `user_api_key_team_id` or `user_api_key_auth` on sync embedding calls, so a sync caller can land on a deployment outside their team or access group.

Concretely, `_embedding` calls `get_available_deployment(model=model, input=input, specific_deployment=...)` with no `request_kwargs` (litellm/router.py around line 5072), whereas the async twin `_aembedding` calls `async_get_available_deployment(..., request_kwargs=kwargs)` (around 5158), and sync `_completion` calls `get_available_deployment(..., request_kwargs=kwargs)` (around 1896). Deployment selection reads the team id from `request_kwargs["metadata"]["user_api_key_team_id"]` in `_common_checks_available_deployment` and the auth object in `_filter_deployments_by_model_access_groups`; with no `request_kwargs`, `team_id` is `None` and `should_include_deployment` treats every deployment as globally accessible. Sync `_image_generation` has the same omission

### Related cache-layer gap

There is a second, related gap. `Cache._get_…