Provider permissions: UI — model assignment multi-select

[jeonghun-jj-lee]

Important

Decision Surface

Problem: Users need a way to assign models to trust tiers from the Permissions tab.

Approach: Each tier card has an "Assign models" button that opens a multi-select picker. Shows all configured models grouped by provider. A model can only belong to one tier — assigning it removes it from its previous tier.

Scope: Model assignment UI + persistence. Requires the Permissions tab (slice #7) to exist.

---

Acceptance Criteria

• Each tier card shows an "Assign models" button (or inline model list with edit affordance)
• Clicking opens a multi-select picker showing all configured/connected models
• Models are grouped by provider in the picker (e.g., "Anthropic: claude-opus-4, claude-sonnet-4")
• Selecting a model assigns it to this tier; deselecting removes it (returns to Unassigned)
• A model can only belong to one tier — selecting it in tier B automatically removes it from tier A
• The tier card shows its assigned models inline (e.g., "Models: claude-opus-4, claude-sonnet-4")
• Changes persist to config immediately
• Models not assigned to any tier are listed under the "Unassigned" card (or shown as "all others")

Key Decisions

#	Decision	Rationale
1	Multi-select inside the tier card (not a separate panel)	Keeps assignment contextual — you see what the tier allows while assigning
2	One-tier-per-model enforced at UI level	Prevents confusing conflicts; clear mental model
3	Group by provider in picker	Helps users find models quickly when they have many configured

Testing Decisions

• Test picker shows all configured models grouped by provider
• Test selecting a model assigns it to the tier (persists to config)
• Test selecting a model already in another tier moves it (removes from old tier)
• Test deselecting returns model to "Unassigned"
• Test Unassigned card reflects unassigned models
• Extends Provider permissions: UI — Permissions tab with tier cards #170 test surface

Constraints & Invariants

• Must handle the case where a model is removed from provider config — orphan assignments are cleaned up silently
• Picker must show model display names (not raw IDs) where available

Source

Part of #163
Blocked by #170