Model access policies

A model access policy defines which providers and models are permitted through the LLM Gateway. The gateway blocks requests for providers or models the policy does not include, returning a 403 response. If no policy applies, all providers and models are available.

​

Policy configuration

A model access policy lists one or more providers, each with an access mode:

• All models: Every model the provider offers is permitted.
• Selected models: Only the models you specify are permitted. At least one model is required.

​

Scopes and overrides

A model access policy is scoped to one subject tier:

​

Policy overrides

Policy overrides let you grant a more specific subject different access than the broader default. A common case is giving one API key access to a premium model that is not available to the rest of the organization. When a request matches policies at multiple tiers, only the most specific tier applies, in the order API key, user, workspace, then organization. The more specific policy replaces the broader one entirely. For example, if the organization policy permits OpenAI and Anthropic, and an API key policy permits only OpenAI and Gemini, requests using that key can access OpenAI and Gemini only. If multiple policies match at the same tier, a model must be permitted by all of them to be accessible.

​

Create a model access policy

1. Go to Settings → Gateway → LLM Gateway and select Model Access.
2. Click Create model access.
3. Enter a Policy name.
4. Select the scope under Applies to (organization, workspace, user, or API key).
5. Configure the Allowed providers and models.
6. Save.

Policies take effect immediately.

​

Next steps

• Spend policies: set cost caps on LLM usage.
• Rate limit policies: limit request or token throughput.
• Per-customer policies: split a policy by a custom request header so each end customer gets its own allowance.
• Data protection: add data protection policies.

---