Model access rules
Decide which agents and users can call which models, on the Agent Access page.
If you don't see this feature in your console, ask your SecureAuth contact to
enable the llm_gateway feature flag for your organization.
Once model calls go through the gateway, you decide which agents and users can call which models. Model access rules are Agent Access rules for model calls, kept on their own Model calls tab.
Where the rules live
On Controls › Agent Access, the Model calls tab appears when the AI gateway is on for your organization. Tool calls keeps the rules for MCP tool calls. Each tab lists its rules in evaluation order, and the first matching rule decides the call. A call that matches no rule is denied.
Write a model rule
Select Add Rule on Model calls to open the model rule editor.
A model rule has the effect Allow or Deny, and matches agents, users, groups, model providers, and model names.
Like a tool rule, it has a status of Draft, Active, or Disabled, and only active rules are enforced.
Filter the list by User, Group, Agent kind, or Provider.
Adding, editing, or reordering a rule needs manage_policies.
A model also needs a Model Providers connection that allows it, or the gateway refuses the call before any rule runs. For the full screen, see Agent Access.