Restrict AI models
Allow or block specific AI models for a provider, such as allowing only approved Claude models.
A Model Restriction rule controls which AI models users can use. Use it to allow only approved models, or to block specific ones.
New to policies? Start with Policies overview.
Before you start
Only providers and models in your Provider Inventory appear in the rule. If a provider is missing, add it to the inventory first.
Add a model restriction
- Go to Security → Policies and open a policy, or click Create Policy.
- Click Add rule and choose Model Restriction.
- Fill in the fields below and click Add rule.
- Click Save, then Deploy.
Fields
Field | What it does |
|---|---|
Enforcement | Block, Warn or Watch. |
Provider | Apply the rule to one provider, or to Any. |
Mode | See below. |
Models | Pick a provider on the left, then tick its models on the right. |
Modes
- Allow list (default): allows only the selected models and blocks the rest.
- Block list: blocks the selected models and allows the rest.
- Block all: blocks every model.
In the example above, the Sales group can only use Claude Opus 5, Claude Sonnet 5 and Claude Haiku 4.5.
To cap how much a model is used rather than block it, use Set token limits. To block a provider's domains entirely, use Control provider hostnames.
When rules overlap
A policy can hold one Model Restriction rule per provider. If several policies cover the same device, the most specific scope wins (Client, then User, then Group, then Organization). At the same level, the stricter rule wins: Block all, then Allow list, then Block list. See Policies overview for the full rules.
Need help?
Contact support@getalesia.com.
Was this helpful?
Your feedback shapes what we write next.