> ## Documentation Index
> Fetch the complete documentation index at: https://docs.krea.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Model Access Controls

> Manage which AI models your workspace members can use with blocklist and allowlist modes.

<Info>
  **Business and Enterprise Only** — Model Access Controls are available on Business and Enterprise plans. [Contact our sales team](mailto:sales@krea.ai) to learn more.
</Info>

Model Access Controls let workspace owners and admins decide which AI models are available to their team. You can restrict models at the workspace or individual member level.

This is especially useful for organizations that need to comply with vendor policies, data governance requirements, or internal security standards.

## Key Concepts

### Two Modes

Krea offers two access control modes that determine how models are treated by default:

<CardGroup cols={2}>
  <Card title="Allow All (Blocklist)" icon="shield-check">
    Every model is **available by default**. You explicitly block the ones you don't want.

    New models added to Krea are **automatically available**.
  </Card>

  <Card title="Block All (Allowlist)" icon="shield-xmark">
    Every model is **blocked by default**. You explicitly allow the ones you approve.

    New models added to Krea are **automatically blocked** until you allow them.
  </Card>
</CardGroup>

<Tip>
  If your organization needs to review and approve each model before it becomes available, use **Block All (Allowlist)** mode. This ensures new models are never accessible until an admin explicitly enables them.
</Tip>

### Hierarchical Policies

Model access is enforced at multiple levels. Each level can further restrict — but never expand — access granted by the level above.

| Level         | Scope                                   | Availability  |
| ------------- | --------------------------------------- | ------------- |
| **Workspace** | Applies to everyone in the workspace    | Available now |
| **Member**    | Narrows access for an individual member | Available now |
| **Project**   | Narrows access for a specific project   | Coming soon   |

<Note>
  A member policy can only restrict models that are already allowed at the workspace level. It cannot grant access to a model the workspace has blocked.
</Note>

## Prerequisites

<CardGroup cols={2}>
  <Card title="Workspace Role" icon="user-shield">
    You must be a **workspace owner** or **admin**
  </Card>

  <Card title="Business or Enterprise Plan" icon="building">
    Model Access Controls require a Business or Enterprise subscription
  </Card>
</CardGroup>

## Choose an Access Control Mode

By default, new workspaces start in **Allow All (Blocklist)** mode. To switch:

<img src="https://mintcdn.com/krea/yXUnvYlVwIGpwFus/images/model-access-mode-toggle.png?fit=max&auto=format&n=yXUnvYlVwIGpwFus&q=85&s=90ca873c8201790a5fd43e8ecac6fa63" alt="Model Access mode toggle in Workspace Settings" width="754" height="112" data-path="images/model-access-mode-toggle.png" />

<Steps>
  <Step title="Open Workspace Settings">
    Navigate to [Workspace Settings ↗](https://www.krea.ai/settings/workspace-settings) and find the **Model Access** section.
  </Step>

  <Step title="Select a Mode">
    Click either **Allow All (Blocklist)** or **Block All (Allowlist)**.
  </Step>

  <Step title="Confirm the Switch">
    A confirmation dialog will explain the impact:

    * **Switching to Block All (Allowlist):** All models will be blocked by default. All currently available models will be added to the allowed list as a starting point, so nothing changes immediately — but any new model added to Krea in the future will be blocked until you allow it.
    * **Switching to Allow All (Blocklist):** All models will be allowed by default. Your current allowed list will be cleared.

    Click **Confirm** to apply.
  </Step>
</Steps>

<Warning>
  Switching modes clears all member-level policies. Only the workspace-level rules are preserved (or reset). Make sure you coordinate with your team before switching.
</Warning>

## Manage Workspace-Level Access

After choosing a mode, you can configure which models to block or allow at the workspace level.

<img src="https://mintcdn.com/krea/yXUnvYlVwIGpwFus/images/model-access-table.png?fit=max&auto=format&n=yXUnvYlVwIGpwFus&q=85&s=d007c9b10a8a752d7d448352785080bd" alt="Model access table showing models, providers, and access status" width="1274" height="1014" data-path="images/model-access-table.png" />

<Steps>
  <Step title="Open Model Access Settings">
    In [Workspace Settings ↗](https://www.krea.ai/settings/workspace-settings), expand the **Model Access** card.
  </Step>

  <Step title="Find Models">
    Use the **search bar** to filter models by name or provider. The table shows each model's name, provider, estimated compute cost, and current access status.
  </Step>

  <Step title="Select Models">
    Check the boxes next to the models you want to change.
  </Step>

  <Step title="Apply Changes">
    * In **Blocklist mode:** Click **Block** to restrict selected models, or **Allow** to unblock them.
    * In **Allowlist mode:** Click **Allow** to grant access to selected models, or **Block** to remove them from the allowed list.
  </Step>
</Steps>

## Manage Member-Level Access

You can customize model access for individual workspace members.

<Steps>
  <Step title="Go to Members">
    Navigate to [Members ↗](https://www.krea.ai/settings/members).
  </Step>

  <Step title="Open Member Menu">
    Find the member you want to configure and click the **three-dot menu** on their row.

    <img src="https://mintcdn.com/krea/yXUnvYlVwIGpwFus/images/model-access-member-menu.png?fit=max&auto=format&n=yXUnvYlVwIGpwFus&q=85&s=43978f6445ffc087cc3175f88a9c8494" alt="Member three-dot menu with Manage Feature Access option" width="454" height="242" data-path="images/model-access-member-menu.png" />
  </Step>

  <Step title="Select Manage Model Access">
    Click **Manage Model Access**. The model table will automatically expand inline below the member's row.
  </Step>

  <Step title="Configure Models">
    Block or allow models for that member. Models blocked at the workspace level will appear grayed out.
  </Step>
</Steps>

## How New Models Are Handled

This is the most important difference between the two modes:

| Scenario                | Allow All (Blocklist)                      | Block All (Allowlist)                            |
| ----------------------- | ------------------------------------------ | ------------------------------------------------ |
| New model added to Krea | Automatically **available** to all members | Automatically **blocked** for all members        |
| Admin action required?  | Only if you want to **block** it           | Yes — must **allow** it before anyone can use it |

<Warning>
  If you need new models to be blocked by default — for example, to prevent unapproved vendor models from becoming available to your team — make sure your workspace is set to **Block All (Allowlist)** mode.
</Warning>

## Downgrading Your Plan

If your workspace downgrades to a plan that does not include Model Access Controls, all access policies are automatically removed and your workspace reverts to the default behavior where all models are available.

<Note>
  Upgrading again will not restore your previous policies. You will need to reconfigure them.
</Note>

## Troubleshooting

<AccordionGroup>
  <Accordion title="I don't see the Model Access section in Workspace Settings">
    Model Access Controls are only available on **Business** and **Enterprise** plans. If you're on a different plan, you'll see an upgrade prompt instead. [Manage your subscription ↗](https://www.krea.ai/settings/workspace-settings) or [contact sales](mailto:sales@krea.ai) to upgrade.
  </Accordion>

  <Accordion title="New models keep appearing as available">
    Your workspace is in **Allow All (Blocklist)** mode. In this mode, new models are available by default. Switch to **Block All (Allowlist)** mode to ensure new models are blocked until you explicitly allow them. See [Choose an Access Control Mode](#choose-an-access-control-mode).
  </Accordion>

  <Accordion title="A member can still use a model I blocked">
    * Verify the block is applied at the correct level (workspace or member).
    * Check that the workspace mode is correct — in Allowlist mode, the model must be absent from the allowed list to be blocked.
  </Accordion>

  <Accordion title="I can't allow a model that's grayed out">
    The model is blocked at the workspace level. A member-level policy cannot override restrictions from above. Ask a workspace admin to allow the model at the workspace level first.
  </Accordion>

  <Accordion title="I switched modes and lost my member policies">
    Switching between Blocklist and Allowlist modes clears all member-level policies. This is expected because the semantics of the rules change between modes. You'll need to reconfigure member policies after switching.
  </Accordion>
</AccordionGroup>

## Need Help?

<CardGroup cols={2}>
  <Card title="Enterprise Support" icon="headset" href="mailto:support@krea.ai">
    Contact our enterprise support team at **[support@krea.ai](mailto:support@krea.ai)**
  </Card>

  <Card title="Sales Team" icon="envelope" href="mailto:sales@krea.ai">
    Questions about Business or Enterprise plans? Email **[sales@krea.ai](mailto:sales@krea.ai)**
  </Card>
</CardGroup>