> ## Documentation Index
> Fetch the complete documentation index at: https://www.krea.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Model Access
> Choose which AI models your Krea organization, workspaces, and members can use with approved-only or block-based rules for compliance and governance.
Model Access rules are available on Business and Enterprise plans. To upgrade, [contact sales](mailto:sales@krea.ai). Members on any plan can open Model Access to see which models they can use. If you used the controls in Workspace Settings before, see [What changed](#what-changed).
Model Access lets admins decide which AI models people can use in Krea. Organization admins can set rules for the whole organization, for each workspace, and for individual members. A standalone workspace sets rules for itself and its members.
## Open Model Access
Open [Manage ↗](https://www.krea.ai/manage/model-access) and click **Model Access** in the sidebar. Organization owners and admins find it in the organization section. Everyone else finds it in the workspace section.
Your role decides what you can see and edit:
| Role | What you can see and edit |
| - | - |
| Organization owner or admin | The organization's rules, plus the rules of every workspace in the organization. You can edit all of them. |
| Workspace owner or admin | The active workspace's rules, which you can edit. In an organization, an **Organization** column shows what the organization allows. You can't change that column. |
| Member | A read-only list of the models you can use in the active workspace, with the reason for each blocked model. |
## How access is decided
An organization has one policy, and each workspace can have its own. The organization policy applies in every workspace in the organization. A model is available to someone only when every policy that applies allows it. In an organization workspace, that means both the organization policy and the workspace policy.
### Default access
Each policy has a **Default access** setting:
| Setting | What it does | New models Krea adds |
| - | - | - |
| **Follow organization access** | The workspace has no rules of its own and uses the organization's. Outside an organization, this setting is called **No restrictions**. | Follow the organization |
| **All models except blocked** | Every model is available unless you block it. | Available right away |
| **Approved models only** | Only models you approve are available. | Blocked until you approve them |
Switching a policy to **Approved models only** doesn't approve anything for you. Until you approve models, every model is blocked for everyone the policy covers. Approve the models you want before you save. See [Approve every model from one company](#approve-every-model-from-one-company).
### Rules
A rule approves or blocks one model, for everyone the policy covers or for one member. Each rule names an exact model, so models Krea adds later start with no rules.
Two things decide the result:
* **Blocks override.** Within a policy, a block for everyone overrides any member approval.
* **Every policy must allow the model.** An organization block, or a missing organization approval, overrides a workspace approval. The editor disables those approvals and shows **Approve it for the organization first**.
```text theme={null}
Organization policy allows the model? ──no──▶ Blocked
│ yes
▼
Workspace policy allows the model? ──no──▶ Blocked
│ yes
▼
Available
```
## Edit rules
Changes stay in draft until you save. **Discard changes** restores the saved rules.
Open **Rules for** at the top of the table. Organization admins can pick **Organization**, **Workspace**, or **Member**. Workspace admins can pick the workspace or **Member**.
Pick a **Default access** setting. A dialog explains what the change does to existing rules. Switching to **All models except blocked** removes the policy's approvals and keeps its blocks.
Check **Approve** or **Block** next to each model. The **Approve** column appears only under **Approved models only**. To narrow the list, search or use **Filter** to pick a company, provider, or tool. To change every listed model at once, click **Edit all N models** next to the search field, then choose **Approve all**, **Block all**, or **Clear all rules**.
Click **Review changes** to see each changed rule and how access changes for the people it covers. Then click **Save all**. Krea saves each policy separately.
To see who can use a model, click its row. The expanded row lists each workspace and member with their result and the rule that decided it. You can add a workspace or member rule from there.
### Workspace rules in an organization
Organization admins can give a workspace its own rules. Choose **Rules for** > **Workspace**, then pick the workspace. If the workspace follows organization access, **Add rules for** asks how its rules should work:
* **All models except blocked**: members can use every model the organization allows, except ones blocked for this workspace.
* **Approved models only**: members can use only models the organization allows and this workspace approves.
Workspace rules can only narrow what the organization allows.
### Member rules
Choose **Rules for** > **Member**, pick the person, and approve or block models for them. In an organization, a member rule that an organization admin sets applies in every workspace of the organization. A member rule that a workspace admin sets applies only in that workspace.
You can also open Model Access from a member's **⋯** menu on the **Members** page.
## Examples
### Approve every model from one company
Choose **Rules for** > **Organization**, then set **Default access** to **Approved models only**.
Click **Filter** > **Company** and pick the company.
Click **Edit all N models** next to the search field and choose **Approve all**. Then click **Review changes** and **Save all**.
Models the company releases later still need your approval.
### Block one model in one workspace
Choose **Rules for** > **Workspace**, pick the workspace, and check **Block** for the model. If the workspace was following organization access, it switches to **All models except blocked** with that one block.
### Let a few people try a model
Under **Approved models only**, leave the model unapproved, then choose **Rules for** > **Member** and approve it for each tester. Pilots need **Approved models only**, since a block for everyone also covers your testers.
### Block a model for one person
Choose **Rules for** > **Member**, pick the person, and check **Block** for the model.
## What members see
Model pickers dim blocked models, and compact pickers group them under **Restricted by your admins** with a lock icon. **Auto** skips them.
Picking a blocked model opens a dialog with up to three admins to contact and, when one exists, a suggested alternative. Admins who can change the rule see a **Manage Model Access** button in place of the contact list.
Each member's Model Access page shows why a model is blocked:
| Reason | Meaning |
| - | - |
| Blocked by your organization | An organization rule blocks it. |
| Blocked by this workspace | A workspace rule blocks it. |
| Needs organization approval | The organization uses **Approved models only** and hasn't approved it. |
| Needs workspace approval | The workspace uses **Approved models only** and hasn't approved it. |
## Where rules apply
Krea checks access at the start of every generation, in every tool, the [Krea API](/docs/api-reference/introduction), and the Krea MCP server. Blocked API and MCP requests return HTTP 403 with `FEATURE_RESTRICTED`. Realtime checks on connect, then about once a minute.
## Plan changes
Downgrading to a plan without Model Access pauses enforcement. Krea keeps the rules and applies them again when you upgrade.
## What changed
Model Access replaces the Workspace Settings controls. Every workspace's rules carried over, and every blocked model stayed blocked.
| | Before | Now |
| - | - | - |
| Where to edit | **Model Access** card in Workspace Settings | **Manage** > **Model Access** |
| Member rules | **⋯** > **Manage Model Access** on the Members page | **Rules for** > **Member** |
| Allow everything by default | Allow All (Blocklist) | **All models except blocked** |
| Require approval | Block All (Allowlist) | **Approved models only** |
| Member exceptions | A member approval could lift a workspace block | Blocks override member approvals |
| Changing default access | Cleared every member rule | Keeps member rules |
| Switching to approval mode | Approved every available model | Starts with zero approvals |
| Plan downgrade | Deleted the rules | Pauses enforcement until you upgrade |
Some workspaces blocked a model for everyone while letting certain members use it. Krea switched these to **Approved models only** and approved every other model, so access stayed the same. New models now need approval there. To switch one back to **All models except blocked**, first block the models it used to block, or they open up to everyone.
## Troubleshooting
Click the model's row in the editor. The expanded row shows the result for each workspace and member, and the rule that decided it. Members can see the reason on their own Model Access page.
Another rule blocks it. Blocks override approvals, so look for a block that applies to everyone or to that member. In an organization, also check that the organization allows the model.
The **Approve** column appears only when the policy uses **Approved models only**. A workspace approval is disabled when the organization blocks the model or hasn't approved it. Approve it for the organization first.
The policy has no approvals yet. Approve the models you want, or click **Discard changes** if you haven't saved. See [Approve every model from one company](#approve-every-model-from-one-company).
The policy uses **All models except blocked**, which makes new models available right away. Switch to **Approved models only** if you want to approve each new model first.
Model Access rules require a Business or Enterprise plan. [Contact sales](mailto:sales@krea.ai) to upgrade.
Only organization owners and admins can edit organization rules. Ask one of them to make the change.
Another admin saved that policy while you were editing it, and Krea loaded their version. Make your changes again and save.
Every model Auto could use is blocked for you. Pick a model yourself, or ask an admin for access.
They moved to Model Access. See [What changed](#what-changed).
## Need help?
Email our enterprise support team at [support@krea.ai](mailto:support@krea.ai).
Ask about Business or Enterprise plans at [sales@krea.ai](mailto:sales@krea.ai).
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.