LLM gateway management¶

The LLM gateway management pages control which LLMs an organization's users can access through the LLM gateway. Set policies at the provider, publisher, and LLM level, and those policies are then applied to the organization, groups within the organization, or individual users. Policies apply to every agentic workflow that uses the LLM gateway, including the playground, chat completions, and deployed agents.

Cascading access control¶

Policies provide an access hierarchy that functions so that the most specific rule "wins"—LLM rules take precedence over publisher rules, which take precedence over provider rules. Rules from different levels do not merge—a more specific level does not combine with the level above it, it replaces it.

In other words, evaluation uses the most specific level that has any rule. If that level is empty, access falls through to the parent. If every level is empty, access is denied. Within the level that decides, any matching deny overrides any matching allow. A more specific allow cannot override a deny at the same level.

In this way you can allow an entire provider (for example, Azure OpenAI) for the organization with a single policy instead of enabling each LLM individually. Publishers and LLMs inherit that policy. Or, you apply that policy but simultaneously provide a specific override, for example preventing the group contractors from accessing specific models.

See LLM gateway permissions and evalution details for information on how policy is processed in the platform.

LLM gateway management page¶

To manage LLM access, open Admin settings from the top navigation bar and select LLM gateway management in the left sidebar.

The page opens on the LLM access tab.

Access control entities¶

The levels that can be controlled by policy configuration, as defined above, are: provider, publisher, and LLM.

The left panel of the LLM access tab lists LLM providers as top-level categories and publishers as child categories; click a provider to expand it and see the associated publishers. Select a provider or publisher to view its policies and associated LLMs in the main panel. When you select an LLM, the panel displays that LLM's policies and shows how the final LLM policy was determined.

Use the search field at the top of the left panel to filter providers and publishers by name. Search matches providers and publishers only—not individual LLMs. To find a specific LLM, select a provider or publisher and use the search field in the LLM list.

Badges in the left panel, next to the provider or publisher name, summarize the policy on each resource.

Provider policy definitions¶

At the provider level, you can set one of the following policies:

Publisher policy definitions¶

At the publisher level, you can set one of the following policies:

LLM policies¶

At the LLM level, you can set one of the following policies:

Configure LLM access¶

Select a provider, publisher, or LLM to open the policy summary for that resource. The heading identifies the resource (for example, Provider: Amazon Bedrock). Use Edit policy to add or change conditions. Use Delete to remove the policy.

You can add Allow and Deny conditions for the organization, groups, and users on the same resource. Publisher- and LLM-level policies replace the parent policy where defined. Changes apply to new LLM requests immediately; users who already have a playground or catalog view open may need to refresh the page.

The policy panel shows the conditions currently set on the selected resource, or an empty state if none are set. The following table describes the effect at each level. The screenshot above is a provider policy of Allow Organization on Amazon Bedrock.

Add or edit conditions¶

To add or edit conditions, click Edit policy. The list of conditions make up the policy for the given entity.

For each condition, set the following fields:

Click Add rule to add another condition. Click Cancel to discard changes. If you leave the form with unsaved changes, a confirmation dialog reports that rules added to the access policy have not been saved and will be lost.

The save action and inherited-rule banner vary by level:

If conditions conflict, the affected principal values are highlighted and a message is displayed below them. Organization Deny with a group or user Allow is not applied. Group Deny with a user Allow for a member of that group is ignored.

Delete a policy¶

Click Delete on the policy summary. A confirmation dialog describes the effect of the deletion.

View LLMs¶

When a provider or publisher is selected, the LLMs table lists the LLMs available at that level. Click an LLM row to open its policy and policy resolution details. Click Back to return to the table.

The table includes the following columns:

Use Show retired to include retired LLMs, and use the search field to filter by name. If no LLMs match, the table displays No matches found.

LLM policy resolution¶

When you select an LLM, Policy resolution lists Provider, Publisher, and LLM and shows the policy at each level. Read from the LLM row first (most specific), then publisher, then provider.

The table uses the following badges:

For the evaluation model, worked examples, and common policy patterns, see LLM gateway permissions and evaluation.