# Access rules

> Allow or block models, providers, price ranges and IP addresses for an API key, a member or a team. How rules at different levels combine.

Source: https://digitspace.ai/docs/control/access-rules · Last checked: 2026-10-31

Access rules decide what a key may use. Open a key's menu and choose **Access rules**; members and teams have the same editor under **Team**.

Each rule is **Allow only** or **Block**, and applies to one of:

| Applies to       | Example                                                                                              |
| ---------------- | ---------------------------------------------------------------------------------------------------- |
| **Models**       | Allow only `claude-haiku-5-5` and `gpt-6-luna`.                                                      |
| **Providers**    | Block `xai`.                                                                                         |
| **Pricing**      | Allow only models up to $1 input and $5 output per million tokens, or only free or only paid models. |
| **IP addresses** | Allow only `203.0.113.0/24` (IPv4 or IPv6 CIDR). Enterprise plan.                                    |

A request must pass every active rule. Pause a rule to switch it off without deleting it.

## How levels combine

Rules can be set on a key, on the member who owns it, and on that member's team.

- **Block** rules from every level apply.
- **Allow only** lists must all agree: a model must be allowed at every level that has an allow list. So a key can narrow what its member or team may use, but never widen it.

## What the caller sees

| Rule                       | Response                                                                                 |
| -------------------------- | ---------------------------------------------------------------------------------------- |
| Model, provider or pricing | `403 model_not_allowed`                                                                  |
| IP address                 | `403 permission_error`: "Requests from this IP address aren't allowed for this API key." |

With `auto`, rules narrow the models `auto` chooses from instead of refusing the request.

## Who can change them

Owners, admins and project admins manage key rules; a key's creator can't change the rules on it unless they're one of these. Member and team rules are set by owners and admins.