This guide explains how to control which Claude models members of your organization can use, and how to cap the effort level each role can select per model. You can manage model access for your whole organization or for specific custom roles.
Model access settings are available in beta for Enterprise plan organizations. Primary Owners, Owners, and members whose custom role grants the Identity & Access permission can manage them in Organization settings > Models.
To set the model new conversations start on, see Set a default model for your organization.
How model access works
Model access is determined at two levels:
Organization level: each model is enabled or disabled for everyone in your organization. Disabling a model here removes it for every member, including Owners and Admins.
Custom role level: for members on custom roles, each role grants access to a subset of the models enabled at the organization level. A role can also cap the maximum effort level members can select on each model.
The organization setting is the ceiling, so a role can’t grant access to a model that’s disabled for the organization. When the feature first becomes available, every model is enabled at both levels, so nothing changes for your members until you adjust these settings.
Note: Haiku models are always available to every member and can’t be disabled. This guarantees members always have at least one model to fall back to.
Who each level affects
Disabling a model at the organization level affects every member, including Primary Owners, Owners, Admins, and Users.
Role-level model access and effort limits affect only members whose role is set to “Custom.” Members with the User, Admin, or Owner roles can use every model enabled at the organization level, at any effort level.
Enable or disable a model for your organization
Navigate to Organization settings > Models.
Under Model access, find the model you want to change.
To enable a model, switch the toggle next to it on, then click the role dropdown to select the roles that can access it.
To disable a model, click the role dropdown and deselect the roles before switching the toggle off.
Click “Save”
If any custom role uses the model you’re disabling as its default, you’ll be prompted to change that role’s default before the change can be saved.
Set model access for a custom role
Navigate to Organization settings > Roles.
Click the role you want to edit, or click “Add role” to create one.
Select the "Models" tab.
Under Model access, switch each model on or off. Models disabled at the organization level appear but can’t be enabled until you turn them on for the organization.
Click “Save.”
Only models the role grants access to can be selected as that role’s default model.
Limit the maximum effort level for a custom role
Effort limits determine how much computation members on a role can apply per response on each model. Higher effort levels produce more thorough responses but consume more usage. Effort limits can only be set per role, not at the organization level.
Navigate to Organization settings > Roles.
Click the role you want to edit.
Select the "Models" tab.
Next to a model, click the gear icon and choose a level.
Click “Save” to save your changes.
Members on the role see only effort levels at or below the cap in their model menu. Note that available effort levels differ depending on the model, and some models don’t support effort level settings at all. For an explanation of each level, see Change the model, effort, and thinking settings.
How access combines across multiple roles
If a member belongs to multiple groups with different custom roles, model settings combine like other role permissions:
Model access is additive. The member can use every model granted by any of their roles, as long as it’s enabled at the organization level.
Effort limits take the highest cap. For each model, the member gets the highest maximum effort level any of their roles allows.
For how default models are chosen across multiple roles, see Set a default model for your organization.
For details on creating roles and assigning them to groups, see Manage custom roles on Enterprise plans.
What users see
In every covered product, the model picker shows only the models the member has access to. Effort levels above a role’s cap don’t appear in the effort menu.
If you disable a model a member is using in an open conversation or session, that conversation falls back to the member’s default model the next time they open it. If the member sends a message while you’re making the change, they’ll see an error that the model isn’t available and be prompted to switch.
Where model access settings apply
Model access settings are enforced across these products:
Product | Model access settings apply |
Chat (web, desktop, mobile) | ✅ |
Claude Cowork | ✅ |
Claude Code (CLI, remote, desktop) | ✅ CLI version 2.1.196 or later |
Office Agents | ✅ |
Claude in Chrome | Not yet supported |
Claude Design | Not yet supported |
Claude Security | Not yet supported |
Note: Members on Claude Code CLI versions earlier than 2.1.196 still see disabled models and effort levels in the picker, but requests using them are rejected.
Model access and Claude Code managed settings
If your organization also configures Claude Code through managed-settings.json, the availableModels setting and model access work together. In Claude Code CLI and IDE, members see only models that appear in availableModels and are enabled by their model access settings—a model removed by either one is unavailable.
Managed settings apply only to Claude Code CLI and IDE, not to Claude Code on web or desktop. For consistent behavior across all Claude Code surfaces, we recommend using model access settings alone. For more on managed settings, see Claude Code settings.