Allowed Models
Amp Enterprise workspace admins can choose which models the members of their workspace can use. Open the workspace settings page, go to “Model Routing”, and then open “Allowed Models”.
Model Groups
Some switches on the “Default Policy” tab turn off a whole group of models, including models a built-in mode uses and models Amp adds to the group later:
- Open-Weights Models turns off every model with published weights, such as GLM, Kimi, DeepSeek, Qwen, and Inkling. Low mode then runs on GPT-5.6 Terra.
- Chinese Labs, inside the Open-Weights Models section, turns off only the models trained by Z.ai, DeepSeek, Moonshot AI, Alibaba, and MiniMax. It is off whenever Open-Weights Models is off.
- SpaceXAI and Meta, on their sections, turn off every Grok or Muse model.
- Claude Fable, inside the Anthropic section, turns off every Claude Fable model. Anthropic retains the prompts and outputs sent to Claude Fable for 30 days, so leaving it on accepts that retention for your workspace.
The group switches save with the rest of the page when you press Save. Directory group grants cannot give back a model whose group is off.
Default Policy
Every model starts enabled. On the “Default Policy” tab, turn off the models you do not want members to use and press Save.
Members cannot pick a disabled model in the mode picker, in Tune Modes, or in the CLI, and Amp refuses to run a thread on it. A thread that was already using a model when you disabled it stops at its next message, and the CLI shows “Model Not Available” with a link to the list of models.
Locked Models
Some models cannot be disabled because a built-in mode currently uses them. Amp locks every model
that low, medium, high, ultra, or Puck routes to in your workspace, so a change
on this page can never break a mode. The page lists these models with the modes that use them.
To disable a locked model, open Mode Dial in workspace settings and pin a different model for every mode that uses it. Then return to Allowed Models. See Tune the Modes.
The reverse also holds: you cannot pin a disabled model, or a model in a group that is off, in Mode Tuning. The model picker shows such models greyed out and marked “Disabled”. If a pin was saved before its model was disabled, the pin does not apply: the mode runs on Auto, and Amp refuses to run the disabled model.
Group Access
If your workspace has directory sync enabled (via WorkOS SCIM), the “Group Access” tab lists the groups from your identity provider. You can give the members of a group models that are disabled for everyone else. Press Choose Models on a group, select the models, and save.
Grants only add access. A member of several groups gets every model that any of their groups grants. When you enable a model for everyone, its grants are removed. When a group is deleted in your identity provider, its grant is listed under “Groups No Longer in Your Directory”, and you can remove it there.
Group Access uses the same directory groups as Directory Group Entitlements.
Plugin Decision Calls
The Jev switch under TypeSafe controls plugin calls to amp.ai.decide(...) and its
single-question helpers, including calls that use Jev by default. To restrict Jev to a directory
group, turn it off on Default Policy, then grant it to that group on Group Access and save.
This does not affect Amp’s built-in use of Jev, such as ordering files in a diff. Jev cannot run an agent and does not appear in Mode Dial. Plugin decision calls denied by the policy fail rather than switch to OpenAI. See Decision Models.
Personal Pins
A member can still pin models for their own modes in Mode Dial. A personal pin to a disabled model is ignored, and the role uses the workspace pin or Amp’s default model instead. The pin is kept, so it works again if you enable the model later.