Skip to content
ATLAS
 Docs
On this page

Manage space policies#

Restrict which models a space can use, and cap how long API keys can live.

Before you begin#

  • To restrict models, you need the Owner or Admin role, or you manage a higher-level space than the one you restrict. A space manager can see the list for their own space but can't edit it.
  • To cap API key lifetime, you need the Owner or Admin role, because they manage the organisation's root space.
  • Roles and permissions lists what each role can do.

Restrict models for a space#

  1. In the sidebar, open Spaces and select the space.
  2. Open the Models tab.
  3. Switch on the toggle for each model you want to block. The change saves immediately. Turn the toggle off to unblock the model.
  4. Optional: turn on Hide restricted to show only the available models.

Result: the models are blocked for that space and all spaces beneath it. The gateway treats a blocked model as if it didn't exist ("model not found") and leaves it out of model listings.

  • Restrictions only add up. You can't unblock a model that a space above has blocked. Inherited rows have a disabled toggle and the note "Inherited from" followed by the blocking space.
  • Saving replaces the whole list, so reload before editing if another manager may have changed it.
  • Space restrictions don't affect API keys that act under a project.
  • If you can't edit, the toggles are disabled and a note says a manager of a higher-level space manages model access.

Cap API key lifetime#

Set the maximum number of days that new API keys in your organisation can live. You set the cap once, on the root space.

  1. In the sidebar, open Spaces and select the root space, which is named after your organisation.
  2. Open the Policies tab.
  3. In the API Key Expiration card, choose No limit, 7, 30, 90, 180 or 365 days. Or choose Custom… and enter a whole number of days, for example 45.
  4. Select Save. Reset discards unsaved edits.

Result: a "Policies updated" message appears. New keys must expire within the cap and can't be set to never expire.

  • The cap applies only to keys created afterwards. Existing keys are unchanged.
  • Other spaces show the inherited value read-only, with the note "This policy can only be managed at the organization root level."