---
title: Control model access
display: 'Control *model* access'
nav_title: Control model access
summary:
  - "Every plan runs every model; on Enterprise, a model shows only if the organization list and the project list both allow it."
  - "Build an approved list in Organization > Models, and narrow it per project."
  - "Run supported providers on your own API keys, under External Keys."
description: Choose which models the organization and each project can use, and find why a member cannot see one.
section: teams
order: 3
type: tutorial
level: Scale
roles: [admin]
time: { read: 2 }
models_checked: []
last_verified: 2026-11-11
# a lesson that points to its articles: their PDFs, not one of this page
pdf: false
video_caption: Control model access
film_first: true
about: "Why a model can be missing, and how admins choose the models: the organization's list and its switches and filters, a project that can only narrow it, the Model Hub for new models, and your own provider keys under External Keys. The models and settings in this lesson are as of November 2026."
chapters:
  - { at: 0, title: "In this lesson", image: "/media/images/teams/model-access/ch-01-in-this-lesson.webp" }
  - { at: 25.9, title: "Enable and disable models", image: "/media/images/teams/model-access/ch-02-enable-and-disable-models.webp" }
  - { at: 68.2, title: "Per project", image: "/media/images/teams/model-access/ch-03-per-project.webp" }
  - { at: 94.5, title: "Your own keys", image: "/media/images/teams/model-access/ch-04-your-own-keys.webp" }
articles: [model-access]
related: []
thumb: teams/model-access/thumb.webp
video: tutorials/model-access.mp4
steps:
  - title: "Check the picker's filters first"
    text: "In the Model panel, click the filter icon next to Search by keyword: Input type on Any input, the budget and speed filters clear. The tabs under the search (ALL, image, video, audio, 3D) filter by output too."
  - title: "Open the organization's model list"
    text: "Pill › the gear next to the organization › Models. It holds Project overrides, two switches, and the list with Disable All Models, Enable All Models, Search, filters and an Active switch per model."
  - title: "Decide what happens to new models"
    text: "Automatically enable new models makes a new model ready at launch; turn it off if every model must be reviewed. Display disabled models (admins only) keeps disabled models visible to admins."
  - title: "Filter the list to fit your policy"
    text: "Filter by Privacy, Category, Capabilities, Providers, Sub Processors, Maintainers, Data Processing, Enterprise Status or Tags. Most security reviews start from Enterprise Status › Ready."
  - title: "Build an approved list"
    text: "Click Disable All Models, then switch on only the models you allow in the Active column. With a filter on, the list shows only the matching models; clear it with its x."
  - title: "Narrow the list for one project"
    text: "Project › Models can turn off more models, never turn on one the organization blocked; each shows Inherited until changed. A good pattern: a wider organization list, approved models only in production, and a sandbox for new ones."
  - title: "Add your own provider keys"
    text: "Organization › External Keys, pick a provider (OpenAI, Anthropic, GCP, xAI, Bytedance, Tencent, Tripo AI or ElevenLabs), Add Credentials, paste the key in API Key and click Save credentials. Make sure it has generation permissions."
  - title: "Know who bills what"
    text: "Your provider bills each generation on your key; Scenario still charges the fees on the Minimum Post-Processing Fees card. Your keys don't cover training, workflows, storage or Scenario's own models."
  - title: "Give a project its own key"
    text: "Project › External Keys (or Go to Project View from the organization page) takes a key that wins over the organization's. Until you add one, the provider shows Inherited."
updated: 2026-11-11
canonical: https://learn.scenario.com/teams/model-access
---

Last updated: 2026-11-11

# Control model access

> Choose which models the organization and each project can use, and find why a member cannot see one.

In short:

- Every plan runs every model; on Enterprise, a model shows only if the organization list and the project list both allow it.
- Build an approved list in Organization > Models, and narrow it per project.
- Run supported providers on your own API keys, under External Keys.


"I can't see this model" is the question every admin hears. This lesson explains why it happens, then sets up the Starforge Games model list for the whole organization, narrows it for one project, and connects your own provider keys under **External Keys**.

:::note As of November 2026
The models, settings and screens in this article are the ones Scenario offered in November 2026. New models and updates arrive often, so check the app for newer options before you choose.
:::

:::steps Quick version
1. When someone can't see a model, check the picker's filters first, then the organization and the project.
2. In **Settings** › **Organization** › **Models**, decide whether new models are enabled automatically.
3. Filter the list (for example **Enterprise Status** › **Ready**), use **Disable All Models**, then switch on only the models you allow.
4. Narrow it further per project under **Project** › **Models**; a project can never turn on what the organization turned off.
5. To run a provider on your own account, add your key under **Organization** › **External Keys**, or per project.
:::

## Before you start

- **You need to be an organization Admin** to change the model list and external keys.
- **Model access and external keys are Enterprise features.** On other plans there is no list to manage: every plan, Free included, runs every model on Scenario.
- **The list applies everywhere your team works:** the web app, workflows, the API and the Scenario MCP. A model switched off here is off in all of them.
- **A model has to pass two checks** before someone can use it:

| Check | Where it's set | Who changes it |
|---|---|---|
| The organization allows it | **Organization** › **Models** | Admins |
| The project hasn't turned it off | **Project** › **Models** | Admins |

## Step 1: Check the picker's filters first

Before you change any setting, check the filters in the model picker. A forgotten filter hides a lot of models. In the **Model** panel, click the filter icon next to **Search by keyword**: **Input type** should be **Any input**, and the budget and speed filters below it should be clear. The tabs under the search (**ALL**, image, video, audio, 3D and others) filter by output too.

![The model picker's filter menu open on Input type, with Any input ticked](https://ufgc0c9mhl4ueq76.public.blob.vercel-storage.com/academy/dd3d8392676e82070bf807950af9c361798760c3574f230f60bd01a85204c392.webp)

## Step 2: Open the organization's model list

On Enterprise, admins choose the models in organization settings: open the pill, click the gear next to the organization, then **Models**. The page has three parts:

- **Project overrides**, at the top, lists the projects that narrow this list.
- **Two switches** that set how the list behaves (next step).
- **The model list**, with **Disable All Models**, **Enable All Models**, a **Search** box and filters, and a switch for each model in the **Active** column.

![Organization › Models: Project overrides, the two switches and the model list with its Active switches](https://ufgc0c9mhl4ueq76.public.blob.vercel-storage.com/academy/4b088918f8a95ef8f56dc7b4b84d47805be37b1be7554c81fe82fc0876472908.webp)

## Step 3: Decide what happens to new models

- **Automatically enable new models** decides what happens when a new model launches. On, it's ready for your team right away. Off, it waits for an admin to approve it.
- **Display disabled models (admins only)** keeps disabled models visible to admins, so you can review and manage them. Members never see them.

Turn the first one off if your legal or security team must review every model before use.

## Step 4: Filter the list to fit your policy

Filter the list by **Privacy**, **Category**, **Capabilities**, **Providers**, **Sub Processors**, **Maintainers**, **Data Processing**, **Enterprise Status** or **Tags**. Click the arrow at the end of the filter bar to see the last ones.

**Enterprise Status** is the one most security reviews start from:

| Status | What it means |
|---|---|
| **Ready** | Meets every enterprise security and contract requirement: your inputs and outputs aren't used for training, minimal or zero data retention, data stored on Scenario's own infrastructure |
| **Available** | Not fully compliant yet, but can be moved to Ready |
| **Pending** | Talks with the provider are under way |
| **Unknown** | The provider hasn't confirmed its status yet |

Custom models your team trains in Scenario count as Enterprise Ready.

![The Enterprise Status filter open on Ready, Available, Pending and Unknown, with the number of models in each](https://ufgc0c9mhl4ueq76.public.blob.vercel-storage.com/academy/8aeadd383ed79a7eb6bf21169b8fef9cfbe42dec79248dce573949343c6a02a6.webp)

## Step 5: Build an approved list

To build an approved list, click **Disable All Models**, then switch on only the ones you allow, one by one in the **Active** column. With a filter on, such as **Enterprise Status (1)**, the list shows only the matching models, so you can enable them quickly. Clear the filter with its **x**.

![The model list filtered by Enterprise Status, with Disable All Models and Enable All Models above it](https://ufgc0c9mhl4ueq76.public.blob.vercel-storage.com/academy/f1cae0395f3b49510906d28080da4ff144f8659d435507a2ac24b3980cfc897f.webp)

## Step 6: Narrow the list for one project

Each project can narrow that list for its own work under **Project** › **Models**. Its **Model access** card explains the rule: you can disable additional models for this project, but models blocked by your organization stay unavailable. Each model shows **Inherited** next to its switch until the project changes it. **Organization Settings** takes you back to the organization's list.

A good pattern:

- **The organization:** a wider list.
- **Production projects:** only approved models.
- **A sandbox project:** for testing new ones.

When new models wait for approval, check the **Model Hub** for what's new, test them in your sandbox, then enable the ones that work.

![Project › Models for Tour Demo: the Model access card, Disable All Models, Enable All Models and every model Inherited](https://ufgc0c9mhl4ueq76.public.blob.vercel-storage.com/academy/b4bee87d84a33852a4304b3e8b0773f12841a8598f0924a00bbdada01dbfd311.webp)

## Step 7: Add your own provider keys

On Enterprise, you can run supported providers on your own API keys, under **Organization** › **External Keys**. Generations then use your keys instead of Scenario's, billed to your provider account.

1. **Pick a provider** in the list on the left: **OpenAI**, **Anthropic**, **GCP (Google...)**, **xAI**, **Bytedance**, **Tencent**, **Tripo AI** or **ElevenLabs**.
2. **Click Add Credentials.**
3. **Paste your key** in **API Key** and click **Save credentials**. It's encrypted, and never shown again; you can replace or remove it at any time.

![Organization › External Keys with the provider list, OpenAI selected and its Add Credentials button](https://ufgc0c9mhl4ueq76.public.blob.vercel-storage.com/academy/bfaf1f5803b47fce17a11b1709304466140fd36c1ecc244f9f5884a35623d3c8.webp)

![The Add OpenAI Credentials dialog with the API Key field, Cancel and Save credentials](https://ufgc0c9mhl4ueq76.public.blob.vercel-storage.com/academy/266e6d0b161f3ff72ccbb337b6b22028217bee636fbb2a47690db979a9d34c8a.webp)

Make sure the key has generation permissions at your provider. If your provider account is rate-limited or suspended, generations on that provider fail.

## Step 8: Know who bills what

Your provider bills you for each generation. Scenario still charges a fee for previews, rendering and indexing: the **Minimum Post-Processing Fees** card lists it per output type (image, video, audio, 3D, text), and **Pricing** shows that a markup is applied to every generation.

Your own keys don't cover Scenario's own services (training, workflows, storage) or Scenario's own models, which have no outside provider.

![The OpenAI panel with Pricing and Actions, and the cards on encrypted credentials and Minimum Post-Processing Fees](https://ufgc0c9mhl4ueq76.public.blob.vercel-storage.com/academy/3ae504c160e5aee7bf83acaac69de3623c545705c55380a74f3165b875938320.webp)

## Step 9: Give a project its own key

A project can also use its own key, under **Project** › **External Keys** (or **Go to Project View** from the organization page). The project's key takes priority over the organization's. Until you add one, the provider shows **Inherited** with the organization's setting.

Use this when one client or product must be billed to a separate provider account.

![Project › External Keys for Tour Demo: OpenAI Inherited from the organization, with Add Credentials for this project](https://ufgc0c9mhl4ueq76.public.blob.vercel-storage.com/academy/35a407409f9cfbfd5c3f266635da890bd4c6b2c27e89b8c39f91578e9936b0e0.webp)

## Supported providers

| Provider | Models it covers |
|---|---|
| **OpenAI** | GPT Image and other OpenAI image models |
| **Anthropic** | Claude models in the LLM and workflow nodes |
| **GCP (Google Vertex AI)** | The Gemini family |
| **xAI** | Grok generation and editing models |
| **Bytedance** | Seedream, Seedance, Dreamina, OmniHuman, Seed Audio |
| **Tencent** | Hunyuan image and video models |
| **Tripo AI** | 3D generation |
| **ElevenLabs** | Music, sound effects and voice |

The model list and external keys work independently: you can use one without the other. Tell your team which models run on your keys, so they know where those charges appear.

## Common problems

| What you see | What to do |
|---|---|
| A member can't see a model | Clear the picker's filters; then check **Organization** › **Models** and the project's **Models** |
| A project can't switch a model on | The organization has it off; enable it at the organization level first |
| A new model appeared before review | Turn off **Automatically enable new models** |
| You can't find a disabled model to review it | Turn on **Display disabled models (admins only)** |
| Generations fail on one provider | Check the key's permissions and your account's limits at the provider |
| One project bills to the wrong account | Add its own key under **Project** › **External Keys**; it takes priority |

## What's next

Your team now sees only the models you approved. Next, [Spend and usage](https://learn.scenario.com/teams/spend-and-usage.md) keeps spend under control with alerts and limits, and shows where it goes.

Source: https://learn.scenario.com/teams/model-access