Every agent is bound to an approved provider and carries a list of approved models. A call to another model is flagged, or blocked if you turn blocking on for that agent. Use cases, Obichat workspaces, and access keys narrow that scope further.
Each agent is bound to an approved provider and has a list of approved models. A call to another model is flagged and let through by default, or blocked if you turn blocking on for the agent. Either way the attempt is recorded on the request trace. This applies to calls made through the agent endpoint.
Each use case carries the model IDs allowed for it, per provider, so the approved model set is documented where the use case is registered.
Each Obichat workspace lists the allowed models for every provider attached to it, so teams chat only with the models their workspace permits.
Access keys can be scoped to specific agents, so a key issued for one agent cannot be used to reach another.
