What
The gateway now enforces a role's deniedModels list. Before, it only checked the availableModels allowlist.
- A request for a denied model is rejected with a message saying it is blocked by your role's
deniedModelsdenylist. - Denied models are removed from the list of models you can pick.
Why
Administrators can block specific models for a role, not only list the ones that are allowed.
Names in the bundledeniedModelsavailableModels
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up deniedModels, on Claude apps gateway configuration.
* **Deny-lists and hook arrays**: `permissions.deny`, `permissions.ask`, `disabledMcpjsonServers`, `deniedMcpServers`, `blockedMarketplaces`, `deniedModels`, and every `hooks` event-type array. These take the union of base and policy, so a…claude-apps-gateway-config see the edit
Confirmed since
Anthropic's documentation has since written up availableModels, on Hooks reference.
On a `completed` response, `resolvedModel` names the model the subagent started on, which can differ from the `model` value in `tool_input`, such as when `availableModels` or another override applies. On an `async_launched` response, `reso…hooks see the edit
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up availableModels, on Hooks reference.
Anthropic's release notes agree
Fixed the Claude apps gateway serving models that a policy's availableModelsMatch: exact or deniedModels blocks; it now answers 400 and…