Skip to main content
Version: v1.0.x

Manage a Client's Model Access

This guide explains how a platform administrator controls which models a client uses on a PaletteAI Inference Launchpad appliance. Model access depends on whether a model runs locally on the appliance or is reached through an external provider.

  • Local models. Every client with a valid API token can call every model served locally on the appliance. You do not grant access to local models. To choose which local model handles a client's requests, route the client with a tier map.
  • External models. A new client cannot reach external, or frontier, models until you enable egress for it. External access is denied by default and is granted per client.

To understand how clients and models relate, refer to Clients and Quotas.

Prerequisites​

  • A running PaletteAI Inference Launchpad appliance, with the console reachable.
  • An existing client. To create one, refer to Create a Client.
  • Console access with permission to manage clients. Managing clients can require operator access.
  • (External models only) A provider key for the external provider.

Route a Client to Specific Models​

Use a client's tier map to route the client's model aliases to the models you choose.

  1. From the left main menu, select Access & Policy.

  2. On the Clients & API tokens page, select the client to open its detail panel.

  3. Select the Routing section.

  4. In the Tier map, select Add alias rule, or edit an existing row.

  5. Set the Alias prefix, such as claude-opus-, and the Model it routes to.

  6. Save the client.

The tier map applies to the selected client. Requests from other clients follow their own tier maps, so they are not routed to that model unless you configure their tier maps as well.

Allow a Client to Reach External Models​

  1. From the left main menu, select Access & Policy.

  2. On the Clients & API tokens page, select the client to open its detail panel.

  3. Select the Egress section.

  4. Select Enable egress.

  5. Add a provider key for the external provider.

  6. Set a daily spend cap for the client. Egress is fail-closed on the cap, so a cap of 0 blocks egress.

  7. (Optional) List the provider models the client may reach. Leave the list empty to allow every model from that provider.

  8. Save the client.

Frontier-model bursting is configured separately and is out of scope for this guide.

Next Steps​