Skip to main content

Create a project and grant models

Enterprise Tier

Model access is a two-layer path: first enable providers and models in the organisation catalog (Provision models and providers), then grant those enabled models to a project in this guide. A project is the isolation boundary for a team's models, keys, Model Context Protocol (MCP) servers, policy, and members. On its own it is configuration only—provisioning the gateway that makes it callable follows in the next guide.

Granting a provider alone is not enough; each model must be granted explicitly. Members are added in Manage project members and access, and the endpoint is created in Provision a gateway for a project.

Persona: Platform operator working in the Admin Dashboard.

Estimated time: 10--15 minutes per project.

Outcomes​

By the end of this guide:

  • A project exists as an isolated configuration and access boundary.
  • At least one provider is granted to the project.
  • At least one model is granted to the project, so its members can route to that model once a gateway is bound.

Prerequisites​

  • Administrator access to the Admin Dashboard.
  • The provider and model already enabled in the organisation's catalog. Adding provider credentials and enabling models is covered in Provision models and providers.

Step 1: Create the project​

  1. In the Admin Dashboard, open Projects and select Create Project.
  2. Give the project a name that identifies the team, application, or environment it represents, for example bedrock-team.

A new project starts empty. It carries no model access, no members, and no endpoint until each is added deliberately, which is what makes it a clean isolation boundary.

Step 2: Grant a provider to the project​

  1. Open the project's Providers view.
  2. Allow the provider the project should use, for example AWS Bedrock or Azure OpenAI.
  3. Remove any providers the project should not use, so its surface is limited to what it needs.

Granting a provider makes that provider available to the project, but does not by itself grant any specific model. Model access is granted separately in the next step.

Step 3: Grant a model to the project​

  1. Open the project's Models view.
  2. Add the specific model the project may call, for example claude-haiku-4-5 on AWS Bedrock or gpt-5-mini on Azure OpenAI.

A model must be granted to the project explicitly. Allowing the provider alone does not make its models callable, and a model that has not been granted cannot be reached through the project's gateway, so it is refused at request time. This explicit grant is the mechanism behind per-project model isolation.

What to do next​

A project with granted models is still configuration with nowhere to send traffic. It becomes usable only once a gateway is provisioned on a data plane and bound to it.

Where to go next

Provision a gateway for a project

Give the project a live inference URL by binding a gateway on a data plane.

Manage project members and access

Add the users who will use the project, and assign their roles.