Skip to main content

Create a project and grant models

Enterprise Tier

A project is the logical boundary that owns a team's or an application's configuration and access: its models, keys, Model Context Protocol (MCP) servers, policy, and members. Creating a project is the first step in giving a team an isolated environment. On its own a project is configuration only, so this guide covers the logical setup, and provisioning the gateway that makes it callable follows in the next guide.

Access in Agent Router is scoped to a project. A model must be granted to a project explicitly before the project can use it, and granting the provider alone is not enough. This guide creates the project and grants it a provider and a model; the members who will use it are added in Manage project members and access, and the endpoint is created in Provision a gateway for a project.

Persona: Platform operator working in the Admin Dashboard.

Estimated time: 10--15 minutes per project.

Outcomes​

By the end of this guide:

  • A project exists as an isolated configuration and access boundary.
  • At least one provider is granted to the project.
  • At least one model is granted to the project, so its members can route to that model once a gateway is bound.

Prerequisites​

  • Administrator access to the Admin Dashboard.
  • The provider and model already enabled in the organisation's catalog. Adding provider credentials and enabling models is covered in Provision models and providers.

Step 1: Create the project​

  1. In the Admin Dashboard, open Projects and select Create Project.
  2. Give the project a name that identifies the team, application, or environment it represents, for example bedrock-team.

A new project starts empty. It carries no model access, no members, and no endpoint until each is added deliberately, which is what makes it a clean isolation boundary.

Step 2: Grant a provider to the project​

  1. Open the project's Providers view.
  2. Allow the provider the project should use, for example AWS Bedrock or Azure OpenAI.
  3. Remove any providers the project should not use, so its surface is limited to what it needs.

Granting a provider makes that provider available to the project, but does not by itself grant any specific model. Model access is granted separately in the next step.

Step 3: Grant a model to the project​

  1. Open the project's Models view.
  2. Add the specific model the project may call, for example claude-haiku-4-5 on AWS Bedrock or gpt-5-mini on Azure OpenAI.

A model must be granted to the project explicitly. Allowing the provider alone does not make its models callable, and a model that has not been granted cannot be reached through the project's gateway, so it is refused at request time. This explicit grant is the mechanism behind per-project model isolation.

What to do next​

A project with granted models is still configuration with nowhere to send traffic. It becomes usable only once a gateway is provisioned on a data plane and bound to it.

Where to go next

Provision a gateway for a project

Give the project a live inference URL by binding a gateway on a data plane.

Manage project members and access

Add the users who will use the project, and assign their roles.