Model governance (EXEC-001, owner decisions of 2026-10-07 and 2026-10-11): whether a
model runs, runs after the user's approval, or never runs.
Remarks
The user's own rules come first, in the allow/ask/deny convention: models.deny refuses a
model, models.ask asks for it on every turn whatever it costs, and models.allow runs it
without asking; deny wins over ask and ask over allow. An entry also covers the
model's effort variants (<id>-<effort>), and an entry naming a variant also applies when a
turn passes that effort separately (model plus reasoning_effort). Other models are asked for when no price list
is available; when their price is unknown or matched only approximately; when their output
price is at or above askAbovePrice (USD per million tokens, default 20, which also covers
an expensive default model); or when it is at least priceMultiplier (default 2) times the
price of their backend's default model. An approval with "remember" adds an unknown or
approximately priced model to models.allow. Consent itself is asked by the server through
MCP elicitation; a calling agent cannot grant it (AUD-P1-7).
A user's price limit is a separate question (checkPriceLimit in prices.ts, AX-002): no
prompt does not show that a model meets it, and models.allow or an approval cannot
satisfy it.
Model governance (
EXEC-001, owner decisions of 2026-10-07 and 2026-10-11): whether a model runs, runs after the user's approval, or never runs.Remarks
The user's own rules come first, in the allow/ask/deny convention:
models.denyrefuses a model,models.askasks for it on every turn whatever it costs, andmodels.allowruns it without asking;denywins overaskandaskoverallow. An entry also covers the model's effort variants (<id>-<effort>), and an entry naming a variant also applies when a turn passes that effort separately (modelplusreasoning_effort). Other models are asked for when no price list is available; when their price is unknown or matched only approximately; when their output price is at or aboveaskAbovePrice(USD per million tokens, default 20, which also covers an expensive default model); or when it is at leastpriceMultiplier(default 2) times the price of their backend's default model. An approval with "remember" adds an unknown or approximately priced model tomodels.allow. Consent itself is asked by the server through MCP elicitation; a calling agent cannot grant it (AUD-P1-7).A user's price limit is a separate question (
checkPriceLimitin prices.ts,AX-002): no prompt does not show that a model meets it, andmodels.allowor an approval cannot satisfy it.