Disallow List
Block specific models or providers at the gateway — org-level deny list with cache-backed enforcement.
Disallow List
Block specific models or providers per organization. Useful for compliance, cost control, or vendor lock-in prevention.
Tier: Available on all tiers.
Feature flag: DISALLOW_LIST_ENABLED — defaults to OFF. Enable per-environment after validation.
How It Works
The gateway checks a per-org disallow list before forwarding each request. If the requested model matches an entry, the request is blocked with 403.
Wildcard Matching
| Provider | Model | Effect |
|---|---|---|
openai | gpt-4o | Blocks gpt-4o from OpenAI only |
openai | * | Blocks all OpenAI models |
* | gpt-4o | Blocks gpt-4o from any provider |
* | * | Blocks all models (emergency stop) |
Configuration
Entries are managed via the CoreValue dashboard or API. The gateway caches the disallow list with a 30-second TTL.
Scope
Applies to both BYOK and PTB requests. Every request is checked regardless of key type.
Fail-Open Behavior
On infrastructure failure (Redis/Postgres down), the gateway allows the request. The disallow list never blocks traffic due to infrastructure failure.
Enabling the Disallow List
- Set
DISALLOW_LIST_ENABLED=truein your gateway environment - Add entries via the CoreValue dashboard (provider + model, with wildcard support)
- Verify blocked requests return 403
Related: Budget Gates block based on spend, not model. Fallback Chains provide alternatives when a model fails.