Limit access to OCI Generative AI models with IAM policies

You can now use the target.model.id condition in IAM policies to limit which Generative AI models a group can use. Policies can allow specific model IDs, allow IDs that match a pattern, or exclude specified model IDs and patterns.

For users working in the Console, grant the group whose model access you want to limit inspect generative-ai-model permission so its members can list and select models. Then grant that group use generative-ai-family permission with a target.model.id condition to limit which models its members can invoke. Permission to list models doesn't grant permission to invoke models outside the condition.

Although the policy examples use the aggregate generative-ai-family resource type, the target.model.id condition applies only to model inference through generative-ai-chat, generative-ai-text-embedding, and generative-ai-text-rerank. It doesn't restrict model-management operations for other resource types in the family.

For more information and example policies, see Limiting Access to Models with IAM Policies. For information about the service, see the Generative AI documentation.