[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Control access to Model Garden models\n\nModel Garden's organization policy lets you centrally control the\nmodels your users can access and the actions they can take. By default, anyone\nwith permissions to use Vertex AI can use Model Garden to\ndiscover, customize, and deploy a wide variety of Google and third-party models.\n\nSetting a Model Garden policy might be useful, for example, if you have\na set of approved Google and third-party models that can be used in production\nenvironments. You can define a policy at the organization, folder, or project\nlevel so that your users can only access the approved models. A policy\napplies to all principals. An organization policy is not a per-user policy. For\nmore information, see [Introduction to the Organization Policy Service](/resource-manager/docs/organization-policy/overview).\n\nPolicy evaluations\n------------------\n\nAt evaluation time, all policies that contribute to a particular resource are\nreviewed, and only the applicable policies are merged and then evaluated. Any\nexplicit deny value takes precedence over any explicit allow value.\n\nFor example, imagine you have a folder policy that denies a specific model and a\nproject policy that allows that same model. Assuming that the policies are\nmerged, access to the model is denied at the project level because the explicit\ndeny policy at the folder level takes precedence. However, if you set the project\npolicy to override all parent policies, then access to the model is allowed at the\nproject level.\n\nFor more information, see [Understanding hierarchy evaluation](/resource-manager/docs/organization-policy/understanding-hierarchy) in the\nResource Manager documentation.\n\nConsiderations\n--------------\n\n- The Model Garden organization policy only applies to models in Model Garden. For example, this policy doesn't apply to models that are registered in Vertex AI Model Registry.\n- An organization policy can't exceed 500 allowed and denied values.\n- For a custom policy, you must specify each model individually. You cannot allow or deny a group of models. For example, you can't deny all third-party models or allow the predict action for only Google models.\n\nPolicy details\n--------------\n\nWhen you set a policy, you define one of the following actions:\n\n- Allow all models.\n- Deny all models.\n- Set a custom policy rule to allow or deny a specific list of models.\n\nBy default, if no policy is set or inherited, all models and actions are\nallowed.\n\nFor a *custom deny policy* , you explicitly deny a list of models\nand implicitly allow all other models. Similarly, for a *custom allow policy*,\nyou explicitly allow a list of models and implicitly deny all other models.\n\nTo specify models in a custom policy and a [model action](#actions), use the\nfollowing format: \n\n```\npublishers/PUBLISHER/models/MODEL_NAME:ACTION\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePUBLISHER\u003c/var\u003e: the name of the publisher who owns the model that your policy applies to.\n- \u003cvar translate=\"no\"\u003eMODEL_NAME\u003c/var\u003e: the name of the model to allow or deny.\n- \u003cvar translate=\"no\"\u003eACTION\u003c/var\u003e: a [model action](#actions) to include with your policy.\n\nFor example, to define a policy rule on predictions against the\nGemini 2.0 Flash model, specify\n`publishers/google/models/gemini-2.0-flash-001:predict`.\n\nThe fully qualified ID\n(`publishers/`\u003cvar translate=\"no\"\u003ePUBLISHER\u003c/var\u003e`/models/`\u003cvar translate=\"no\"\u003eMODEL_NAME\u003c/var\u003e) is\nalso known as the *model ID* . To find the model ID for a model, go to its model\ncard in Model Garden. For links to model cards, see the list of models\nin [Explore AI models in Model Garden](/vertex-ai/generative-ai/docs/model-garden/explore-models).\n\n### Model actions\n\nFor each model, you can allow or deny the following actions:\n\n- `predict`: Specifies whether users can make online and batch predictions against a model with a managed API (model as a service).\n- `deploy`: For models without a managed API, specifies whether users can deploy models on Google Cloud. For example, this action applies to one-click deployments in the Google Cloud console.\n- `tune`: Specifies whether users can tune models.\n\n### Set a policy\n\nYou can set a policy for Model Garden by using the Google Cloud console or\nthe Google Cloud CLI. The name of the constraint is\n`vertexai.allowedModels`. For more information about setting policies, see the\nthe following topics in the Resource Manager documentation:\n\n- For Google Cloud console instructions, see [Creating and managing\n organization policies](/resource-manager/docs/organization-policy/creating-managing-policies).\n- For gcloud CLI instructions, see [Using constraints](/resource-manager/docs/organization-policy/using-constraints).\n\nExample policies\n----------------\n\nThe following example policies are in the YAML format, which you use when\nsetting a policy through the gcloud CLI.\n\n### Deny a set of models and allow all other models\n\nThe following example denies actions on a specific set of models. \n\n```yaml\nname: organizations/\u003cvar class=\"edit\" translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e/policies/vertexai.allowedModels\nspec:\n rules:\n values:\n deniedValues:\n - publishers/meta/models/llama3:deploy\n - publishers/google/models/gemini-2.0-flash-001:tune\n - publishers/hf-google/models/gemma-2b:deploy\n```\n\nReplace \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e with the ID of your Google Cloud\norganization. For more information, see [Getting an organization\nresource](/resource-manager/docs/creating-managing-organization#acquiring).\n\n### Allow a set of models and deny all other models\n\nThe following example allows actions on a specific set of models. \n\n```yaml\nname: organizations/\u003cvar class=\"edit\" translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e/policies/vertexai.allowedModels\nspec:\n rules:\n values:\n allowedValues:\n - publishers/meta/models/llama3:deploy\n - publishers/google/models/gemini-2.0-flash-001:tune\n - publishers/hf-google/models/gemma-2b:deploy\n```\n\nWhat's next\n-----------\n\nLearn about [Model Garden and its offerings](/vertex-ai/generative-ai/docs/model-garden/explore-models)."]]
