fix(permission-groups): normalize defaults and recover policy reads

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/workflow.tsx

@@ -898,7 +898,8 @@ const WorkflowContent = React.memo(
      */
     const pendingFocusBlockIdRef = useRef<string | null>(null)
 
-    const { resolveSeedGate, agentDefaultModel, isAgentDefaultReady } = useOperationAccess()
+    const { resolveSeedGate, agentDefaultModel, isAgentDefaultReady, refetchModelSettings } =
+      useOperationAccess()
 
     const addBlock = useCallback(
       (
@@ -914,6 +915,7 @@ const WorkflowContent = React.memo(
         presetSubBlockValues?: Record<string, unknown>
       ) => {
         if (type === 'agent' && !isAgentDefaultReady) {
+          void refetchModelSettings({ cancelRefetch: false })
           toast({ message: 'Model settings are not ready. Try again.' })
           return
         }
@@ -988,6 +990,7 @@ const WorkflowContent = React.memo(
         resolveSeedGate,
         agentDefaultModel,
         isAgentDefaultReady,
+        refetchModelSettings,
       ]
     )
 

apps/sim/ee/access-control/components/agent-default.tsx

@@ -21,6 +21,12 @@ import type { ProviderId } from '@/providers/types'
 
 const PLATFORM_DEFAULT = '__platform-default__'
 
+function getDefaultModelId(provider: string, model: string): string {
+  return provider === 'ollama' && !model.toLowerCase().startsWith('ollama/')
+    ? `ollama/${model}`
+    : model
+}
+
 interface AgentDefaultProps {
   config: PermissionGroupConfig
   providerIds: ProviderId[]
@@ -40,8 +46,12 @@ export function AgentDefault({ config, providerIds, workspaceId, onChange }: Age
   const options = useMemo((): ComboboxOption[] => {
     const isAllowed = createModelAccessGate(config)
     const models = new Set([
-      ...providerIds.flatMap((provider) => getProviderModels(provider)),
-      ...dynamicModels,
+      ...providerIds.flatMap((provider) =>
+        getProviderModels(provider).map((model) => getDefaultModelId(provider, model))
+      ),
+      ...dynamicModels.flatMap(({ provider, models }) =>
+        models.map((model) => getDefaultModelId(provider, model))
+      ),
     ])
     const modelOptions: ComboboxOption[] = [
       { label: 'Platform default', value: PLATFORM_DEFAULT },

apps/sim/hooks/queries/providers.ts

@@ -23,6 +23,11 @@ interface UseProviderModelsOptions {
   enabled?: boolean
 }
 
+interface ProviderModelList {
+  provider: ProviderName
+  models: string[]
+}
+
 const logger = createLogger('ProviderModelsQuery')
 
 export const PROVIDER_MODELS_STALE_TIME = 5 * 60 * 1000
@@ -116,8 +121,8 @@ export function useProviderModels(
   })
 }
 
-function combineProviderModelLists(results: UseQueryResult<ProviderModelsResponse>[]) {
-  return results.flatMap((result) => result.data?.models ?? [])
+function combineProviderModelLists(results: UseQueryResult<ProviderModelList>[]) {
+  return results.flatMap((result) => (result.data ? [result.data] : []))
 }
 
 /** Fetches multiple provider catalogs with the shared workspace-scoped query cache. */
@@ -130,6 +135,10 @@ export function useProviderModelLists(
     queries: providers.map((provider) => ({
       ...providerModelsQueryOptions(provider, workspaceId),
       enabled: options?.enabled ?? true,
+      select: (data: ProviderModelsResponse): ProviderModelList => ({
+        provider,
+        models: data.models,
+      }),
     })),
     combine: combineProviderModelLists,
   })

apps/sim/hooks/use-operation-access.ts

@@ -1,6 +1,7 @@
 'use client'
 
-import { useMemo } from 'react'
+import { useCallback, useMemo } from 'react'
+import type { RefetchOptions } from '@tanstack/react-query'
 import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
 import { resolveAgentDefaultModel } from '@/lib/permission-groups/model-access'
 import {
@@ -20,6 +21,7 @@ import { PROVIDER_DEFINITIONS } from '@/providers/models'
 export interface OperationAccess {
   agentDefaultModel: string | null
   isAgentDefaultReady: boolean
+  refetchModelSettings: (options?: RefetchOptions) => Promise<void>
   /**
    * Whether the permission config is still loading. Every list this module
    * filters reads as unrestricted until it resolves, so a surface that
@@ -78,23 +80,42 @@ export interface OperationAccess {
  */
 export function useOperationAccess(): OperationAccess {
   const { hosted } = useDeploymentShape()
-  const { config, isToolAllowed, isModelUsable, isLoading, isPermissionFetching } =
-    usePermissionConfig()
+  const {
+    config,
+    isToolAllowed,
+    isModelUsable,
+    isLoading,
+    isPermissionFetching,
+    isPermissionReady,
+    refetchPermissionConfig,
+  } = usePermissionConfig()
   const blacklistedProviders = useBlacklistedProviders()
+  const refetchModelSettings = useCallback(
+    async (options?: RefetchOptions) => {
+      await Promise.all([refetchPermissionConfig(options), blacklistedProviders.refetch(options)])
+    },
+    [refetchPermissionConfig, blacklistedProviders.refetch]
+  )
 
   return useMemo(() => {
     const isReady = !isLoading
-    const isAgentDefaultReady = isReady && !isPermissionFetching && blacklistedProviders.isSuccess
+    const isAgentDefaultReady =
+      isReady &&
+      isPermissionReady &&
+      !isPermissionFetching &&
+      (!config.defaultAgentModel || blacklistedProviders.isSuccess)
     return {
       isAgentDefaultReady,
-      agentDefaultModel: isAgentDefaultReady
-        ? resolveAgentDefaultModel(config, {
-            allowAuto: hosted,
-            availableProviderIds: Object.keys(PROVIDER_DEFINITIONS).filter(
-              (provider) => !blacklistedProviders.data.blacklistedProviders.includes(provider)
-            ),
-          })
-        : null,
+      refetchModelSettings,
+      agentDefaultModel:
+        isAgentDefaultReady && blacklistedProviders.isSuccess
+          ? resolveAgentDefaultModel(config, {
+              allowAuto: hosted,
+              availableProviderIds: Object.keys(PROVIDER_DEFINITIONS).filter(
+                (provider) => !blacklistedProviders.data.blacklistedProviders.includes(provider)
+              ),
+            })
+          : null,
       isPermissionLoading: isLoading,
       getDeniedOperations: (block, operationIds) =>
         isReady
@@ -120,6 +141,8 @@ export function useOperationAccess(): OperationAccess {
     isModelUsable,
     isLoading,
     isPermissionFetching,
+    isPermissionReady,
+    refetchModelSettings,
     hosted,
     blacklistedProviders.isSuccess,
     blacklistedProviders.data,

apps/sim/hooks/use-permission-config.ts

@@ -29,6 +29,8 @@ export interface PermissionConfigResult {
   config: PermissionGroupConfig
   isLoading: boolean
   isPermissionFetching: boolean
+  isPermissionReady: boolean
+  refetchPermissionConfig: ReturnType<typeof useUserPermissionConfig>['refetch']
   isInPermissionGroup: boolean
   filterBlocks: <T extends { type: string }>(blocks: T[]) => T[]
   filterProviders: (providerIds: string[]) => string[]
@@ -63,6 +65,8 @@ export function usePermissionConfig(): PermissionConfigResult {
     data: permissionData,
     isLoading: isPermissionLoading,
     isFetching: isPermissionFetching,
+    isSuccess: isPermissionReady,
+    refetch: refetchPermissionConfig,
   } = useUserPermissionConfig(workspaceId)
   const {
     data: envAllowlistData,
@@ -231,6 +235,8 @@ export function usePermissionConfig(): PermissionConfigResult {
       config: mergedConfig,
       isLoading,
       isPermissionFetching,
+      isPermissionReady,
+      refetchPermissionConfig,
       isInPermissionGroup,
       filterBlocks,
       filterProviders,
@@ -252,6 +258,8 @@ export function usePermissionConfig(): PermissionConfigResult {
       mergedConfig,
       isLoading,
       isPermissionFetching,
+      isPermissionReady,
+      refetchPermissionConfig,
       isInPermissionGroup,
       filterBlocks,
       filterProviders,

apps/sim/lib/permission-groups/application/management.test.ts

@@ -91,30 +91,30 @@ beforeEach(() => {
   mocks.allConflict.mockResolvedValue(null)
 })
 describe('permission group current organization authority', () => {
-  it.each([{ BLACKLISTED_PROVIDERS: 'openai' }, { BLACKLISTED_MODELS: 'gpt-4*' }])(
-    'refuses a deployment-blocked Agent default: %j',
-    async (env) => {
-      queueTableRows(member, [{ role: 'admin' }])
-      dbChainMockFns.returning.mockResolvedValueOnce([
-        { ...group, config: { defaultAgentModel: 'gpt-4o' } },
-      ])
-      setEnv(env)
-      envFlagsMockFns.getBlacklistedProvidersFromEnv.mockReturnValue(
-        env.BLACKLISTED_PROVIDERS ? [env.BLACKLISTED_PROVIDERS] : []
-      )
-      try {
-        await expect(
-          updatePermissionGroup.execute({
-            principal,
-            input: { ...scope, changes: { config: { defaultAgentModel: 'gpt-4o' } } },
-          })
-        ).rejects.toMatchObject({ code: 'validation' })
-      } finally {
-        resetEnvMock()
-        envFlagsMockFns.getBlacklistedProvidersFromEnv.mockReset()
-      }
+  it.each([
+    { env: { BLACKLISTED_PROVIDERS: 'openai' }, defaultAgentModel: 'gpt-4o' },
+    { env: { BLACKLISTED_MODELS: 'gpt-4*' }, defaultAgentModel: 'gpt-4o' },
+    { env: { BLACKLISTED_MODELS: 'llama*' }, defaultAgentModel: 'ollama/llama3' },
+    { env: { BLACKLISTED_MODELS: 'ollama/llama*' }, defaultAgentModel: 'ollama/llama3' },
+  ])('refuses a deployment-blocked Agent default: %j', async ({ env, defaultAgentModel }) => {
+    queueTableRows(member, [{ role: 'admin' }])
+    dbChainMockFns.returning.mockResolvedValueOnce([{ ...group, config: { defaultAgentModel } }])
+    setEnv(env)
+    envFlagsMockFns.getBlacklistedProvidersFromEnv.mockReturnValue(
+      env.BLACKLISTED_PROVIDERS ? [env.BLACKLISTED_PROVIDERS] : []
+    )
+    try {
+      await expect(
+        updatePermissionGroup.execute({
+          principal,
+          input: { ...scope, changes: { config: { defaultAgentModel } } },
+        })
+      ).rejects.toMatchObject({ code: 'validation' })
+    } finally {
+      resetEnvMock()
+      envFlagsMockFns.getBlacklistedProvidersFromEnv.mockReset()
     }
-  )
+  })
   it.each(['gpt-5-chat-latest', 'unsupported-agent-model'])(
     'refuses an unavailable Agent default: %s',
     async (defaultAgentModel) => {

apps/sim/lib/permission-groups/model-access.server.ts

@@ -11,8 +11,9 @@ export function resolveAvailableAgentDefaultModel(
   const model = resolveAgentDefaultModel(config, { allowAuto: isHosted })
   if (!model) return null
   const provider = findProviderFromModel(model)
+  const modelIds = provider === 'ollama' ? [model, model.replace(/^ollama\//i, '')] : [model]
   return (!provider || !isProviderBlacklisted(provider)) &&
-    filterBlacklistedModels([model]).length > 0
+    filterBlacklistedModels(modelIds).length === modelIds.length
     ? model
     : null
 }

apps/sim/lib/permission-groups/model-access.test.ts

@@ -8,6 +8,18 @@ describe('createModelAccessGate', () => {
     expect(gate('claude-sonnet-4-5')).toBe(true)
   })
 
+  it.each(['llama3', 'ollama/llama3', 'OLLAMA/LLAMA3'])(
+    'denies a namespaced Ollama model when its denylist entry is %s',
+    (deniedModel) => {
+      const gate = createModelAccessGate({
+        deniedModels: [deniedModel],
+        allowedModelProviders: ['ollama'],
+      })
+      expect(gate('ollama/llama3')).toBe(false)
+      expect(gate('ollama/other-model')).toBe(true)
+    }
+  )
+
   it('denies a model whose provider is not allowlisted', () => {
     const gate = createModelAccessGate({ deniedModels: [], allowedModelProviders: ['anthropic'] })
     expect(gate('gpt-4o')).toBe(false)

apps/sim/lib/permission-groups/model-access.ts

@@ -32,7 +32,10 @@ export function createModelAccessGate(config: ModelGateConfig | null | undefined
 
   const denied = new Set(deniedModels?.map((model) => model.toLowerCase()))
   return (model: string) => {
-    if (denied.has(model.toLowerCase())) return false
+    const normalizedModel = model.toLowerCase()
+    if (denied.has(normalizedModel) || denied.has(normalizedModel.replace(/^ollama\//, ''))) {
+      return false
+    }
     if (allowedProviders === null) return true
     const providerId = findProviderFromModel(model)
     if (!providerId) return true