Repository navigation
v2: experimental.policies not enforced for model selection or LLM execution #34971
Description
Description
Summary:
experimental.policies statements are parsed and loaded into the v2 Policy service but are not enforced by the Provider.Service that powers model listing, model selection, and session execution.
Expected behavior:
Denied providers should be excluded from model listing and rejected at execution time, as documented:
A provider denied by policy is not available for model selection or model use, even if it has credentials or is otherwise configured correctly.
Root cause:
The v2 Catalog (packages/core/src/catalog.ts) correctly evaluates policies in its finalize step, but nothing in the active code path uses it. The v2 Catalog is only consumed by debug v2 today.
Workaround:
Use the older enabled_providers field:
{
"enabled_providers": ["anthropic"]
}Plugins
N/A
OpenCode version
1.17.13
Steps to reproduce
- Configure policies in opencode.json:
{ "experimental": { "policies": [ { "effect": "deny", "action": "provider.use", "resource": "*" }, { "effect": "allow", "action": "provider.use", "resource": "anthropic" } ] } } - Run opencode models — all providers with credentials still appear, not just anthropic.
- Select a denied provider's model and send a prompt — it executes successfully.
Screenshot and/or share link
TUI
Desktop app:
Operating System
macOS 26.5.1
Terminal
iTerm2
Activity
experimental.policies.effect : denynot making it dissapear from the UI during model selection #35104 as a duplicate of this issue[-]`experimental.policies` not enforced for model selection or LLM execution[/-][+]v2: `experimental.policies` not enforced for model selection or LLM execution[/+]github-actions commentedon Sep 3, 2026
To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.
lucashervier commentedon Oct 7, 2026
Still reproducible on OpenCode 1.18.35.
I have a project config with a custom provider and a deny-all/allow-one provider policy:
{ "model": "custom/gpt-5.6-terra", "provider": { "custom": { "npm": "@ai-sdk/openai", "name": "Custom Gateway", "options": { "baseURL": "http://localhost:xxxx/openai/v1" } } }, "experimental": { "policies": [ { "effect": "deny", "action": "provider.use", "resource": "*" }, { "effect": "allow", "action": "provider.use", "resource": "custom" } ] } }opencode debug configconfirms that the policy is loaded.However, this still succeeds:
Relevant log lines:
providerID=opencode
modelID=muse-spark-1.3-contributor-free
llm.provider=opencode
llm.model=muse-spark-1.3-contributor-free
And the model successfully replies:
POLICY_BYPASS_TEST
So provider.use is still not being enforced for execution in 1.18.35.
As a workaround, adding:
does correctly prevent the opencode provider from being resolved/used. The same CLI command then fails with ProviderModelNotFoundError.
Environment: