# Model access controls and bring your own LLM

*Agentforce Specialist Study Guide · Prompt Engineering · Last updated October 15, 2026 · https://www.certifyforce.com/study-guide/agentforce-specialist/prompt-engineering/model-access-controls-and-bring-your-own-llm*

How model use is governed: the model chosen per prompt template version, org-level provider blocking in Setup, hiding an LLM configuration in AI Models (formerly Einstein Studio), beta-model enablement, limiting who holds Manage Prompt Templates, Salesforce's AI policies, and connecting a contracted provider with bring your own LLM.

- Certification: Salesforce Agentforce Specialist
- Exam section: Prompt Engineering
- Study guide: https://www.certifyforce.com/study-guide/agentforce-specialist

**Official exam objective:**

> Explain how to manage and prevent specific models from being accessed.

## What the exam expects

- Pin a prompt template to an approved model by selecting it in the template, and explain why prompt text can't change routing.
- Prevent a model from being used anywhere in the org: turn off its provider in Setup or hide its LLM configuration in AI Models, and know what each does to existing templates.
- Govern who can choose models by limiting the Manage Prompt Templates permission, alongside Salesforce's AI Acceptable Use Policy and model containment policies.
- Connect a contracted provider account with bring your own LLM (BYOLLM) and use it from Prompt Builder while keeping the Trust Layer.
- Key terms: **Salesforce-managed model** (a model Salesforce provides out of the box, enabled by default); **AI Models** (formerly Einstein Studio: where model configurations are created, tested and shown or hidden); **LLM configuration** (a configured model that Prompt Builder can select); **BYOLLM** (connecting a foundation model through your own provider account); **model provider access** (the org setting that allows or blocks a provider's models).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Default model availability | Salesforce-managed models are enabled by default | [Large Language Model Support](https://help.salesforce.com/s/articleView?id=ai.generative_ai_large_language_model_support.htm&language=en_US&type=5) |
| Block a provider | Admin turns off a model provider in Setup; its models are blocked in the org | [Large Language Model Support](https://help.salesforce.com/s/articleView?id=ai.generative_ai_large_language_model_support.htm&language=en_US&type=5) |
| Provider flags | `disableAIProvOpenAI`, `disableAIProvAzureOpenAI`, `disableAIProvAWSBedrock`, `disableAIProvVertexGemini`; default false | [EinsteinGptSettings](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_einsteingptsettings.htm) |
| Hidden configuration | Not selectable in Prompt Builder; templates already using it run as before | [Hiding Configurations](https://help.salesforce.com/s/articleView?id=data.c360_a_ai_mm_show_hide_models.htm&language=en_US&type=5) |
| Beta models | Off by default; enable in Einstein Setup, preferably in sandboxes | [Large Language Model Support](https://help.salesforce.com/s/articleView?id=ai.generative_ai_large_language_model_support.htm&language=en_US&type=5) |
| Where a template's model lives | `primaryModel` on each prompt template version | [GenAiPromptTemplate](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_genaiprompttemplate.htm) |
| Agent default model | Changed on the Agentforce Agents page in Setup | [Supported Models](https://developer.salesforce.com/docs/ai/agentforce/guide/supported-models.html) |
| BYOLLM providers | Azure, Bedrock, OpenAI or Vertex accounts; others via LLM Open Connector | [Large Language Model Support](https://help.salesforce.com/s/articleView?id=ai.generative_ai_large_language_model_support.htm&language=en_US&type=5) |
| BYOLLM and the Trust Layer | Inference by the provider; Trust Layer features fully supported | [Supported Models](https://developer.salesforce.com/docs/ai/agentforce/guide/supported-models.html) |
| Who can change a template's model | Holders of Prompt Template Manager or Customize Application | [Enable Prompt Builder](https://help.salesforce.com/s/articleView?id=ai.prompt_builder_enable.htm&language=en_US&type=5) |

## Check yourself

- Why doesn't hiding a model configuration break existing prompt templates?
- When should you turn off a model provider rather than hide a configuration?
- Why does BYOLLM still meet Trust Layer requirements?
- What do model containment policies do?

## Sources

- [Large Language Model Support](https://help.salesforce.com/s/articleView?id=ai.generative_ai_large_language_model_support.htm&language=en_US&type=5)
- [Manage Large Language Model (LLM) Access by Hiding Configurations](https://help.salesforce.com/s/articleView?id=data.c360_a_ai_mm_show_hide_models.htm&language=en_US&type=5)
- [Bring Your Own Large Language Model](https://help.salesforce.com/s/articleView?id=data.c360_a_ai_foundation_models.htm&language=en_US&type=5)
- [Supported Models](https://developer.salesforce.com/docs/ai/agentforce/guide/supported-models.html)
- [AI Models](https://developer.salesforce.com/docs/ai/agentforce/guide/get-started-einstein-studio.html)
- [EinsteinGptSettings](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_einsteingptsettings.htm)
- [GenAiPromptTemplate](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_genaiprompttemplate.htm)
- [Craft an Effective Prompt Template](https://trailhead.salesforce.com/content/learn/modules/custom-service-agents-with-prompt-builder-and-agentforce/craft-an-effective-prompt-template)
- [Explore Agentforce Guardrails and Trust Patterns](https://trailhead.salesforce.com/content/learn/modules/trusted-agentic-ai/explore-agentforce-guardrails-and-trust-patterns)
- [Enable Prompt Builder](https://help.salesforce.com/s/articleView?id=ai.prompt_builder_enable.htm&language=en_US&type=5)
- [Einstein Trust Layer: Designed for Trust](https://help.salesforce.com/s/articleView?id=ai.generative_ai_trust_arch.htm&language=en_US&type=5)
- [Change Set Considerations for Prompt Templates](https://help.salesforce.com/s/articleView?id=ai.prompt_builder_considerations_changeset.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 6 linked practice questions, and unlimited timed mock exams are included with the Agentforce Specialist pack (USD $19): https://www.certifyforce.com/practice-exams