AI model errors

What you see

• The AI agent stops and reports an error from its AI model, for example permission_error, rate_limit_error, authentication_error or api_error.
• The agent says a model "is not permitted".
• The agent says a "token budget" was exceeded.
• The agent worked earlier, then stopped with "User previously denied this model."

Why it happens

Inside a project, the agent never talks to an AI provider directly. Every call goes through Levee's model gateway on your computer. The gateway checks the call against your organization's model rules (which models, how much use), adds the real provider key on your computer, and passes the call on. The agent never sees that key.

So a call can be refused because the model is not allowed, you declined it, a usage limit was reached, or the provider itself failed.

What you can try

"User denied access to this model." or "User previously denied this model."

Some models ask for your approval the first time they are used. The request was declined, or nobody answered within 5 minutes.

1. If the message says previously denied, Levee remembers the "no" until the project stops. Stop the project and start it again.
2. Ask the agent to try again.
3. When Levee shows the Access Request, approve it. See Approvals.

"Model '...' is not permitted."

The agent asked for a model your organization does not allow. Ask the agent to use an allowed model, or ask your IT team to allow the one you need.

"session token budget exceeded."

The project has used up its allowance for this session. Stop the project and start it again to begin a new session.

"daily token budget exceeded."

The project has used up its daily allowance. It resets at midnight UTC. Wait, or ask your IT team to raise the limit.

"concurrent request limit exceeded."

The agent sent too many requests at the same time. Most AI tools wait and retry on their own. If it keeps happening, ask the agent to do one thing at a time.

"Prompt contains a disallowed term."

Your request contained a word or phrase your organization blocks. Rephrase it. If you think the block is wrong, tell your IT team.

"Request body exceeds 4 MB limit."

The agent tried to send too much text at once, usually very large files. Ask it to work on smaller parts.

"Upstream provider failure."

The AI provider returned an error or could not be reached. Try again in a few minutes. If your organization uses the Vediram LLM Gateway, check that you are signed in: open the Levee app, go to Settings > Vediram Cloud, and sign in. Start the Levee app normally, not as administrator, for this sign-in.

Anything else

Copy the exact message and send it to your IT team.

For your IT team

Levee points the agent's SDKs at the gateway on the host (ANTHROPIC_BASE_URL and OPENAI_BASE_URL) and gives the agent a placeholder API key that is useless outside the sandbox. Errors come back in each provider's native format, so agents and SDKs handle them normally:

• Anthropic protocol: {"type":"error","error":{"type":"...","message":"..."}}
• OpenAI protocol: {"error":{"type":"...","code":"...","message":"..."}}

Every call and every refusal is audited as an llm.* event. Prompt and response content is never written to the audit trail.

Error reference

429 errors use the rate_limit_error type, so most SDKs back off and retry automatically.

Find the reason in the audit trail

levee audit tail --lines 100

Look for llm.denied.model, llm.denied.user, llm.denied.budget, llm.denied.protocol, llm.denied.auth, llm.prompt_blocked and llm.upstream_error. For budget denials the detail shows the scope, the tokens used and the cap. For more detail:

levee log tail --component proxy.llm --project <project-id> --since 1h

Configure provider keys

Provider API keys are never stored in policy (a policy that contains an inline apiKey is rejected) and never enter the sandbox. They are read from machine environment variables on the host:

Set the variable at machine scope from an elevated PowerShell, then restart the computer so the Levee service picks it up (Windows services only see machine environment changes after a restart):

[Environment]::SetEnvironmentVariable('LEVEE_KEY_ANTHROPIC', '<your key>', 'Machine')
Restart-Computer

Machine environment variables are readable by local administrators and by processes on the machine. Deploy keys with your usual secret-distribution tooling and restrict administrator access accordingly. If your organization uses the Vediram LLM Gateway, no provider key is needed on the device. See Model access.

Upstream provider failure

Check the llm.upstream_error audit event. Its detail includes the provider's HTTP status.

• 401 or 403 from the provider: the host key is wrong, expired or lacks access to the model. Replace the key.
• 404 from the provider: the upstreamModel (or the Azure deployment) does not exist at the provider. Fix the model mapping in policy.
• 429 from the provider: the provider's own rate limit or quota. Levee does not retry; the agent's SDK will.
• No status / connection failure: the host cannot reach the provider. Check firewall and proxy rules for the provider endpoint from the host (not from the sandbox).
• Vediram LLM Gateway: calls routed to the Vediram gateway use the user's own Vediram sign-in. If the user is signed out, calls fail closed with this error. Running the Levee app as administrator is not supported for this sign-in.

Protocol mismatch

Levee does not translate between protocols. Anthropic-protocol clients (such as Claude Code) need models mapped to anthropic, bedrock, or an Anthropic-compatible endpoint. OpenAI-protocol clients (such as Codex CLI) need models mapped to openai, azure-openai, azure-foundry, or an OpenAI-compatible endpoint. See Model access.

Which models can the agent use?

From inside the sandbox, the agent can list the models the policy allows (for example, GET /v1/models on the gateway base URL). Only allowed model names and aliases are listed.

Before you open a request

Send the llm.* audit events and the proxy.llm log. See Collecting logs for support.