If I only use deniedModels without availableModelsMatch: "exact", can I get the same locking effect?
Not quite. Using deniedModels alone only excludes the specific models you explicitly list — it has zero effect on models that don't exist yet but will be released in the future. Once a new model ships, it'll still pass through the allow-list as long as it wasn't added to deniedModels. The real value of availableModelsMatch: "exact" is that it flips the allow-list's own matching behavior so that anything not explicitly listed is blocked by default — that's the mechanism that actually guards against future versions you don't even know the name of yet.
Layering both together is what lets you precisely exclude known problem versions while also blocking every unapproved future version.
Is this setting only relevant for Claude Enterprise or large organizations?
The primary use case does skew toward teams with centralized governance needs — the documentation positions it as a managed setting, meaning it's designed for IT or platform teams to push down uniformly, with individual developers unable to override it. If you're an individual developer or a small team, you generally don't need this level of strict version locking; sticking with default automatic-update behavior actually lets you benefit from new model capability improvements sooner.
But even a small team can benefit from this if you have compliance review requirements or contractual commitments to clients about which specific model version is in use — this isn't a need exclusive to large enterprises.
If a team already has availableModelsMatch set to exact and wants to upgrade to a new model, what's the correct procedure?
The correct approach is to explicitly add the new model's full name to availableModels first, rather than expecting any form of automatic pass-through or fuzzy matching to kick in. Since exact mode matches character-for-character, the new model's version string (which typically includes a date or version number) must match the officially published name exactly — it's worth copying it directly from the official announcement or the available-models list shown in /status, to avoid a manual typo that makes the config look correct but silently fails to actually permit the model.
Before rolling out broadly, it's also worth validating the new setting in a small test environment first, then pushing it to the whole team's managed settings.
After setting availableModelsMatch to exact, does it change the day-to-day experience for ordinary developers using Claude Code?
There's no direct change to day-to-day operation — this setting affects which models can be selected, not the interface or command usage. The only situation a developer would actually notice is trying to switch to a model that isn't explicitly on the allow-list, which gets blocked with a notice — at that point, the right move is to contact the administrator to confirm whether that model should be added to the list, not to try working around it in local settings (managed settings are specifically designed not to be overridable at the individual level).
For administrators, this means every future model rollout now requires an explicit action to update the allow-list, rather than relying on default automatic extension behavior.
For teams that centrally manage Claude Code in an enterprise setting, automatic model upgrades have long posed a dilemma: leave versions unlocked, and a team can get silently switched to new model behavior the moment a new release ships, with zero testing; lock versions with an imprecise mechanism, and certain sub-versions might still slip through anyway. A recent release adds two managed settings — availableModelsMatch: "exact" and deniedModels — built specifically as a precise control mechanism for this exact pain point.
Before this setting existed, the matching logic behind the availableModels allow-list was comparatively loose — a model name an administrator listed could, in practice, end up also permitting closely related sub-versions or aliases. Setting availableModelsMatch to "exact" makes the behavior strict: every entry in availableModels only permits the exact model version that entry literally names. A newly released model, even with a similar name, stays blocked unless explicitly added to the allow-list — there's no implicit slack left anywhere. This matters for scenarios requiring strict version control — for instance, a team that completed a compliance review or internal evaluation on a specific model version, and doesn't want anyone accidentally using an unvetted new version just because it became automatically available before the review was signed off.
deniedModels works in the reverse direction: even if a model appears in the availableModels allow-list, it still gets blocked if it also appears in deniedModels. This means administrators now have both an allow-list and a deny-list mechanism they can layer together, rather than being forced to choose one or the other. A common practical pattern: set availableModels relatively broadly (covering an entire model family), then use deniedModels to precisely exclude one or two sub-versions with a known specific issue (say, a version that's unstable on a particular task, or is still under internal validation) — without having to rewrite the entire allow-list just to exclude one or two versions.
Combining availableModelsMatch: "exact" with deniedModels achieves the effect of "pinning the entire team to a designated version, with no automatic pass-through when a new version ships" — which is precisely the use case named in the documentation. Compared to the previous loose-matching availableModels, this raises version control precision from "roughly lock to a model family" to "lock down to one specific version number."
If your organization needs compliance review, internal evaluation, or cost control (different model versions can carry different pricing) over AI tool behavior, this update means you no longer have to rely on soft constraints like "the team promises not to manually upgrade" — you can now enforce a genuinely verifiable, auditable version lock at the managed settings level. After upgrading to a version that supports this, it's worth first auditing your existing availableModels configuration in settings.json to decide whether to also add availableModelsMatch: "exact" — because an existing allow-list that worked fine under loose matching might unexpectedly Block some legitimate model names that were only passing through thanks to fuzzy matching once you switch to strict mode. It's worth validating this in a test environment before rolling it out broadly.