diff --git a/src/ReverseLlama.Server/ManagementStore.cs b/src/ReverseLlama.Server/ManagementStore.cs
index 0951d0d..5dc4062 100644
--- a/src/ReverseLlama.Server/ManagementStore.cs
+++ b/src/ReverseLlama.Server/ManagementStore.cs
@@ -912,21 +912,27 @@ internal sealed class ManagementStore
                     {
                         if (regex.IsMatch(connectedClient))
                         {
-                            allClients.Add(connectedClient);
                             if (!string.IsNullOrWhiteSpace(model))
                             {
                                 clientModels.Add($"{connectedClient}:{model}");
                             }
+                            else
+                            {
+                                allClients.Add(connectedClient);
+                            }
                         }
                     }
                 }
                 else if (!string.IsNullOrWhiteSpace(clientId))
                 {
-                    allClients.Add(clientId);
                     if (!string.IsNullOrWhiteSpace(model))
                     {
                         clientModels.Add($"{clientId}:{model}");
                     }
+                    else
+                    {
+                        allClients.Add(clientId);
+                    }
                 }
             }
 
diff --git a/src/ReverseLlama.Server/ReverseProxyEndpoint.cs b/src/ReverseLlama.Server/ReverseProxyEndpoint.cs
index e5687e5..0fbe21c 100644
--- a/src/ReverseLlama.Server/ReverseProxyEndpoint.cs
+++ b/src/ReverseLlama.Server/ReverseProxyEndpoint.cs
@@ -97,7 +97,9 @@ internal static class ReverseProxyEndpoint
         var connection = hub.SelectBest(
             requestedModel,
             clientId => !managementStore.GetClientAccess(clientId).IsDisabled
-                && groupAccess.IsClientAllowed(clientId));
+                && (requestedModel is null
+                    ? groupAccess.IsClientAllowed(clientId)
+                    : groupAccess.IsClientModelAllowed(clientId, requestedModel)));
         if (connection is null)
         {
             if (!hub.HasClient)
@@ -202,6 +204,13 @@ internal static class ReverseProxyEndpoint
         }
 
         var requestedModel = embeddingRequest?.Model ?? await GetRequestedModelAsync(context.Request, clientPath);
+        if (requestedModel is not null && groupAccess is not null && !groupAccess.IsClientModelAllowed(clientId, requestedModel))
+        {
+            context.Response.StatusCode = StatusCodes.Status403Forbidden;
+            await context.Response.WriteAsync($"Access to model '{requestedModel}' on client '{clientId}' is not permitted.", context.RequestAborted);
+            return;
+        }
+
         await ForwardAsync(
             context,
             connection,
@@ -300,7 +309,7 @@ internal static class ReverseProxyEndpoint
         foreach (var (model, clients) in models.OrderBy(kvp => kvp.Key, StringComparer.OrdinalIgnoreCase))
         {
             var accessibleClients = clients
-                .Where(clientId => groupAccess.IsClientModelAllowed(clientId, model) || groupAccess.IsClientAllowed(clientId))
+                .Where(clientId => groupAccess.IsClientModelAllowed(clientId, model))
                 .ToList();
 
             if (accessibleClients.Count > 0)