diff --git a/src/ReverseLlama.Server/ManagementStore.cs b/src/ReverseLlama.Server/ManagementStore.cs
index 5dc4062..8ad2d01 100644
--- a/src/ReverseLlama.Server/ManagementStore.cs
+++ b/src/ReverseLlama.Server/ManagementStore.cs
@@ -871,7 +871,7 @@ internal sealed class ManagementStore
             var groupIds = GetApiKeyGroupIdsLocked(apiKeyId);
             if (groupIds.Count == 0)
             {
-                return GroupAccess.Unrestricted;
+                return GroupAccess.Empty;
             }
 
             var clientModels = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
@@ -1281,6 +1281,8 @@ internal sealed class GroupAccess
 {
     public static GroupAccess Unrestricted { get; } = new(new HashSet<string>(), new HashSet<string>(), isUnrestricted: true);
 
+    public static GroupAccess Empty { get; } = new(new HashSet<string>(), new HashSet<string>());
+
     public IReadOnlySet<string> ClientModels { get; }
 
     public IReadOnlySet<string> AllClients { get; }