diff --git a/apps/web/src/lib/organizations/auto-model-change-log.test.ts b/apps/web/src/lib/organizations/auto-model-change-log.test.ts
index 56c0ce22f..a764e06a5 100644
--- a/apps/web/src/lib/organizations/auto-model-change-log.test.ts
+++ b/apps/web/src/lib/organizations/auto-model-change-log.test.ts
@@ -74,7 +74,6 @@ describe('computeRelevantChangesForOrg', () => {
   test('allow-list mode: new model from already-allowed provider is relevant', () => {
     const org = buildEnterpriseOrg({
       settings: {
-        provider_policy_mode: 'allow',
         provider_allow_list: ['z-ai'],
       },
     });
@@ -92,7 +91,6 @@ describe('computeRelevantChangesForOrg', () => {
   test('allow-list mode: new model from non-allowed provider is NOT relevant', () => {
     const org = buildEnterpriseOrg({
       settings: {
-        provider_policy_mode: 'allow',
         provider_allow_list: ['z-ai'],
       },
     });
@@ -111,7 +109,6 @@ describe('computeRelevantChangesForOrg', () => {
   test('allow-list mode: brand-new provider with new model is NOT relevant', () => {
     const org = buildEnterpriseOrg({
       settings: {
-        provider_policy_mode: 'allow',
         provider_allow_list: ['z-ai'],
       },
     });
@@ -130,7 +127,6 @@ describe('computeRelevantChangesForOrg', () => {
   test('allow-list mode: new model on the deny list is NOT relevant', () => {
     const org = buildEnterpriseOrg({
       settings: {
-        provider_policy_mode: 'allow',
         provider_allow_list: ['z-ai'],
         model_deny_list: ['z-ai/glm-5.1'],
       },
@@ -144,7 +140,7 @@ describe('computeRelevantChangesForOrg', () => {
     expect(relevantChangesIsEmpty(changes)).toBe(true);
   });
 
-  test('legacy deny-list mode (empty deny lists): new model from any provider is relevant', () => {
+  test('no allow list: new model from any provider is relevant', () => {
     const org = buildEnterpriseOrg({ settings: {} });
     const oldSnapshot = buildSnapshot([{ slug: 'z-ai', models: ['z-ai/glm-5'] }]);
     const newSnapshot = buildSnapshot([
@@ -158,25 +154,9 @@ describe('computeRelevantChangesForOrg', () => {
     expect(changes.addedByReasonProvider.get('new-provider')).toEqual(['new-provider/foo']);
   });
 
-  test('legacy deny-list mode: new model from denied provider is NOT relevant', () => {
-    const org = buildEnterpriseOrg({
-      settings: { provider_deny_list: ['bad-corp'] },
-    });
-    const oldSnapshot = buildSnapshot([{ slug: 'bad-corp', models: ['bad-corp/old'] }]);
-    const newSnapshot = buildSnapshot([
-      { slug: 'bad-corp', models: ['bad-corp/old', 'bad-corp/new'] },
-    ]);
-
-    const diff = computeSnapshotDiff(oldSnapshot, newSnapshot);
-    const changes = computeRelevantChangesForOrg(org, diff);
-
-    expect(relevantChangesIsEmpty(changes)).toBe(true);
-  });
-
   test('removed from catalog: model that was accessible is recorded', () => {
     const org = buildEnterpriseOrg({
       settings: {
-        provider_policy_mode: 'allow',
         provider_allow_list: ['z-ai'],
       },
     });
@@ -193,7 +173,6 @@ describe('computeRelevantChangesForOrg', () => {
   test('removed from allowed providers: model still in catalog but only via denied providers', () => {
     const org = buildEnterpriseOrg({
       settings: {
-        provider_policy_mode: 'allow',
         provider_allow_list: ['openai'],
       },
     });
@@ -216,7 +195,6 @@ describe('computeRelevantChangesForOrg', () => {
   test('removed model that was denied is NOT relevant', () => {
     const org = buildEnterpriseOrg({
       settings: {
-        provider_policy_mode: 'allow',
         provider_allow_list: ['z-ai'],
         model_deny_list: ['z-ai/glm-4.0'],
       },
@@ -233,7 +211,6 @@ describe('computeRelevantChangesForOrg', () => {
   test('removed model still offered by another allowed provider is NOT relevant', () => {
     const org = buildEnterpriseOrg({
       settings: {
-        provider_policy_mode: 'allow',
         provider_allow_list: ['openai', 'azure'],
       },
     });
@@ -255,7 +232,6 @@ describe('computeRelevantChangesForOrg', () => {
   test('deterministic reason provider: picks first alphabetical allowed provider', () => {
     const org = buildEnterpriseOrg({
       settings: {
-        provider_policy_mode: 'allow',
         provider_allow_list: ['azure', 'openai'],
       },
     });
diff --git a/apps/web/src/lib/organizations/auto-model-change-log.ts b/apps/web/src/lib/organizations/auto-model-change-log.ts
index f487b922d..c93218611 100644
--- a/apps/web/src/lib/organizations/auto-model-change-log.ts
+++ b/apps/web/src/lib/organizations/auto-model-change-log.ts
@@ -30,7 +30,6 @@ type Availability = { allowed: boolean; reasonProvider: string | null };
 type PrecomputedRestrictions = {
   modelDenySet: Set<string>;
   providerAllowSet: Set<string> | undefined;
-  providerDenySet: Set<string>;
 };
 
 function precompute(restrictions: ModelRestrictions): PrecomputedRestrictions {
@@ -39,7 +38,6 @@ function precompute(restrictions: ModelRestrictions): PrecomputedRestrictions {
     providerAllowSet: restrictions.providerAllowList
       ? new Set(restrictions.providerAllowList)
       : undefined,
-    providerDenySet: new Set(restrictions.providerDenyList),
   };
 }
 
@@ -72,10 +70,7 @@ function checkAvailability(
       : { allowed: false, reasonProvider: null };
   }
 
-  const nonDeniedProvider = sortedProviders.find(slug => !precomputed.providerDenySet.has(slug));
-  return nonDeniedProvider
-    ? { allowed: true, reasonProvider: nonDeniedProvider }
-    : { allowed: false, reasonProvider: null };
+  return { allowed: true, reasonProvider: sortedProviders[0] };
 }
 
 /**