Enterprise users logging in via OAuth had their organization ID stored
in auth.accountId but the model fetch code never read it, causing the
model list to be fetched from the personal endpoint instead of the
org-specific endpoint that applies the allow list.
Marius