A model was refused · Falcon docs

Read the sentence on the screen. It names which of the three it is. Fix that one. The others can stay as they are.

Company model rules

Open the agent, then Settings. Under Model and limits, the field is Model. If this model is not one the company allows, the page says: This model isn't allowed for your company right now, so this agent can't run on it. Choose another model, or ask an administrator.

If the model may keep data, it says: This model may keep data, and your company hasn't allowed those. Choose a model that keeps nothing, or turn on Allow models that may keep data (Dev only) in Models & limits. Models & limits opens Connections › Model providers.

On Model providers, open Limits. Model rules says: Every model call follows these. A way of running a model that breaks one is never used, and a model with no way left can't be added.
Only routes that keep no data. Calls use only routes and providers that keep nothing. Your own key counts once you've confirmed its provider keeps no data.
US only. Calls use only routes known to run in the US. Today that's the included Amazon Bedrock models; anything else is left out while this is on.
On Add models, when the rules are on: Your company's model rules are on, so only models that can run within them are listed. Model rules jumps to the switches.
On Models, a Runs through choice the rules refuse is marked outside your model rules and cannot be chosen.
The switch Allow models that may keep data is on Limits. Its note says: Only while testing in Dev; Live always uses models that keep nothing. Turning it off turns those models off.

The provider refused the key

Open Connections, then Model providers, then Your keys. The Key column is No key yet, Working, Key not working, or Out of credit.

Key not working and Out of credit add a line: the provider's name, then The provider refused this key. Replace it; until then its models use their fallback, if one is set. Choose Replace key.
On Models, a Runs through choice whose key stopped says key not working.
Failover says: A failover takes a call only when the route refuses it before it runs, such as a key that stopped working. It is never used after a call has started. None. The call stops. means there is no failover.
Ask Studio can say: The model provider refused the company's key. An administrator needs to check the model connection. A different sentence, The model provider's budget is exhausted. An administrator needs to check the provider account., is the provider account, not the company's Spending page.

Adding or replacing a key is on Add a model key.

A spending limit is reached

Open Settings, then Spending, or follow Open Spending › from Model providers › Limits. The section When a limit is reached says: New model calls, app syncs, media and voice are refused with a clear message. Work already running finishes.

Ask Studio says: A spending limit has been reached. An administrator can check the company's usage settings. Only a System admin can change the limits. See Set the company's spending limits.
A different Ask Studio sentence, Ask Studio has reached this month's limit for your company., is Ask Studio's own monthly limit, not the company Spending page.
On a run, Waiting for you with Open Waiting for you is a step that used its own allowance. That opens Inbox, section Stopped at a limit. It is not the Failed outcome. See When a run failed.
Reports › Needs me, chip Limits needing attention, means: Agent or company budgets nearing a daily or monthly spending limit, and work stopped at a limit.