zen: restrict alpha models to admin workspaces