Gating without grounding

Staged release and the political economy of AI dependency.

19 October 2026 · Aakash Sangani

Debates regarding the deployment of open-weight frontier models are frequently framed around a technical trade-off between safety and innovation. This framing conceals a political question. Who decides the conditions under which a sovereign state, a public institution or an independent researcher gets access to foundational computational tools? The paradigm of staged release, formulated systematically by Seger et al. (2023)1 and championed by frontier commercial developers such as Anthropic4, answers this question by centralising authority within the commercial entity that trains the system. This governance model trades a rapidly shrinking safety window for an enduring state of technical dependency. The literature that advocates these access controls rarely examines the communities that bear the cost of that dependency.

Seger et al.1 define staged release as an operational pathway in which incrementally larger model iterations are released exclusively through hosted application programming interfaces (APIs). While the authors outline a broader catalogue of structured access, including vetted downloads, restricted research portals, and third-party red-teaming, every option presented governs the external communication layer rather than the computational asset itself. Whether interacting with a commercial API or a gated research portal, external parties cannot inspect weight matrices, fine-tune models on local datasets, use the responses to re-train other models, host architectures on domestic servers, or verify internal activations. The terms of access remain under the discretionary control of the developer, subject to unilateral modification, pricing changes, or outright revocation.

The technical case for these perimeter controls rests on documented failure modes. Post-hoc fine-tuning can strip safety guardrails for less than USD 0.20 in compute5, adversarial prompt suffixes transfer readily from open surrogate models to proprietary black-box systems6, and unvetted downstream software integrations can surface latent capabilities that developers never foresaw1. In policy declarations and legislative testimonies, frontier laboratories such as Anthropic have turned these vulnerabilities into a broader claim. Once weights for models with advanced biological or cyber capabilities proliferate, they argue, catastrophic tail risks can no longer be contained4. Their strongest technical argument rests on the irreversibility of open weights. As Seger et al.1 observe, developers cannot recall or patch an open-weight model once it circulates publicly. Hosted access avoids this problem entirely by allowing developers to patch vulnerabilities server-side and revoke access keys without requiring downstream cooperation. A critique of access controls has to answer this point.

Restricting model access to a hosted interface, however, does not eliminate systemic risk for institutions that rely on external software2. For a public agency building civic infrastructure, the utility of a foundation model depends less on whether it holds the global frontier on capability benchmarks than on whether access remains stable, whether local regulators can audit internal processes during institutional failures, and whether domestic teams can adapt the system to local conditions. Structured access denies all three by design1,2.

This access model carries a second cost, which is the loss of normative sovereignty. When an institution relies entirely on a closed API, it cannot retrain weights to reflect local linguistic registers, cultural conventions, or constitutional protections. Instead, dependent societies must import the moral baselines, safety definitions, and political judgments of a small cluster of developers in the United States8. In multilingual and socio-economically stratified contexts, these default guardrails frequently misclassify benign local expressions as toxic while failing to catch culturally specific vitriol. Gating stops domestic researchers from fixing these misalignments, so public institutions outside the United States end up importing a safety floor they never vetted.

Historical precedents in telecommunications, payment rails, and digital identity show the danger of ceding infrastructural control to external providers. Kenya and its implementation crises with the Huduma Namba and Maisha Namba digital identity systems illustrate how reliance on proprietary, foreign-supplied technical architectures produces vendor lock-in, legal vulnerability, and exclusion for millions of citizens7. When judicial rulings halted Maisha Namba due to data protection failures and the absence of independent verification, the state found itself constrained by foreign technical designs that local regulators could neither inspect nor reconfigure. A sovereign alternative would have paired access with domestic audit sandboxes, open protocol specifications, and independent bias benchmarks evaluated on representative civic data. Without these sovereign safeguards, whoever controls the underlying technical stack sets the legal and civic terms for everyone building on top of it.

Seger et al.1 assess risk mainly at the level of the model, focusing on malicious use and the irreversible spread of system flaws, and leave institutions' capacity to adapt outside the analysis. Drawing on decolonial theory, Mohamed, Png and Isaac argue that centralised access models reproduce historical patterns of resource extraction and technical subordination8. Kilian argues that risk assessments should move from proximate operational threats to the institutional forces and power relations that shape how technology is adopted. Kilian's "inequality of control" shows that the concentration of model development within a small cluster of private corporations redistributes geopolitical leverage toward those firms2.

Empirical capability trends make this inequality of control increasingly difficult to justify. Epoch AI estimates that as of early 2026, leading open-weight architectures trailed proprietary frontier models by an average of four months, or roughly eight points on the Epoch Capabilities Index3. This variance is comparable to the gap between consecutive minor releases within a single model lineage. Seger et al.1 concede this point even while arguing against open release. Frontier progress happens mainly inside well-resourced firms because those firms hold the capital, compute clusters, and proprietary datasets needed to push the frontier forward. Open-source distribution does not drive frontier advancement because external actors lack the computational resources to match that pace. Structured access controls merely manage the temporal lag between frontier discovery and public release, a margin that is now measured in months. Establishing an international governance norm that buys a four-month delay at the price of permanent institutional dependency prioritises a transient operational window over long-term structural autonomy.

Proponents of closed access argue that this four-month window is critical because catastrophic risks do not wait for parity. From this perspective, a brief buffer that prevents the proliferation of dangerous chemical, biological, or cyber capabilities outweighs abstract institutional friction1,4. No appeal to digital sovereignty can implement a software recall on an open-weight model with dangerous capabilities. Yet dependency carries an equivalent form of irreversibility. Public administration systems constructed over multiple years upon proprietary foreign APIs cannot easily pivot when open alternatives reach parity. Civil service workflows, procurement pipelines, and public trust form around the proprietary systems available during initial deployment. By the time open parity arrives, institutional and enterprise lock-in is already complete. Kilian terms this dynamic a "deleterious feedback loop," wherein organisations make short-term adaptations under initial constraints that continue to dictate their choices long after technical conditions change2. Paternalistic calls to wait until commercial systems become safer impose compounding economic, administrative, and democratic costs on dependent states.

This dynamic helps explain the political pushback against corporate safety arguments. In regulatory debates across both the United States and international forums, critics increasingly characterise the safety justifications advanced by frontier laboratories as a form of regulatory capture9,10. By lobbying for mandatory licensing regimes, compute thresholds, and restrictions on open weights under the banner of existential risk prevention, incumbent developers establish legal barriers that insulate their market position against open-source competition and smaller commercial rivals. Structured access turns commercial concentration of compute into an officially sanctioned regulatory monopoly, and in doing so widens the inequality of control.

This critique does not suggest that high-capability weights should be released indiscriminately without regard for catastrophic hazards. Seger et al.1 present a rigorous case for oversight when severe, irreversible tail risks are plausible. This argument would fail if empirical capability gaps between proprietary frontiers and open architectures widened from months into multiple years through novel techniques rather than pure scale and compute, or if commercial developers proved that structured access regimes can provide non-revocable, sovereign audit rights that eliminate institutional lock-in. A governance framework still has to weigh two kinds of risk together. One is the misuse that access controls prevent; the other is the dependency those same controls impose on the institutions that rely on them.

Unilateral corporate gatekeeping should give way to enforceable multilateral standards that combine binding access guarantees, sovereign auditing rights and transparent empirical criteria requiring capability sharing as frontier gaps close. Multinational digital public infrastructure already works this way. MOSIP's core identity platform and eGov Foundation's DIGIT stack are built centrally, then adapted, deployed and audited by local implementation partners in each country that adopts them11,12. AI access could follow the same pattern, with a central developer releasing monitored open weights that local vendors customise. Seger et al.1 propose a multi-stakeholder body to oversee research access, but they restrict participation to academic investigators. Expanding this oversight model to include the sovereign states and public bodies that rely on foundational systems would be a necessary step toward reducing the structural risks of closed model governance8.

References

1. Seger, E., Dreksler, N., Moulange, R., Dardaman, E., Schuett, J., Wei, K., Winter, C., Arnold, M., Korinek, A., Anderljung, M., Bucknall, B., Chan, A., Stafford, E., Koessler, L., Ovadya, A., Garfinkel, B., Bluemke, E., Aird, M., Levermore, P., … Biderman, S. (2023). Open-sourcing highly capable foundation models: An evaluation of risks, benefits, and alternative methods for pursuing open-source objectives. Centre for the Governance of AI. doi.org/10.48550/arXiv.2311.09227
2. Kilian, K. A. (2025). Beyond accidents and misuse: Decoding the structural risk dynamics of artificial intelligence. AI & Society. doi.org/10.1007/s00146-025-02419-2
3. Edwards, J., & Emberson, L. (2026). Open models lag state-of-the-art closed models by 4 months. Epoch AI. epoch.ai/data-insights/open-closed-eci-gap
4. Anthropic. (2023). Written testimony of Dario Amodei, Ph.D., to the United States Senate Committee on the Judiciary, Subcommittee on Privacy, Technology, and the Law. United States Senate. judiciary.senate.gov; see also Anthropic. (2024). Anthropic's responsible scaling policy, version 1.0. Anthropic PBC.
5. Qi, X., Zeng, Y., Xie, T., Chen, P. Y., Jia, R., Mittal, P., & Henderson, P. (2023). Fine-tuning aligned language models compromises safety, even when users do not intend to! arXiv preprint arXiv:2310.03693. doi.org/10.48550/arXiv.2310.03693
6. Zou, A., Wang, Z., Kolter, J. Z., & Fredrikson, M. (2023). Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043. doi.org/10.48550/arXiv.2307.15043
7. Privacy International. (2020). Kenyan court ruling on Huduma Namba identity system: Lessons for digital identity. Privacy International; see also High Court of Kenya at Nairobi. (2023). Katiba Institute & another v Attorney General & 3 others, Constitutional Petition E473 of 2023.
8. Mohamed, S., Png, M. T., & Isaac, W. (2020). Decolonial AI: Decolonial theory as sociotechnical foresight in artificial intelligence. Philosophy & Technology, 33(4), 659–684. doi.org/10.1007/s13347-020-00405-8
9. Sacks, D. [@DavidSacks]. (2026, September 13). Dario has written that we need to "pace the frontier," and Sam has agreed… [Post]. X. x.com/DavidSacks
10. Federal Trade Commission. (2025). Staff report on AI partnerships & investments: 6(b) study. Bureau of Competition, Office of Technology. ftc.gov
11. MOSIP. (2024). Modular Open Source Identity Platform architecture and country adoption models. International Institute of Information Technology, Bangalore.
12. eGov Foundation. (2024). DIGIT open source platform for urban and governance transformation. eGov Foundation.