Policy proposal. Open a formal release-profile review only when evidence is tied to an exact tested object or an explicitly bounded access condition and supplies more than one relevant signal: reproducible evaluation evidence, a policy-level pathway showing material assistance, and a release-profile change that plausibly removes provider-dependent controls. A benchmark, compute quantity, model name, or forecast cannot trigger a restriction by itself. This is a proposed decision standard, not an evidence-derived universal numerical threshold.
Evidence limits
- No evidence-derived universal capability, compute, or risk threshold is asserted.
- Benchmarks, pooled access, single-model causal uplift, and catastrophic outcomes remain separate estimands.
- Exact tested-object identity may remain unavailable for hosted systems.
Unresolved dissent
Security reviewers may consider convergent evidence too slow; liberty and science reviewers may consider an uncalibrated trigger too discretionary.
Review trigger
Any new object-pinned independent study, material benchmark calibration, validated incident evidence, or demonstrated trigger error.
Defeat condition
The trigger is defeated if independent reviewers cannot apply it consistently, if it repeatedly misidentifies the tested object, or if it has no measurable relationship to the exposure being governed.
Policy proposal. Use MAPS—Model Access, Permissions, and Safeguards—only as a release-profile framework, never as a model class. Preserve a presumptive open path for low-risk objects; require increasing object pinning, independent evaluation, method disclosure, safeguard-limit testing, staged access, and time-limited review as evidence and exposure increase. A managed-access pause is prospective and contestable; it is not a claim that copied weights can be recalled.
Evidence limits
- Framework or standards conformity is process evidence, not proof of safety.
- No gate is represented as optimal or universally calibrated.
- Gates apply to decisions still under the relevant actor's control.
Unresolved dissent
Staged access can concentrate evaluation power, while fully open release can eliminate provider-dependent safeguards before uncertainty is reduced.
Review trigger
A materially different release profile, corrected evaluation, new causal evidence, appeal reversal, or evidence that a less restrictive profile performs as well.
Defeat condition
The gate is defeated if it is indefinite, cannot be independently reviewed, fails to affect relevant exposure, or suppresses protected low-risk work without demonstrable security value.
Policy proposal. Assign proposed duties according to control: developers document provenance, release profile, evaluation limits, and incident channels; hosted providers disclose and test provider-dependent safeguards; regulated distributors preserve hashes, provenance, notices, and update channels only where a validated legal or voluntary basis exists; downstream commercial modifiers disclose material provenance changes when entering a covered distribution channel; funders and procurers use proportionate conditions; regulators provide reasons, privacy safeguards, metrics, and appeal. No general repository, publication, or private-local-use duty is asserted as existing law.
Evidence limits
- Actor duties are policy proposals unless a cited jurisdiction-specific legal rule applies.
- Repository and intermediary law requires later validation.
- Compliance does not establish outcome effectiveness.
Unresolved dissent
Control-based allocation may miss informal distributors and can burden small actors who lack legal and evaluation capacity.
Review trigger
Any actor-specific legal validation, change in distribution practice, compliance-cost evidence, or showing that a duty targets an actor without relevant control.
Defeat condition
A duty is defeated if the actor lacks control over the conduct, no lawful or voluntary basis exists, compliance is not observable, or burden is disproportionate to the supported risk.
enforcement routes
Layered enforcement routes
Policy proposal. Maintain separate routes for existing criminal and export law, jurisdiction-specific reporting and transparency duties, civil or administrative remedies, procurement and funding conditions, financial investigation, standards-based process evidence, and voluntary technical practices. Each route must identify authority status, actor reach, observable conduct, remedy, appeal, and measurement plan. No route is described as sufficient or proven to reduce severe risk.
Evidence limits
- Legal status, non-enforcement, guidance, and targeted amendment remain distinct.
- Financial tracing cannot be represented as universal attribution or technical recall.
- Outcome effectiveness is unmeasured in this corpus.
Unresolved dissent
Layering can create complexity and overlapping burdens without closing cross-border or informal routes.
Review trigger
Measured coverage, false-positive/negative evidence, appeal outcomes, displacement, authority change, or validated severe-risk outcome data.
Defeat condition
A route is defeated if its authority fails, its target conduct is unobservable, remedies are unreviewable, or measured collateral costs exceed demonstrated benefits.
appeals/due process
Appeals, due process, and rights protection
Policy proposal. Require notice of the actor, action, authority, evidence class, duration, and review date; a meaningful statement of reasons; access to non-protected evidence and an independent advocate or cleared reviewer for protected evidence; prompt independent review; correction and appeal; privacy minimization; protected whistleblowing; aggregate public reporting; and a presumption against burdens on private low-risk local use, bona fide research, and defensive security.
Evidence limits
- The corpus does not settle the constitutional status of model weights.
- Some evidence may require lawful protection, which can weaken adversarial testing.
- Rights safeguards are moral and policy commitments unless anchored in applicable law.
Unresolved dissent
A cleared-review mechanism may still privilege institutions and provide less than full adversarial access.
Review trigger
Appeal reversal, delay, secrecy burden, privacy incident, unequal access evidence, or materially on-point legal authority.
Defeat condition
The process is defeated if restrictions are indefinite or viewpoint-based, reasons cannot be contested, review is not independent, or privacy and protected-use burdens are disproportionate.
international interfaces
International and cross-jurisdiction interfaces
Policy proposal. Use interoperable provenance and evaluation formats, evidence-sharing arrangements, mutual assistance, conflict-of-law review, minimum rights protections, and representative participation. Keep binding law, treaty form, entry into force, implementation, standards, guidance, and political commitments distinct. Capacity support covers compute, connectivity, local data, language, skills, finance, evaluation, and appeal rather than weight access alone.
Evidence limits
- Treaty and institutional commitments do not prove implementation or effectiveness.
- The UK legal state and later EU outcomes require refresh before present-tense reliance.
- Interoperability can export the preferences of powerful jurisdictions.
Unresolved dissent
Coordination can be slow, unequal, and vulnerable to forum shopping or political blockage.
Review trigger
Treaty status change, new law, interface adoption data, participation audit, capacity-distribution evidence, or conflict-of-law failure.
Defeat condition
The interface is defeated if it flattens legal status, excludes affected jurisdictions, creates material rights asymmetry, or shifts cost without capacity support.
present actions
Present actions
Policy proposal. Before any stronger restriction, preserve exact release and tested-object provenance; fund independent and unaffiliated evaluation; publish methods, uncertainty, nulls, and corrections; create lawful incident and researcher-reporting channels; document provider-dependent safeguard limits; establish shared evaluation and legal-validation capacity; baseline burden, access, concentration, participation, and appeal metrics; and fund preparedness, response, accessibility, and global capacity. These are proposals, not claims of completed implementation.
Evidence limits
- Actions improve evidence and institutional capacity but are not proven severe-risk controls.
- Currentness remains fixed to the July 28 corpus until refreshed.
- Capacity commitments require measurable delivery.
Unresolved dissent
Evidence-building can delay action and may favor already-resourced evaluators.
Review trigger
Completion or failure of baselines, missing evaluator access, material incident evidence, or inability to deliver capacity support.
Defeat condition
An action is defeated if it produces no inspectable output, excludes independent challenge, or imposes persistent cost without improving evidence, preparedness, access, or accountability.
Policy proposal. Escalate to a time-limited, least-restrictive prospective measure only after independent review finds credible and reproducible object-specific or explicitly access-condition evidence of material assistance across a policy-level severe-misuse pathway, a release profile that removes relevant provider controls, and no comparably effective less-restrictive option. Catastrophe need not be observed, but proxy performance cannot be called catastrophe evidence. Emergency action requires prompt review, reasons, sunset, and appeal.
Evidence limits
- The trigger is a policy proposal and is not a universal numerical threshold.
- Multi-barrier pathways and counterevidence remain attached.
- Emergency procedures can amplify false positives and secrecy.
Unresolved dissent
Security reviewers may seek action on weaker signals; liberty, science, and economic reviewers may demand calibration that is not yet available.
Review trigger
New causal evidence, correction, identity resolution, incident, less-restrictive alternative, or emergency appeal.
Defeat condition
A measure is defeated if trigger evidence is not reproducible, the release profile is irrelevant to the risk, a less-restrictive option performs as well, or collateral harms are not corrected at review.
Policy proposal. If international agreement fails, apply only lawfully supported, narrow measures to actors and transactions within the implementing jurisdiction; use procurement, funding, hosted-access, provenance, incident, and mutual-assistance routes where available; preserve open evidence-sharing and later interoperability; support preparedness and affected communities; and state plainly that domestic action cannot recall global copies or establish universal compliance.
Evidence limits
- Fallback measures may displace activity or create jurisdictional asymmetry.
- Export and transaction-specific consequences require legal validation.
- No universal attribution or technical recall is claimed.
Unresolved dissent
Narrow domestic action may be too weak for global diffusion yet still burden local science and competition.
Review trigger
Coordination breakthrough, displacement evidence, legal change, rights or equity impact, or cross-border incident.
Defeat condition
The fallback is defeated if it lacks jurisdictional basis, mainly displaces conduct, materially worsens equity or rights, or claims control over copies it cannot reach.
review dates
Dated and event-driven review
Policy proposal. Treat every present-tense factual and legal claim as requiring refresh before Phase-6 drafting. For this internal architecture, set an interim evidence-and-burden checkpoint for 2026-10-28 and a full architecture review for 2027-01-28, followed by reviews at least every 180 days if adopted. Corrections, incidents, legal changes, treaty status, object-identity resolution, appeal reversals, and material burden evidence trigger earlier review. These dates are proposed governance cadence choices, not evidence-derived safety thresholds.
Evidence limits
- The Phase-5 corpus remains fixed to July 28, 2026.
- Calendar review cannot substitute for event-driven correction.
- A review date does not prove that institutions will implement change.
Unresolved dissent
Six-month review may be too slow for model change and too frequent for under-resourced institutions.
Review trigger
The listed event triggers or arrival of either proposed calendar date.
Defeat condition
The cadence is defeated if material changes routinely precede review, reviews lack authority to revise measures, or recurring burden produces no correction.
Policy proposal. For hosted or otherwise provider-controlled access, prospective rollback can suspend access, remove accounts, change safeguards, or force updates subject to law and appeal. For released weights, containment is limited to prospective distribution controls, lawful notices, hash and provenance advisories, voluntary patches, compliant intermediary action, incident response, and measures against reachable actors. Licenses and remote withdrawal are not represented as reliable recall.
Evidence limits
- Mirror survival, patch uptake, and recall success are unmeasured.
- The architecture cannot erase private or foreign copies outside reachable controls.
- Legal and technical routes have different reach.
Unresolved dissent
Naming limited containment routes may create false reassurance when copies have propagated.
Review trigger
Measured patch or notice reach, mirror persistence study, incident response, provider-control change, or legal validation.
Defeat condition
A containment claim is defeated if it implies deletion or universal compliance, lacks reach to the specified actor, or shows no measured response benefit.
Policy proposal. Baseline and publish, with privacy protection: exact-object identification rate; independent evaluation coverage; correction latency; decision and appeal timing; appeal reversal rate; research-access requests, denials, and reversals; small-actor compliance cost and exit; market concentration; accessibility and geographic/language participation; incident and near-miss reporting coverage; patch/notice reach without calling it recall; audit noncompliance; cross-border interface adoption; and validated control-outcome studies. Adopt component-specific targets only after a public baseline and adversarial review; no target here is a universal safety threshold.
Evidence limits
- Observability and causality differ; counts do not by themselves establish severe-risk reduction.
- Metrics can be gamed and must retain denominator, distribution, and uncertainty.
- Privacy and security can constrain disclosure.
Unresolved dissent
Measurement can become surveillance or compliance theater and may systematically undercount excluded actors.
Review trigger
Any baseline, distributional disparity, metric gaming, privacy incident, causal evaluation, or sustained failure to collect an indicator.
Defeat condition
A component is weakened when its intended intermediate indicator fails to improve or collateral harms rise; it is defeated when repeated reviewed evidence shows no relevant benefit, unacceptable rights/equity cost, or a superior less-restrictive alternative.
Policy proposal. Presume lawful low-risk open research, local and offline use, accessibility work, small-actor experimentation, competition-enhancing interoperability, defensive security, independent evaluation, and public-interest science remain available. Increase burden only with object- and release-profile-specific evidence, actor control, consequence, and exposure; choose the least-restrictive effective option; provide research and accessibility pathways, fee relief, technical assistance, reasons, appeal, sunset, and distributional review.
Evidence limits
- The net benefit of open-weight release is not proven.
- Protected-use pathways still require narrowly tailored safety and privacy safeguards.
- Availability alone does not ensure equitable participation.
Unresolved dissent
Case-by-case pathways can reproduce discretion and inequality; categorical exemptions can be exploited.
Review trigger
Denial patterns, concentration or access metrics, safety incidents, appeal outcomes, accessibility impacts, or a less-restrictive alternative.
Defeat condition
A control is defeated if burden is not tied to actor control and supported risk, protected uses are inaccessible in practice, or a less-restrictive option supplies equal demonstrated value.