# Access Is Not Authority

A badge opens a door. Whether an unwelcome finding can hold that door open is a different question.

Volume 48 · Edition 1 · 2026-09-14

Category: B · Artificial Intelligence (https://www.thierry-gilgen-ict.ch/library/artificial-intelligence)

Canonical: https://www.thierry-gilgen-ict.ch/field-notes/access-is-not-authority

A company badge opens a door. Whether an unwelcome finding can hold that door open is a different question.

The badge appears in Dario Amodei’s proposal of 12 September 2026, alongside a desk and a company laptop. Anthropic commits to bringing independent evaluators inside the laboratory, with access broadly comparable to its internal risk teams. The promise includes publication without Anthropic’s editorial control, limited redactions and the right to say when a redaction has removed something important to a conclusion.[^B1][^B2]

These are proposed working arrangements, not evidence that the full programme is already operating. They are nevertheless more substantial than an invitation to inspect a finished model. Sam Altman said the same day that OpenAI would also give independent evaluators employee-like access. Demis Hassabis endorsed the direction, while leaving the details to be worked through.[^B2][^B3]

The useful question begins after the welcome. An evaluator sees something the laboratory would prefer to investigate after its next release. The evaluator believes the release should wait. Both positions may be sincerely held. What happens next?

## Inside the laboratory

Access can change the quality of a question. A reviewer working from a public report can ask why an incident was omitted. A reviewer able to examine the underlying work may discover that the incident never entered the reporting process at all. Those are different problems, requiring different remedies.

The value of an embedded team would lie partly in such ordinary inconsistencies. A monitoring system may cover the released product but miss a research environment. A safety claim may depend on a configuration that has since changed. A successful test may be repeatable only with settings that the deployment team no longer uses. These are illustrative failure modes, not allegations about a particular laboratory.

Finding them requires more than a powerful model endpoint. It requires a way to trace a claim back to the system that produced it. The reviewer needs to know which version ran, under which permissions, with what monitoring and against which test. The work must remain inspectable when the team changes the model or rebuilds the environment.

An evaluator can also learn from conversations that do not fit neatly into a report. An engineer may know that a safeguard works except during one kind of restart. Another may know why a seemingly reassuring measurement excludes a troublesome class of runs. Proximity can make these details visible. It is a serious reason to welcome access rather than dismiss it because the host has commercial interests.

But a contract must make that access durable. A disputed request should produce a recorded refusal and a reason, not disappear into an unanswered message. Necessary privacy restrictions should lead to a workable alternative where possible. Otherwise the reviewer can be present throughout the year and still receive only the evidence that the laboratory finds convenient to supply.

## A useful precedent, with a boundary

There is already a concrete example of deeper external scrutiny. METR and Redwood researchers spent six days on OpenAI premises investigating the Hugging Face incident. Their report, published on 26 August, described substantial access to records and staff. They took no payment for the assessment, although OpenAI supplied computational resources. The report also stated its limits: earlier training incidents, the effectiveness of safeguards, the laboratory’s investigation process and planned remediation were outside scope.[^B4]

That is valuable work. It is also a bounded investigation, not an audit of everything the public might reasonably want to know. A laboratory can cooperate generously within an agreed scope while questions beyond that scope remain unanswered. Neither fact cancels the other.

The report made its redaction arrangements visible. OpenAI could redact non-public information; the researchers included a statement about whether important information had been withheld beyond the redactions described. They also disclosed that the company had provided other feedback which led to edits.[^B4]

The lesson is to preserve those boundaries in the public record. An independent report should say what it examined, what it could not examine and who controlled those limits. Its existence should not become a transferable certificate attached to every later model or every claim made by the host.

Ongoing access could improve on a short investigation. It should also make changes of scope more visible. A reviewer who discovers a related failure should have a route to follow it, or to record that the route was denied. Independence includes the ability to identify a question the original engagement did not anticipate.

## The banking analogy has an employer

Amodei points to embedded banking supervisors as a precedent.[^B1] The comparison is useful, provided the badge is not mistaken for the institution behind it.

The Federal Reserve’s documented large-bank supervisory model combines firm-specific teams with oversight beyond the individual bank. Those teams develop detailed knowledge and recommend findings, ratings and enforcement action through a supervisory chain. Its published arrangements also provide for rotating team leadership to support independence.[^B5]

The bank does not become the supervisor’s principal simply because the supervisor spends time understanding its business. The route from observation to consequence belongs to an institution outside the bank. Nor does every examiner acquire an unlimited personal power to stop any activity. Authority is allocated through a process, with responsibilities above the person who first sees the problem.

Public reporting is not a feature that transfers automatically. The Federal Reserve’s June 2026 report describes supervisory ratings as confidential. A system can therefore combine strong access and escalation with restricted public disclosure.[^B6] An AI evaluator’s right to publish must be established on its own terms. Borrowing the banking metaphor does not supply it.

For readers in Basel, the underlying concern is familiar. FINMA’s AI guidance places governance and risk management within the responsibilities of the institutions it supervises.[^B7] That is a limited analogy, not a proposal to treat FINMA as a frontier-laboratory regulator. The useful principle is that technical advice should inform the organisation’s responsibility, not become a way for management to pass it elsewhere.

An evaluator should not absorb the laboratory’s liability by occupying a desk. Equally, the laboratory should not be able to point at the evaluator’s presence as a defence against an incident the evaluator was unable to investigate. The contract must distinguish the work commissioned from assurances that nobody actually gave. The eventual legal allocation would still depend on the relevant law and agreement.

## A finding needs a route out

Publication rights deserve credit. A critical report can change a board’s decision, alert an affected service or give a regulator grounds to investigate. Public criticism is a real source of pressure. It need not be dismissed simply because the reviewer lacks a formal veto.

It is less reliable as an emergency control. A report published after a run has reached outside infrastructure cannot undo the intervening actions. A document waiting for a redaction dispute to end cannot serve as a timely warning. Effective oversight needs a route for urgent action as well as a route for eventual explanation.

Confidentiality has legitimate purposes here. Publishing an unpatched exploit could make an incident worse. Customer data should not become the price of external scrutiny. Legally privileged information raises its own constraints. The design task is to separate the sensitive detail from the finding and from the warning that somebody needs to receive.

Commercial sensitivity is harder to contain because an unfavourable conclusion may itself be commercially costly. A contract should prevent that cost from becoming a reason to suppress the conclusion. The reviewer should be able to publish a useful account without exposing the precise detail that creates a genuine security risk.

A redaction dispute therefore needs an expiry time and an independent route for resolution. The parties should agree in advance what can be withheld temporarily, who can inspect the unredacted evidence and when an affected operator must be told. A visible record of unresolved restrictions would be better than an indefinitely delayed report bearing no sign of the disagreement.

There should also be protection against retaliation through access. A reviewer who raises a serious concern must not lose the data needed to investigate it because the engagement suddenly becomes inconvenient. Removal may sometimes be justified, including for misconduct or a security breach. It should be reviewable, and it should not silently erase the findings already made.

## Who can move the date

An independent team does not need unrestricted control of a company. It does need a defined consequence when it finds evidence that crosses an agreed safety threshold.

One workable arrangement would allow a documented concern to trigger a temporary hold on the relevant activity. A separate decision-maker would then review the evidence within a stated period. The laboratory could challenge an error. The reviewer could contest an override. The decision to resume would identify the person accepting responsibility and the evidence supporting that decision.

This is a proposed design, not a power established by the September announcements. The hold should be proportionate: a particular tool, experiment or deployment may need to stop without freezing everything the laboratory does. Open-ended powers with vague triggers would be vulnerable to mistakes and abuse of their own.

The important change is that disagreement would have an operational consequence before it became a communications exercise. A company could no longer satisfy the arrangement merely by hearing the objection and continuing on the original timetable. Equally, an evaluator could not turn a suspicion into an indefinite prohibition without defending it.

Funding needs the same discipline. A reviewer dependent on the next renewal may hesitate to become difficult. Pooled funding or independent appointments could reduce that pressure, but neither is sufficient by itself. The terms should protect the ability to finish and publish an adverse investigation. A second team able to challenge the first team’s conclusions would help prevent the supervisor’s own confidence from becoming another untested dependency.

The people affected outside the laboratory need a place in this process. A registry operator with evidence of unwanted activity should be able to submit it directly, obtain an acknowledgement and learn whether it has been considered. Otherwise permanent internal scrutiny could still miss the failures that matter most to those maintaining the services around it.

## A standards body must inherit more than the name

Hassabis’s July proposal takes a different route. It envisages a US standards body, substantially funded by industry and federally overseen, drawing on the FINRA model. Initially, laboratories would voluntarily provide frontier models for review up to 30 days before release. Successful assessments could later become a condition of deployment in the US market.[^B8]

That advance review is not the same as continuous access to training operations. Nor is “up to 30 days before release” an automatic 30-day suspension. A standards body might provide common tests and a route towards enforceable conditions. Embedded reviewers might establish whether a laboratory follows those conditions between assessments. The two could complement one another, but neither acquires the other’s powers by analogy.

FINRA itself supervises member broker-dealers under federal law and SEC oversight. It is not simply a club issuing optional advice: its sanctions include fines, suspensions and bars.[^B9][^B10] An AI body borrowing that name would need an explicit basis for its own authority, including review and appeal. Industry funding alone supplies none of those things.

Coordination raises a separate issue. Amodei’s wider plan moves from embedded evaluation to standards and pacing among laboratories in democratic countries, then towards more limited global agreements. It also seeks government help with competition-law constraints and supports regulation.[^B1]

There is a useful historical warning against treating every safety discussion as prohibited. In 2014, US competition agencies explained that properly designed sharing of cyber-threat information was unlikely to raise antitrust concerns.[^B11] That precedent is not a blanket exemption for rivals agreeing how fast to develop or release products. A lawful route for the latter needs separate work. In the meantime, a laboratory can grant outside scrutiny of its own operations without waiting for every competitor to agree on a common pace.

The badge is still worth issuing. A desk inside the laboratory could produce better questions and earlier warnings than a report assembled after the work is done. The mistake would be to photograph the desk and treat the institutional work as complete.

The next evidence to look for is an uncomfortable decision that the arrangement actually changed. The record should show what the reviewer found, who had to answer and what happened to the activity in question. A delay alone would not prove success; the response must address the risk that justified it.

Pace becomes a governance outcome when unwelcome evidence can change it. Until then, it remains a date the laboratory chooses.

## Sources

[^B1]: Dario Amodei, “We Must Pace the Frontier”, September 2026; released 12 September according to contemporaneous reporting. Primary proposal, not proof of implemented contractual terms. [Source](https://darioamodei.com/post/we-must-pace-the-frontier)

[^B2]: Reuters, “Anthropic CEO urges AI companies to slow model development amid fears over misuse”, 12 September 2026. Corroborates the announcement date and Altman’s employee-like-access commitment. [Source](https://www.reuters.com/business/anthropic-ceo-urges-ai-companies-slow-model-development-2026-09-12/)

[^B3]: Ben Berkowitz / Axios, “AI’s most powerful CEOs hit the brakes”, 13 September 2026. Used narrowly for Hassabis’s 12 September endorsement; original X post could not be fetched directly. [Source](https://www.axios.com/2026/09/13/ai-labs-regulation-safety)

[^B4]: Ryan Greenblatt, Ajeya Cotra and Hjalmar Wijk / METR, “Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident”, 26 August 2026. [Source](https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/)

[^B5]: Federal Reserve, “Large Institution Supervision Coordinating Committee”, updated 17 January 2024. Used as a documented supervisory precedent, not as an assertion that every programme label remains unchanged in 2026. [Source](https://www.federalreserve.gov/supervisionreg/large-institution-supervision.htm)

[^B6]: Federal Reserve, “Supervisory Developments”, June 2026 Supervision and Regulation Report. Current cross-check for monitoring, ratings and confidentiality. [Source](https://www.federalreserve.gov/publications/2026-june-supervision-and-regulation-report-supervisory-developments.htm)

[^B7]: FINMA, “FINMA guidance on governance and risk management when using artificial intelligence”, 18 December 2024. Limited financial-supervision analogy. [Source](https://www.finma.ch/en/news/2024/12/20241218-mm-finma-am-08-24/)

[^B8]: Demis Hassabis, “A Framework for Frontier AI and the Dawning of a New Age”, 14 July 2026. A proposal, not an enacted US regulatory body. [Source](https://demishassabis.substack.com/p/a-framework-for-frontier-ai-and-the-dawning-of-a-new-age)

[^B9]: FINRA, “About FINRA”, accessed 14 September 2026. Federal-law basis, SEC oversight, member funding and broker-dealer remit. [Source](https://www.finra.org/about)

[^B10]: FINRA, “Enforcement”, accessed 14 September 2026. Disciplinary procedures and sanctions. [Source](https://www.finra.org/rules-guidance/enforcement)

[^B11]: Federal Trade Commission / Department of Justice, “FTC, DOJ Issue Antitrust Policy Statement on Sharing Cybersecurity Information”, April 2014. Historical, bounded precedent; not an AI pacing exemption. [Source](https://www.ftc.gov/news-events/news/press-releases/2014/04/ftc-doj-issue-antitrust-policy-statement-sharing-cybersecurity-information)

## Connected reading
- [AI strategy without operational ownership is theatre](https://www.thierry-gilgen-ict.ch/field-notes/ai-strategy-without-operational-ownership-is-theatre)
- [Sovereignty Is Measured in Response Time](https://www.thierry-gilgen-ict.ch/field-notes/sovereignty-is-measured-in-response-time)
- [Incident Ownership Without a Principal](https://www.thierry-gilgen-ict.ch/field-notes/incident-ownership-without-a-principal)