Who Authorises the Release: Pre-Release Review, Staged Access and the Permission Gap in Enterprise AI

A frontier model reaches the public on a Thursday because a government cleared a broader launch. An agent posts a payment because nothing in the application said it could not.

Both are authorisation decisions. Only one of them is usually written down.

What could and could not be verified this week

No development dated within this edition's 36-hour reporting window could be verified. What follows is analysis of documented material published between 7 July and 28 October 2026, and it is labelled that way rather than dressed up as same-day news.

Four retrievable sources carry the factual weight: three Reuters items and one Microsoft engineering post. None is an independent audit of any model or platform.

July: a launch that waited for a clearance

Reuters reported on 7 July that OpenAI would publicly launch GPT-5.6 on the Thursday, after delaying the release at the request of the US government over national security concerns about misuse of powerful AI. The launch covered GPT-5.6 Sol, described as the most capable model, alongside lower-cost Terra and Luna variants.

Three details matter more than the model names.

First, access had been limited to a small group of vetted partners whose details were shared with the authorities. That is a staged rollout, not general availability, and the distinction is worth holding onto when a vendor's marketing arrives.

Second, Reuters attributed the broad-launch approval to Axios, which reported that the administration approved it after additional testing and meetings between the company and officials. The White House and the Commerce Department did not respond to Reuters' request for comment.

Third, the mechanism is voluntary. Reuters noted that an executive order had established a framework under which developers could provide \"covered frontier models\" to the US government for up to 30 days before releasing them to trusted partners.

Voluntary and pre-release is an unusual combination, and it creates an unusual buying problem. A model can be cleared for a subset of users without being cleared for yours.

June: when the switch went the other way

The same Reuters report documents the opposite motion. Anthropic abruptly disabled its most advanced models, Mythos 5 and Fable 5, for all users after a 12 June US export control order. The curbs were lifted in the days before that report, after Anthropic implemented certain safeguards.

Mythos did not come back on the same terms. The model, designed for cybersecurity professionals, remained available only to some trusted US organisations.

Read that sequence carefully. A working capability was withdrawn from general access, then partially restored on a different basis, within a few weeks. Any architecture that assumed permanent access to a specific frontier model was making an assumption nobody had guaranteed.

Reuters also records Anthropic's own statement that it was \"probably impossible\" to make any AI model fully robust against jailbreaks. That is a vendor describing its own product, and it is a useful calibration for anyone drafting an assurance clause.

August: the open-weight hedge, and what it leaves uncovered

By mid-August the market had responded. Reuters reported that Meta would resume releasing open models, including a version of its most powerful, and that Nvidia had released a small open system while developing a larger one intended to rival leading open-weight models.

Data from the fintech provider Ramp, released that week, showed about 6.1% of businesses spending on AI used platforms offering open-weight and Chinese-developed models in July, up from 4.5% a year earlier. Ramp's lead economist told Reuters the trend had not yet dented spending on OpenAI and Anthropic, but that their adoption was slowing.

The appeal of open weights is easy to state. A model you can run on infrastructure you control is harder for a supplier — or a government — to withdraw.

Reuters Breakingviews made the counter-argument on 30 July, in a commentary column rather than a news report: that open weights are an incomplete hedge, partly because the leading open models are largely developed outside the United States, and users cannot assume future updates or restriction measures remain politically neutral. The column also flagged that hidden security risk can surface after deployment for models that generate and execute code.

Both points hold. Open weights change who can withdraw a capability. They do not answer who authorised the action it takes.

October: the vendor draws the same line

Microsoft's 28 October post on the Copilot harness states the division plainly: \"Microsoft runs the agent loop and sandbox, with governance and optimization built in from day one. You bring the instructions, skills, tools, and model choice.\"

The same post describes the harness as everything around the model — the orchestration layer supplying instructions, context, execution environment and controls.

Put that beside the July reporting and a pattern emerges across two different levels. At the model level, a government may gate a release and a vendor may stage access. At the action level, the customer supplies the tools and decides what those tools are reachable from.

Neither vendor is being evasive. This is simply what delegated authority looks like when it is described accurately — and it is the reason \"the model is approved\" is not an answer to a risk committee's question.

The permission gap nobody writes a ticket for

Consider, illustratively, an accounts-payable agent. It reads a supplier email, matches it to an invoice, and can either draft a payment run or submit one.

Drafting is reversible. Submitting is not. Nothing about the model decides which of those it is holding — the application decided that when someone registered the tool.

That is the gap. Release governance is now documented, debated and in some cases government-reviewed. Action governance is frequently a configuration file that nobody outside the build team has read.

The commercial consequence is not abstract. A supplier that withdraws a model, or a workflow that executes an irreversible step without a named approver, produces the same business outcome: an operation that stops, and an incident review that cannot reconstruct why.

What remains unknown

• No audit results. None of the sources reviewed publishes independent measurement of how any model behaves under adversarial input in a customer's own environment.
• No participant list. Which developers have used the voluntary 30-day pre-release framework, and for which models, was not established.
• No withdrawal terms. Whether enterprise customers would receive notice before a model was restricted was not established from any source reviewed.
• No vendor implementation data. Whether any specific agent platform classifies actions by reversibility was not established here.

Six questions to put to a model or agent supplier

• Access basis. Is this capability generally available, staged, or restricted by geography or customer type — and can you say which?
• Withdrawal notice. What notice do we receive if the capability is restricted, and what happens to work already in flight?
• Action classification. Which tool calls are irreversible, and who signed off on that list?
• Untrusted content boundary. Which steps can read external content, and which tools are reachable from them?
• Approval record. Who accepts an irreversible action, on what evidence, and is that record retrievable months later?
• Exit path. If we switch model or provider, what breaks — the workflow, the permission, or the audit trail?

The fourth is the one most suppliers cannot answer today, and the one that decides whether an incident review is possible at all.

A phased plan that produces evidence

• Phase zero, inventory the dependencies. List every model, endpoint and tool the workflow calls, and mark which are single-source. Then count them.
• Phase one, classify the actions. Sort each tool by reversibility and by whether it can be reached from a step that ingests outside content.
• Phase two, test one withdrawal. Simulate loss of one model or one tool and observe what the workflow does. Test the failure, not the intention.
• Phase three, publish the approval record. Name the approver for each irreversible action, and review it whenever the model or the tool list changes.

Four indicators worth baselining

Single-source exposure: the share of workflow steps that depend on one model or provider. Classification coverage: the share of exposed tools with a documented reversibility class. Confirmation rate: the share of irreversible actions that reached a named approver before execution. Reconstruction time: minutes needed to attribute one historical action to a person and a permission.

Baseline all four on one workflow. An improvement claim built from your own before-and-after is defensible. A vendor's assurance language is not.

Evidence notes and limits

Evidence was reviewed through 16:00 UTC on 1 November 2026. No development dated inside the edition's 36-hour window could be verified, so this article presents analysis of earlier documented material and says so rather than implying recency.

Four sources support the factual claims above: a Reuters report dated 7 July 2026 on the GPT-5.6 launch and the earlier Anthropic restrictions; a Reuters report dated 12 August 2026 on open-weight model releases and the Ramp adoption data; a Reuters Breakingviews commentary column dated 30 July 2026, which is opinion and is labelled as such; and Microsoft's Copilot harness post of 28 October 2026.

All four are news organisations reporting or vendors describing their own products. None is an independent evaluation. The Breakingviews column is commentary, not reporting, and is treated accordingly.

Earlier drafts of this article relied on OpenAI documentation that could not be retrieved for verification. Those claims and their source links have been removed rather than restated. No replacement facts were invented to fill the gap.

No benchmarks, adoption rates, financial results, customer outcomes or stock movements are independently established here. The supplier questions, phased plan and indicators are analysis and suggested method, not a tested protocol.