An access rule should have a reason. It should say what harm it is meant to reduce, how it is expected to work, and what it prevents other people from doing.
This sounds simple. In practice, debates about AI often compress several decisions into one: open the model or keep it closed. That leaves too much out. Access to a chat interface, access for independent testing, access to model weights and permission to connect a system to sensitive tools are different choices. Each changes what a person can do and what a provider can still control.
We should ask about the particular access being granted or withheld. An institution cannot make a sound choice by attaching one broad label and assuming the rest follows.
What exactly is open?
Model weights are a large set of numbers adjusted during training that help determine the model’s outputs. Obtaining them can let someone run a model on equipment they control, subject to the license and their technical resources. It does not necessarily give them the training code, adequate information about the training data, or the right to modify and distribute the result.
The Open Source Initiative’s definition requires more than downloadable weights. It includes freedoms to use, study, change and share the system, together with the materials its standard considers necessary for modification. These include code, parameters and detailed training-data information. The definition does not require unconditional publication of every training example. It is a stated standard, not proof that a release is safe or that everyone can afford to use it. Open Source AI Definition 1.0
This brief uses open-weight when weight access is the relevant fact. A claim of open source needs to be checked against the actual license and released materials. Even then, another question remains: can the intended user exercise those rights?
A small team may have legal permission to modify a model but lack equipment and support. A researcher may have equipment but lack records needed to reproduce a result. A public office may be able to run a model independently but lack staff who can maintain it. A right and the ability to use it are related, but they are not identical.
The same care applies to closed systems. A provider can offer independent researchers controlled access to evidence without releasing every part publicly. Whether that access is adequate depends on what can be tested, what information is available, whether findings can be reported, and whether the provider can prevent inconvenient work.
Follow the path from capability to harm
The International AI Safety Report 2026 describes both benefits and risks of weight release. It can support independent study, adaptation and private hosting. Once weights spread, however, the original provider cannot ensure that every copy is monitored, recalled or patched. Closed systems can also leak. The report distinguishes releasing a model from deploying it with tools and permissions. It does not establish that either release form is safe in every setting. International AI Safety Report 2026
An assessment should follow the path from ability to outcome. What can the system do? Who gains access? What other knowledge, tools and resources do they need? What defenses exist? What happens when something goes wrong?
For example, a system that suggests text has different powers from one allowed to make changes in an important database. The model may be the same. The surrounding permissions change what an error can cause. Restricting those permissions can therefore be part of a safety plan even when access to the model itself remains broad.
This does not make model capability irrelevant. A more capable system may make some harmful tasks easier. But an assessment that stops at a benchmark score misses the practical conditions needed to turn that ability into an outcome. It also misses ways to reduce harm at other points in the process.
Sayash Kapoor and colleagues proposed a counterfactual approach in their 2024 work on open foundation models: ask what additional capability a release gives an actor compared with the tools already available. Their argument is useful as a method. Its early evidence gaps are not a permanent assurance that releases cause no extra risk. The comparison must be updated as models and defenses change. On the Societal Impact of Open Foundation Models
There are two errors to avoid. One is to count every imaginable misuse as a demonstrated consequence of a particular release. The other is to treat the absence of a measured consequence as proof of safety. A careful decision can acknowledge uncertainty and still act. It should explain the size and seriousness of the concern, the available evidence, and why the chosen restriction is proportionate.
Evidence can cut both ways
Research on safeguards offers a good example of why a single reassuring or alarming result is insufficient.
A 2026 preprint, a publicly shared research draft, by Kevin Kuo, Virginia Smith and Chhavi Yadav tested defenses intended to remain effective when open-weight models are modified. In the models and benchmarks they studied, defenses that worked under some tests remained vulnerable under others. The study also found tradeoffs with ordinary performance. These are controlled results on relatively small models, using benchmark judgments. They are not measured rates of real-world harm, and they do not establish that all safeguards fail equally. Open-Weight LLM Fine-Tuning Defenses
Other research gives reason to continue developing defenses. Kyle O’Brien and colleagues studied whether filtering selected material during training could make models more resistant to later harmful modification. Their controlled model comparisons found improved resistance on the tested knowledge measures. Yet the models could still use relevant information supplied in the question or other material given to them. The models, domain and tests were limited, so the result is neither a general guarantee nor evidence that such work is pointless. Deep Ignorance
Taken together, these findings support a demanding but workable position: test defenses against several kinds of failure, report what the tests do not cover, and examine the deployed system as well as the underlying model. A promising result should guide the next test. It should not end scrutiny.
The assessment also needs a response plan. Who can receive a report? Who can investigate it? Who can change a deployed system? If copies are operated by many people, how will useful fixes reach them? If one provider controls the service, who can check whether it acted on the warning?
Those questions apply to both open and closed arrangements. Broad access can help people find problems while making coordinated repair harder. Central control can make updates easier while concentrating the power to decide which problems matter. The choice involves institutions as well as code.
A human checkpoint has to do something
It is tempting to solve uncertainty by requiring a human to approve every result. That can be sensible, but only if the person has the information, time and authority needed to make a real judgment.
Michelle Vaccaro, Abdullah Almaatouq and Thomas Malone reviewed 106 experiments on human–AI combinations. On average, combinations did better than humans alone, but worse than the better performer among the human and AI used separately. Results varied by task. The evidence came from experiments conducted before mid-2023, with different designs and outcomes. It shows why adding a human is not, by itself, evidence that performance improves. It does not settle questions of rights or legal accountability. When combinations of humans and AI are useful
A person can be responsible for a decision even when a machine performs one part more accurately. Responsibility includes hearing context, explaining a choice and correcting an outcome. Those duties should not be confused with the claim that a human will always spot a model’s mistake.
For a review step to be meaningful, the reviewer should know what to check and when to disagree. They need access to the underlying case, rather than only the model’s confident summary. The process must allow enough time for review. And someone must check whether disagreement is possible in practice, including whether staff are penalized for slowing a queue.
These are design proposals. Their effectiveness should be measured in the setting where they are used. Counting the number of approvals does not tell us how much checking occurred.
Match the rule to the decision
An access policy can have several layers. Public information can explain the system’s purpose and limits. Qualified researchers can receive access needed for independent testing. Users can receive the freedom to move their records or operate an appropriate model themselves. High-consequence actions can require narrow permissions, added safeguards and review.
Different systems need different combinations of these arrangements. A research tool used with public data calls for different precautions from a system used to make decisions about someone’s essential services. A rule should be linked to the use and the risk it is meant to address.
It should also be reviewable. The evidence may change. A safeguard may improve; a new capability may create a concern the earlier assessment missed. An access restriction that once made sense may become unnecessarily broad. A permissive rule may become inadequate. Set out who can reopen the decision and what evidence will be considered.
There is a public-interest test for restrictions as well as releases. Does the rule reduce a named risk? Is there a less burdensome way to obtain similar protection? Does it block independent scrutiny or make smaller groups depend more heavily on the same providers? Can those affected challenge an unfair denial of access?
We should not assume that every restriction is a bid for control. Nor should we assume that every invocation of safety justifies the restriction attached to it. Ask for the mechanism, the evidence and the alternatives.
An open future is one in which useful possibilities remain available and harmful choices can be corrected. That requires the freedom to build, the capacity to inspect and the ability to impose justified limits. The hard work is deciding how those powers fit a particular problem, then checking whether the arrangement works.