Examples
Examples from published documents
- OpenAI lists "KYC and identity verification to enable traceability" and "KYC robustness to prevent a banned actor from creating new accounts at scale (recidivism)" as example safeguards (OpenAI Preparedness Framework v2, Appendix C.1)
- OpenAI's Trusted Access for Cyber is "an identity-gated access pathway that provides higher-risk dual-use cyber capabilities to enterprise customers, verified defenders, and other legitimate users" (GPT-5.6 deployment safety card, s.9.4.8.2)
Counter-examples
Not to be confused with
- Restricting which employees can reach the model weights (for example two-person approval) is weight security, recorded under security-control, not user access control.
Related terms
Related AI safety terms
Terms defined under this element that are not NIKOLAI elements themselves, each as the cited document uses it. Every term is also listed in the AI safety glossary.
- Know your customer (KYC)
- Know your customer (KYC) is verifying the identity of people or organisations before giving them access to a model, so misuse can be traced and banned users cannot simply open new accounts. OpenAI lists KYC among its trust-based access safeguards.
- Source: OpenAI Preparedness Framework v2
- Trusted access
- Trusted access is a programme that gives vetted users, such as verified security defenders or researchers, access to capabilities withheld from the general public. OpenAI's Trusted Access for Cyber is an identity-gated pathway of this kind.
- Source: GPT-5.6 deployment safety card
- Rate limiting
- Rate limiting caps how much a user or account can query a model in a period. OpenAI lists rate limits as an access condition that can vary across actors, and the EU Code cites output rate limiting against weight exfiltration.
- Source: OpenAI Preparedness Framework v2
Source of record
Where this definition comes from
OpenAI Preparedness Framework v2, Appendix C.1
“Trust-based Access: The actors who gain access to the model will not use it in a way that presents an associated risk of severe harm under our threat model.”
https://cdn.openai.com/pdf/18a02b5d-6b67-4cec-ab64-68cdfbddebcd/preparedness-framework-v2.pdfAnthropic Responsible Scaling Policy v3.4, effective 8 Jul 2026, §1, non-novel chemical/biological weapons row
“access controls for trusted users with exemptions to classifier guards”
https://cdn.sanity.io/files/4zrzovbb/website/0bacdc8440ea96e62a8766d99ebe1d4eea6d5f3a.pdf
Crosswalk
How named organisations use this concept
Every row below is a shadow mapping. A shadow row is CASRAI's own reading of a published document. No lab, evaluator or regulator named on a shadow row has declared, endorsed, or been consulted on it. That changes only when an organisation files its own Mapping Declaration.
| Organisation | Their term, as published | Match & verification | Source |
|---|---|---|---|
| OpenAIShadow mapping OpenAI Preparedness Framework v2 | “Claim "Trust-based Access"; example safeguards: "KYC and identity verification to enable traceability", "KYC robustness to prevent a banned actor from creating new accounts at scale (recidivism)", "Actor-policy standards, including bespoke usage policies that limit access to higher capabilities to trusted actors", "Access conditions including variation across actors, e.g., rate-limits, fine-tuning access, releasing weights"” | exactEQ confidence: high | OpenAI Preparedness Framework v2 |
| AnthropicShadow mapping Anthropic Responsible Scaling Policy v3.4 / Risk Report, August 2026 | “ASL-3 protections include "access controls for trusted users with exemptions to classifier guards" (RSP §1); Risk Report §6.4.1 lists "tighter customer verification, limits on ZDR deployments, closer monitoring of high-trust deployment arrangements"” | exactEQ confidence: high | Anthropic Responsible Scaling Policy v3.4, effective 8 Jul 2026 |
| Google DeepMindShadow mapping Frontier Safety Framework v3.1 | “Deployment mitigations "may include safety post-training, input/output/chain-of-thought monitoring and analysis, account moderation, jailbreak detection and patching, user verification, and bug bounties"” | closeCL confidence: medium | Google DeepMind Frontier Safety Framework v3.1 |
| EUShadow mapping EU GPAI Code of Practice, Safety and Security Chapter | “Measure 5.1 example: "staging the access to the model, e.g. by limiting API access to vetted users"” | closeCL confidence: medium | EU GPAI Code of Practice, Safety and Security Chapter |
| xAIShadow mapping Frontier AI Framework, 30 Jun 2026 | “"the full functionality of our models may be available to only a limited set of trusted parties, partners, and government agencies"” xAI's Frontier AI Framework (30 Jun 2026) carries PDF metadata reading "Privileged/Confidential DRAFT working FRAMEWORK DOC" with no xAI statement found disambiguating draft from final; the cited URL also returned HTTP 404 (NoSuchKey) on 13 Nov 2026, so the quote is verified against the local capture only. Treat as provisional. | closeCL confidence: medium | xAI Frontier AI Framework, 30 Jun 2026 |
| METRShadow mapping METR (common-elements) | “"Model Deployment Mitigations": "Access and model-level measures applied to prevent the unauthorized use of a model's dangerous capabilities."” | broadBR confidence: medium | METR (common-elements) |
What do these codes mean?
- exact
- The source term is equivalent to this element
- close
- The source term is close but not equivalent to this element
- broad
- The source term is broader than this element
- narrow
- The source term is narrower than this element
- none
- No mapping claim — used for false-friend and declared-but-undefined rows
- EQ
- Equivalent
- CL
- Close
- BR
- Source is broader than the element
- NR
- Source is narrower than the element
- FF
- False friend — same or similar label, different meaning
- DU
- Declared but undefined by the source
- UV
- Unverified
Related, not mapped
Pointers that are not crosswalk claims
These sources mention this concept but do not define or map it clearly enough to count as a crosswalk row — noted here so the research is visible without overstating it as a mapping.
- OpenAI
Actor-level enforcement ladder in the GPT-5.6 card: additional monitoring, more restrictive blocking, a prompt to apply for trusted access, restricted frontier access, then suspension or ban; "We recognize that account-level enforcement is a coarse tool in an inherently dual-use domain" (s.9.4.7). Related, not a mapping.
GPT-5.6 deployment safety card
