Govern who can access powerful models.

Access architecture is itself a governance control: API-only, gated, internal and open-weight releases create different residual-risk profiles.

Match authentication, rate limits, monitoring and contractual controls to risk.

Treat irreversible release as a distinct governance decision with explicit evidence and ownership.

Define abuse signals, thresholds, case handling and escalation paths.

Ensure high-risk access can be suspended quickly when controls fail or assumptions change.