Restricted Distribution Is a Safety Control Separate From Model Refusal

# Restricted distribution is a safety control separate from model refusal ## Claim Restricted distribution controls who can exercise a dual-use model's capability when refusal behavior can't contain the capability itself.  ## Evidence > [!quote] > "The model will be exclusively available to governments and trusted partners via CodeMender soon as part of a limited-access pilot program." Google's Gemini 3.5 Flash Cyber launch gates the model by recipient instead of offering the cyber capability through the general model surface. ## Scope & conditions Access gating matters most when risk comes from what a model can do, not only what it will say. It narrows distribution but doesn't replace logging, contractual controls, or oversight inside the trusted group. Breaks down when the "trusted partner" gate is porous, informally defined, or expands without re-evaluating risk — access control is only as strong as the vetting behind it. Does not claim access control is sufficient on its own; Google pairs it with continued refusal-tuning work on the general-release models. ## Links - [[3. Resources/Permanent Notes/Bounded Action Spaces Not Better Models Make Agents Safe to Run]] — distribution gating bounds who receives the capability while action-space controls bound what a deployed agent may do with it - [[3. Resources/Permanent Notes/Defense in Depth Concedes Perfect Safety Is Impossible and Optimizes for Narrow Costly Monitored Failure]] — restricted access is one layer in a system that assumes no single safety mechanism is sufficient - [[3. Resources/Permanent Notes/AI Finds Exploit Chains Faster Than Humans Can Audit Them]] — the audit bottleneck explains why broad access to an exploit-finding model creates risk even when each result still needs verification - [[3. Resources/Permanent Notes/Practical Obscurity Is an Economic Property Not a Technical One]] — because contrasts: that note describes protection that erodes as an attack's cost falls; this note describes a lab deliberately keeping a capability's cost high (via access gating) specifically because it knows the underlying attack is no longer expensive. - [[3. Resources/MOCs/AI Agent Safety MOC]] — home for capability access and containment controls ## Tests / falsifiers - Track whether "trusted partner" access for Flash Cyber expands over time without published re-evaluation of vetting criteria — if it does, the access-control lever is weakening in practice. - Compare vulnerability discovery-to-patch time with and without Flash Cyber-class tooling, under both defender-only access and a simulated leaked-access condition, to measure whether the access gate is actually reducing net risk versus just relocating it. ## Source - [[3. Resources/Readwise/Articles/Introducing Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber]] — announces a limited-access pilot for the cyber-specialized model