For two years the question every board asked about AI was which model. This week the frontier answered a different question, and it is the one that will actually decide who keeps their margin: not what the model can do, but under what conditions it is allowed to do it.

Two labs made the same move within days of each other, and neither of them shipped a product.

The week the frontier stopped shipping products

On 3 September, OpenAI released its most capable model to date — and shipped it as Critical. Under the company's own Preparedness Framework, that is the top of the cyber-risk scale, the first time any model has been released carrying that classification. It went out into a deliberately restricted build that refuses cyber work, to paid tiers first, after a delay taken to construct the controls. The rating was not revised downward to permit the launch. The launch was permitted by building the envelope around it.

Days earlier, Anthropic did something structurally identical from the other direction: one underlying model, shipped behind two different safety envelopes — a general-availability deployment for the market, and a restricted deployment for vetted cyber and life-sciences users. Same weights. Different doors.

Read those two events together and the product framing collapses. Neither lab shipped a model this week in the sense the market still uses that word. Both shipped a governed access ladder — a set of gates, tiers, refusals and eligibility rules wrapped around a capability that already existed. The capability was the easy part. The envelope was the release.

And beneath the envelope, the thing everyone still argues about got dramatically cheaper. Six models from five providers landed in a matter of days. Open-weight checkpoints shipped under permissive licences at or near frontier parity. One analyst tracking the price curve — Ignacio de Gregorio — puts a fast frontier-class model at a small fraction of the cost of its nearest premium rival for a handful of points of measured capability, and draws the conclusion plainly: pricing power is moving from smarts to speed. That is his argument, not settled fact. But the direction is not in dispute by anyone.

So hold the two halves side by side, because together they are the whole shape of the market:

Raw capability is commoditising. Governed capability is being rationed. The margin has left the model and moved to the envelope around it.

The pattern is rising through every layer — and none of them is yours

Once you have the shape, you find it everywhere, and the finding is uncomfortable, because at every layer the envelope belongs to someone else.

At the frontier, the envelope is the access ladder. Which tier you are on, what the build will refuse, whether you are vetted, what the classification permits. Note what this is not: it is not a safety story you can audit. The controls are self-declared, the classification evidence is largely unpublished, and when one lab told legislators it was building an automated shutdown capability, the most generous reading offered by people watching closely was that a kill switch is a circuit breaker, not governance. A circuit breaker is a good thing to have. It is not an answer to who decides.

At the platform, the envelope is your default reasoning layer — and it has already been chosen for you. Last edition we watched one enterprise vendor make a frontier model the default across its whole stack. It is now three: ServiceNow through the winter, SAP across the portfolio in June, Salesforce across its collaboration and agent surfaces in August — still in select pilots, with an open beta scheduled. Three separate platform vendors, in eight months, have selected the reasoning substrate on behalf of every customer running their systems. All three keep multi-model support, so the lock is soft at the point of inference and hard where it actually matters — in the skills, the integrations and the accumulated configuration built on top. That distinction is the whole game, and it is worth saying in the practitioners' words: the model is replaceable; six months of accumulated working context is not.

In verification, the envelope has quietly consolidated into the party being audited. This is the sharpest of the four. Enterprises testing frontier models increasingly do it with an evaluation tool that a frontier lab acquired in March — so the auditor's instrument now belongs to the audited. Nobody broke a rule; the tool is good, the acquisition was public, the users are largely the same. But the NIST framework names evaluator independence as a control for a reason, and independence is not a property you can buy back later. Meanwhile the practitioner data says the thing nobody wants on a slide: in a mid-year survey of 573 respondents, around half had shipped an agent that passed its internal evaluations and then failed a real customer — a quarter of them more than once. Roughly two-thirds allow or are building production paths with no human review. Full trust in automated evaluation sits in the single digits, and the teams who trust most are, almost exactly, the teams who have not yet been burned. That is not a maturity curve. It is a survivorship artefact.

Add to it the finding that ought to worry any CIO planning a five-year assurance model: as the models get deeper, their reasoning is becoming less legible, not more. The audit surface is being designed out of the model. Whatever your verification strategy is in 2029, it will not be reading what the model was thinking.

And in commercial structure, the envelope has reached your P&L. The pricing conversation is moving from tokens to outcomes — pay when the work completes, and, in the direction several vendors are now openly steering, pay a share of the gain the work produces. Take the pattern seriously and leave the specific terms alone; the terms reported so far are not verified and do not need to be. The pattern by itself is enough. A share of your realised improvement is a permanent claim on your operating model, priced before the operating model can prove it earned anything. And it inherits every one of the problems above it: it requires trustworthy measurement of the gain, at exactly the moment the measurement supply chain is consolidating into the vendors, and with strong optimisers on the other side of the contract. Alex Wissner-Gross puts the risk in one line — strong optimisers are incredible reward hackers. An outcome contract without independent verification is not a fairer deal. It is an unaudited one.

Four envelopes. Frontier, platform, verification, price. Every one of them being built with genuine engineering seriousness, and every one of them owned, governed and sunset by somebody who is not you.

The one envelope nobody is building for the buyer

Here is the turn, and it is not a complaint about vendors.

The reason none of them is building the buyer's envelope is not conspiracy. It is that the buyer's envelope has no vendor margin in it. It is made of your processes, your data, your decision rights, your instrumentation and your people. Nobody can sell it to you as a SKU, which is precisely why nobody will.

And the burning platform for building it is not at the frontier at all. It is two much older, much duller facts, and both of them arrived this fortnight from people with no interest in our argument.

The first is from a finance practitioner, writing to other CFOs, in language a Way Pointer would not have dared use: "You cannot transform a shitshow. You have to repair it first." The named failure mode is transformation that skips repair, and the result is shiny packaging wrapped around broken finance. The sequencing line underneath it is the one to write down: accuracy is the first foundation of finance, not automation. Every organisation putting an outcome-priced agent over a process whose numbers it does not trust is about to discover that automation is a multiplier with no opinion about sign.

The second is a diagnostic, from Salim Ismail: "If you took AI out of your organisation today, would any workflow change?" For most organisations, he argues, the honest answer is no — the spend is real, the pilots are real, the demos are real, and nothing structural has moved. This is testimony, not measurement, and we carry it as such. But it is the cheapest audit in this entire essay, it takes four minutes in a leadership meeting, and the answer is usually known before anyone speaks.

Put those two beside the four envelopes and the position clarifies. If the answer to Salim's question is no, you have no envelope to protect and nothing yet to price — and the correct response to an outcome-based offer is not to negotiate the percentage. It is to repair the thing being measured. If the answer is yes, then you have something real, and every layer above it is now organised to capture it.

There is a version of the future being marketed right now that makes this concrete. One of the more compelling proposals in circulation — Salim Ismail's — is to build a digital twin of your organisation at the edge and move your workflows onto it. It is a genuinely good idea with one clause conspicuously unstated: who owns the twin. A twin you do not own, holding workflows you have already moved, sitting under a contract that takes a share of the improvement, is not a modernisation. It is the lock-in its own advocates warn about, arriving in the shape of a gift.

What a client-owned control envelope actually is

So build the one nobody sells. It has three parts, and none of them is a purchase.

An instrumented, repaired operating model. Repair precedes transformation — not as a virtue, as a sequence. Know which processes are accurate before you make them fast. Name the operating model you actually run, in enough detail that a change to it can be described, dated and measured. This is the substrate the envelope is built on, and it is the only layer in this entire essay that cannot be rented, because it is not a product. It is your organisation, written down honestly enough to be governed.

A human-decision layer that is explicit about what it has delegated. The most useful governance framing of the fortnight is the distinction between humans in the loop and humans in command. In the loop is a position on an org chart; in command is a set of answered questions. What may an AI decide without a human? Up to what spend? With what access? What triggers escalation? And the one everybody skips: what is reversible, and what is not? Answer those five and you have a risk budget — an actual instrument, with limits you can raise deliberately as evidence accumulates. Leave them unanswered and you have step-approval theatre: humans clicking through decisions they have no practical means of evaluating, generating review debt that will be discovered, as one security executive put it in a finance newsletter this week, the failure shows up not in real time, but at audit.

Independent verification you own. Not the vendor's benchmark, which is a marketing asset. Not certification, which attests conformance rather than performance. Not, increasingly, the market's default evaluation tooling, whose independence is now a live question. Write down what good looks like — in production, in your terms, on your data — before the system performs, and measure it on a stated cadence afterwards. If you are going to sign an outcome-linked contract, this stops being good practice and becomes the contract's only defence: the party paying a share of the gain must be the party that can prove the gain, independently, or the number in the contract is whatever the counterparty's optimiser says it is.

Instrument, decide, verify. That is the envelope. It is unglamorous, it has no launch event, and it is the only one of the five described in this essay that appreciates rather than decays.

Your waypoint

One exercise for your next leadership meeting. Do the four in order and do not skip the first.

Ask Salim's question first: if we removed AI from this organisation tomorrow, would any workflow actually change? Take the honest answer, not the sponsored one.

Then, whatever the answer, draw the four envelopes above you and put a name in each: who governs our access at the frontier, who chose our default reasoning layer, who owns the tool we verify with, and who is proposing to price against our results. Four names. If any of them is a blank, that is not an absence of risk — it is an absence of ownership.

Then ask the one that matters: what is inside our own envelope, who wrote it down, and on what cadence do we check it still holds? If the honest answer is that our processes are unrepaired, our decision rights are unstated and our verification belongs to a supplier, then we do not have a control envelope. We have four of somebody else's.

Capability is on its way to being a commodity; it got cheaper again this week and will get cheaper again next. Governance is what is being rationed, and every layer of the stack is racing to sell you theirs. Repair what is broken, instrument what remains, state what a human must still decide, and verify it with something you own. Everything above that line is rentable, decaying, or quietly negotiating for a share of your margin. The envelope beneath it is the only one that is yours — and owning it is the same thing as owning the capacity to change.