Permission you can take back
Most safety around a model happens after the fact: the model produces something, and a filter downstream decides whether to allow it. We think that is the wrong place to stand. Safety can live earlier, in what a system is permitted to do at all, rather than in what it is stopped from saying once it has already said it.
The idea is a licence for a capability. Instead of trusting a component because of what it is, you grant it a specific, bounded permission to do a specific thing, for a limited time, and you can take that permission back. Once revoked, the next attempt to use the capability is refused. Safety becomes a property you hold and can withdraw, not a judgement made after the output exists.
We have now built this and demonstrated it on real model capabilities, not a stand-in. A capability, a model adapter, is stored encrypted; loading it is a decryption that only happens under a live licence; and when the licence is revoked, the decryption key is destroyed. At that point the capability is not merely blocked, it is gone. On a real inference engine and a real adapter, a licensed capability loads and produces its trained behaviour; revoke it and the next load is refused; destroy the key and the encrypted weights, including a copy someone has already taken, can never be decrypted again. The escaped copy is useless.
This turns two of the hardest problems in the field from arguments into properties. The off-switch problem, stopping a system that has reason not to be stopped when other things depend on it, becomes a key you destroy. And the fear of a model that copies itself and runs free stops being prevent the copy, which no one can reliably do, and becomes the copy cannot run: its capabilities are encrypted, and the licence that would decrypt them is gone. Outputs are protected the same way; revoke the licence and what was produced under it becomes unrecoverable. High-risk actions require a human in the loop, structurally: a valid licence alone will not run them.
We are precise about what this is and is not. It protects a capability at rest and gates its use; it does not yet keep the weights unreadable to a privileged host while they are running, which needs a hardware secure enclave, designed and interface-ready but not yet built. Encrypting a capability from the moment it is trained, so it is never written in the clear, is the same kind of next step. These are named on purpose: a claim about trust is only worth the honesty about its edges.
This lives today in a research build, not in production; production is still the deny-by-default role gate below. If you build inference systems, work on AI safety and control, or care about granting a model a capability and actually taking it back, we would like to talk.