On Governance at the Substrate Level

The visible governance conversation operates almost entirely at the deployment layer. Model cards describe what was released. API gating restricts who can call the model. Refusal training narrows the surface of what the model will say. Audits inspect what a deployed model does in response to a battery of probes. All of these are downstream of the decisions that actually shape model behavior, and the gap between where governance is operating and where capability is being shaped is the central problem the field has not addressed.

This paper makes three arguments. First: the deployment-layer governance stack, taken at face value, is mostly cosmetic. Second: the real governance lever is the substrate, by which is meant pre-training data composition, the evaluations that gate releases, and the architectural commitments that lock in path-dependent behaviors. Third: there are three specific upstream interventions that would move the field more than any combination of current deployment-layer policy, and the absence of frameworks for any of them is one of the largest unaddressed failure modes in current AI governance.

The case against the current paradigm is not that the deployment-layer stack is bad or harmful. It is that the deployment-layer stack is operating on a layer of the system that does not determine the outcome, and the policy effort being invested in that layer is producing returns that look productive in the moment and accomplish less than the effort suggests. The case for the upstream paradigm is that the leverage is structurally located there and the frameworks to operate there can be built but do not yet exist. The transition from the current paradigm to the upstream paradigm is the policy work the field most needs and is least doing.

The deployment-layer critique

A model card describes a snapshot. It is useful for documentation and accountability after the fact, but the behaviors it describes were already decided by the time the model card was written. The deployment layer cannot influence those decisions; it can only describe them.

API gating raises the cost of access. It does nothing to the underlying capability of the model. A capability gated behind an API can be replicated by a competent adversary with a smaller model and a determined fine-tuning pass. The gate is not at the capability; it is at the cost of accessing the capability.

Refusal training adds a thin gate between the user and the underlying capability. The capability is still present in the model. Jailbreaks reach it. The gate is structurally reversible. The reason the gate works at all is that most users do not try to circumvent it, not that the capability is not there to be reached.

Audits operate on the surface that the deployment layer exposes. They cannot probe the priors that the pre-training corpus installed. They cannot examine the architectural commitments that determine which capabilities will emerge under scale. They cannot inspect the synthetic data composition decisions that shaped the model's prior toward or away from particular behaviors.

None of this means the deployment-layer governance stack is useless. It means it is not where the actual decisions are being made, and treating it as the primary lever is a category error that the public conversation has not corrected.

The deployment-layer governance stack is operating on a layer of the system that does not determine the outcome. The policy effort invested there is producing returns that look productive and accomplish less than the effort suggests.

Why the deployment layer cannot reach the upstream decisions

The asymmetry between deployment-layer governance and substrate-layer governance is not a matter of policy choice. It is structural. The deployment layer comes into existence after the model has been trained, the architectural commitments have been made, and the corpus has been finalized. Every decision the deployment layer is operating on was made earlier, by people whose decisions are not subject to deployment-layer review, in a process that the deployment layer has no visibility into.

Audit at the deployment layer can verify what the model does in response to particular probes. It cannot verify why the model does what it does, because the why is determined by decisions that happened upstream. A model that refuses a particular request might refuse because the underlying capability was never trained, or because the underlying capability was trained and is now being suppressed by a thin refusal layer, or because the model is producing a refusal as the most-likely continuation of the prompt format rather than as a deliberate safety behavior. The deployment-layer audit cannot distinguish these cases, and the distinctions matter because they predict different generalization behavior.

Pre-training composition could in principle be inferred from sufficiently rich audit, but the inference is loose, requires extensive access to model internals, and produces results that are debatable in ways that policy frameworks cannot rely on. Architectural commitments could in principle be probed for, but the probes require deep technical sophistication and access to model internals that no current audit body has the capacity to design or run. The deployment layer is not the wrong place to do governance because of any policy choice. It is the wrong place because the levers it has access to are downstream of the decisions that matter.

The training-data composition decision

The highest-leverage governance decision any frontier lab makes is what enters the pre-training corpus, in what proportion, weighted how, and filtered against which quality criteria. This decision is currently made early in a training run, by a small number of people, with essentially no external visibility, and once made it is structurally irreversible at the timescale of a model generation.

The decision shapes the prior of the base model. Every downstream behavior the public sees is a transformation of that prior by post-training. The prior cannot be substantially changed after pre-training. If the corpus weights science papers heavily, the base model has a science-paper prior. If the corpus weights forum discussions heavily, the base model has a forum-discussion prior. Post-training can suppress surface manifestations of either prior; it cannot remove the prior.

An upstream governance framework for training-data composition would require labs to disclose, prior to pre-training, the corpus categories and their target weights. It would require external review of the composition decisions, on a privileged-access basis if necessary, before training compute is committed. It would create accountability for composition decisions in the same way that financial decisions of comparable magnitude already receive external audit. None of these frameworks currently exist.

The political difficulty here is real. Pre-training data composition is treated by every frontier lab as competitively sensitive. Disclosure regimes that would surface composition decisions to external review run into legitimate intellectual-property concerns. The labs have low incentive to comply voluntarily, and the regulatory authority to mandate compliance does not yet exist anywhere. The framework has to be designed in a way that accommodates the legitimate competitive concerns, surfaces the decisions that matter for safety, and is built on an institutional foundation that can credibly hold private information without leaking it. None of these design problems are intractable. None of them are being seriously worked on.

Pre-release evaluation gates

The decision to release a frontier model is currently subject to internal evaluation and limited external red-teaming. The evaluations are designed by the releasing lab, scoped according to internal definitions of what risks matter, and the threshold for release is set by the releasing lab's internal policy.

An upstream governance framework would specify a minimum set of evaluations, designed by parties other than the releasing lab, with public criteria for what scores gate release. The evaluations would need to be private (so that frontier models cannot train on them) but their structure and the gating criteria would be public. This is structurally different from current voluntary commitments, and structurally different from the deployment-layer policy that operates after a model has been released.

The capability-specific eval that gates release at a particular capability tier is the single intervention that would move the field most in the next twenty-four months. The reason it has not been built is that no governance authority currently has the technical capacity to design or run such an eval at the level the frontier requires. Building that capacity is the second-order intervention this paper is calling for.

What building eval capacity actually requires

Designing a frontier-grade capability eval requires a team with deep technical sophistication about model capabilities, the failure modes that matter, and the adversarial design techniques that prevent the eval from being optimized against. The team has to be large enough to cover the breadth of capability dimensions that need to be tested, sophisticated enough to design oracles for tasks that do not have obvious ground truth, and institutionally credible enough that frontier labs will accept its evaluations as gating their releases. No existing governance body currently has all three of these properties. Building one is a multi-year institutional project. It is also one of the highest-leverage things that could happen in AI policy in the next five years, and the absence of any serious effort to build it is one of the most consequential gaps in the current policy landscape.

Architectural commitment auditing

Architectural decisions lock in path-dependent behaviors. The choice between dense and sparse, between sliding-window and full attention, between standard transformer and reasoning-first architecture, are not reversible at the timescale of a model generation. They determine what the model can do, what it cannot do, and what subsequent post-training will be working with.

An upstream governance framework would require labs to document their architectural commitments prior to training, with an analysis of which capabilities the chosen architecture admits and which it does not. This is not a constraint on architectural choice. It is a requirement to make the choice legible to external review, in the same way that drug approval requires legible mechanism documentation. Currently, frontier architectural choices are documented after the fact, in technical reports that describe what worked. The decisions that did not get tried are not legible at all.

The intent of architectural commitment auditing is not to prevent any particular architectural choice. It is to surface the path-dependent consequences of architectural choices to external review at a moment when those consequences are still under the labs' control rather than baked into a deployed model. A lab choosing a reasoning-first architecture that admits certain capabilities and excludes others should have to make that choice legibly, with an analysis that survives external technical review. The choice itself remains the lab's. The legibility requirement is the governance contribution.

The three interventions

Training-data composition disclosure with external review prior to pre-training. Mandatory capability-specific evaluation gates designed by parties other than the releasing lab. Architectural commitment auditing prior to compute commitment. Each of these is upstream of where current governance is operating. Each of these would require frameworks that do not currently exist. None of them are technically infeasible. All of them are politically difficult.

The interventions compound. A regime that surfaces composition decisions before pre-training, evaluates the resulting model against capability-specific gates designed by independent technical bodies, and requires architectural commitments to be legible to external review before compute is committed, produces a governance landscape that is operating on the layers where the actual capability is being shaped. The deployment-layer governance can stay in place as a complement. It cannot be the primary lever. The primary lever has to move upstream or the governance stack stays cosmetic.

The political pathway

The political difficulty is not the absence of will. It is the absence of institutional capacity. There is no body in any major jurisdiction that has the technical sophistication to design frontier-grade capability evals, the institutional credibility to hold private composition information without leaking it, or the regulatory authority to require either disclosure or gating. Building any of these is a multi-year process that has to start before there is overwhelming political consensus, because the political consensus will not form until after a significant downstream failure, and the cost of building the institutional capacity in the aftermath of that failure is substantially higher than the cost of building it now.

What the field is currently doing instead

The field is producing a substantial volume of policy work focused on the deployment layer. Model card standards. Voluntary release commitments. Audit protocols for deployed models. Liability regimes for downstream harms. All of this work is being done by people who are aware that the deployment layer is not where the leverage is, and who are working there because that is where the institutional capacity currently exists. The mismatch between where the work is being done and where the leverage is located is not a failure of any individual policy effort. It is a structural property of the current institutional landscape, and it will not correct without deliberate effort to build the institutions that operate at the substrate layer.

The absence of upstream institutional capacity is a self-reinforcing problem. Policy work continues to flow to the deployment layer because that is where the institutional infrastructure exists to receive it. Institutional infrastructure does not get built at the substrate layer because the policy work flowing there is too small to support it. Breaking this loop requires a deliberate decision somewhere in the field to invest in building substrate-layer institutional capacity ahead of the policy demand that would naturally create it. That deliberate decision has not yet been made anywhere visible.

Conclusion

Governance has to move upstream or it stays cosmetic. The deployment-layer stack will continue to feel productive and produce limited results because the decisions it is operating on were already made. The leverage is at the substrate. Building the frameworks that operate there is one of the most important and most under-resourced research directions in current AI policy. The work of describing what those frameworks would look like is the first step. The work of building them is the second. The field has barely started the first step. The clock is shorter than the public conversation acknowledges.

If the upstream institutional capacity is not built in the next thirty-six months, the policy landscape will be locked into a deployment-layer-centric paradigm for the entire next generation of frontier capability. The substrate-layer decisions will continue to be made by a small number of people inside frontier labs, without external review, in a regulatory vacuum that the field has not addressed because the institutional muscles to address it have not been built. The cost of building those muscles now, ahead of the regulatory demand that will eventually require them, is substantially lower than the cost of building them in a hurry after a downstream failure. That trade-off is the central call to action of this paper.