Alignment Just Became a Permit System
When the frontier lab gates dual-use cyber to 150 customers in the same week the White House demands pre-release NSA review, the alignment debate stops being about values and starts being about licensure.
Two stories landed inside a single news cycle that look unrelated until you put them on the same axis. The White House moved to insert the National Security Agency into the pre-release review of every frontier model (covered here). Anthropic expanded a tool it openly describes as offensive-grade cyber capability to 150 more organizations, while conceding its own safeguards aren't ready (covered here). Read in isolation, one is a policy story and the other a product story. Read together, they describe the same transition: alignment is no longer a research program. It is becoming a permit system.
The reason this matters is that the vocabulary of alignment was built for a different problem. "Helpful, harmless, honest" assumes a model whose deployment surface is a chat box and whose downside is a bad answer. Both of this cycle's stories concede that frame is dead. The executive order language treats the model itself as the payload — something inspected by an intelligence agency before it ships, the way a dual-use export is inspected before it crosses a border. Anthropic's own posture concedes the symmetric point from the vendor side: they shipped the capability anyway, acknowledged the misuse window, and bet that compensating controls outside the model would close it. Both actors have stopped pretending the model's training run produces a safe artifact. The artifact is assumed unsafe; the question is who gets to handle it.
That is what makes this a permit system rather than an alignment regime. A permit system has three load-bearing pieces, and you can see all three forming. There is a list of inspectors with statutory authority (NSA red-team, eventually the Commerce BIS rules that already cover compute). There is a list of approved end-uses and approved end-users (Anthropic's enterprise tier is now functioning as the allow-list, with the company itself as the permitting authority for a capability the government has not yet defined). And there is a residual liability story that nobody has written yet — what happens when a 151st organization gets the offensive tool and uses it against critical infrastructure, and the executive order's 30-day review window turns out to have missed the relevant capability.
The uncomfortable consequence is that the labs and the state are converging on the same operating model from opposite directions, and neither one is the alignment community. Anthropic is acting like a regulated utility before the regulator exists — self-issuing capability licenses to its customer book. The administration is acting like an export-control office before the export-control schedule exists — claiming pre-release review authority without yet specifying the threshold capabilities or the denial criteria. The alignment researchers who spent a decade arguing about reward hacking and deceptive mesa-optimizers are not in either room. The room is now full of lawyers, intelligence officers, and enterprise account managers, and the artifact under discussion is a contract, not a loss curve.
There is a tell that the transition is real: notice what neither story argues about. Neither one argues about whether the model's values are correctly specified. Neither one argues about RLHF technique, constitutional AI, or interpretability progress. The executive order doesn't ask NSA to audit the reward model. Anthropic's announcement doesn't claim the safeguards work — it concedes they don't. Both sides have implicitly agreed that the inside-the-model questions are unsolved and that the policy lever has moved outside the model: who gets the weights, who gets the API key, who gets the pre-release look, who carries the bag when it goes wrong. That is the shape of a permit regime, and it is being assembled in public without anyone naming it.
The forecast follows directly. Within twelve months, expect a published capability schedule — something analogous to the Wassenaar dual-use lists — that names the specific cyber, bio, and autonomy thresholds that trigger pre-release review. Expect Anthropic's "enterprise tier" pattern to be copied by every frontier lab, because it is the only structure that lets a vendor ship a known-dangerous capability while preserving a defense. And expect the alignment field to bifurcate: a technical wing that keeps working on interpretability and a policy wing that becomes, in practice, a compliance discipline. The cycle's two stories are not about alignment failing. They are about alignment being relocated — out of the model, into the permit.
Trump frontier model NSA review (this cycle) → · Anthropic Glasswing cyber dual-use expansion (this cycle) →