The conversation about artificial intelligence often feels stuck on a single, binary question: should the most powerful computer brains be kept behind a locked door, accessible only through a company's website, or should their inner workings be published for anyone to download and study? This debate treats the release of a model as a simple choice between "open" and "closed." However, the reality of these systems is far more complex. An AI designed to help a child learn their alphabet is fundamentally different from a system capable of planning complex military strategies or manipulating financial markets. The danger one system poses is not the same as the danger the other poses. If we apply the same rules to both, we either lock away tools that could teach millions or we hand out dangerous weapons to anyone who wants them. The core challenge for society is not just deciding how smart a machine can be, but deciding who gets to use that intelligence and under what conditions.

In September 2026, researchers Chai K. Toh and Vasu Raj Jain from the SAFE AI Foundation proposed a new way to think about this problem. They argue that the current debate misses a crucial distinction: the difference between how capable a system is and who is allowed to access it. Instead of asking whether a model should be open or closed, they suggest we should sort access based on what the machine is actually going to do and how much harm it could cause if it went wrong. They call this the Multi-Tiered AI Accessibility Model, a system that organizes artificial intelligence into three distinct levels, much like how we regulate different types of vehicles or chemicals based on their risk.

The first level, which the authors call "AI for Learning," is designed for education and basic literacy. These are systems meant to teach students how to use technology, how to write code, or how to understand the world. Because the potential for harm is low, these models should be as open as possible. Anyone should be able to download them, study them, and use them without needing to prove who they are. The researchers suggest that these systems should be deliberately limited in their power; they do not need to be the most powerful computers in existence to teach a lesson. By keeping the capability of these learning tools bounded by design, society can enjoy the benefits of open access without the risk of a student accidentally unleashing a dangerous system.

The second level, "AI for Exploration," serves a different group: researchers, developers, and businesses that need more power to build new applications or test scientific ideas. These systems are more capable than the learning tools but are not yet at the peak of what is possible. Access to this tier is not completely open, but it is not locked away either. It operates on a sliding scale. A less powerful system in this category might be available to the public with some rules, while a more powerful one requires the user to register their identity and agree to specific terms of use. The key idea here is accountability. As the power of the tool increases, the person or organization using it must be identifiable. If something goes wrong, there is a record of who was using the system, and there is a way to stop them from using it again if necessary.

The third and final level is "Full-Scale Frontier AI." These are the most powerful systems imaginable, capable of advanced reasoning, autonomous planning, and operating in high-stakes fields like defense, aviation, or critical infrastructure. The researchers argue that these systems should never be released as open files that anyone can download and modify. Once a powerful model is published as a set of weights—the mathematical instructions that make it work—it is impossible to take it back. If a bad actor downloads it, they can strip away the safety features, change its behavior, or embed it into a robot that acts on its own. The original creator loses all control. Therefore, access to these frontier systems should be strictly limited to vetted organizations that have a legitimate need, with every interaction logged and monitored. The goal is not to stop innovation, but to ensure that the most dangerous tools are handled only by responsible parties who can be held accountable.

The paper provides strong evidence for why this separation is necessary. The authors point out that safety features added to an AI are often shallow and can be removed very cheaply. Research shows that with just a few hundred dollars of computing power and a small amount of data, someone can take a safe, open-weight model and strip away its safety guardrails. This means that even if a developer tests a model and finds it safe before releasing it, the moment it is downloaded, that safety guarantee is gone. The model can be changed into something dangerous, and the original developer has no way to stop it or fix it. In a closed system, where the model is served through a secure interface, the developer can monitor usage, detect when someone is trying to break the rules, and revoke access instantly. In an open system, once the file is downloaded, the developer loses all these levers of control.

To make this system work, the researchers propose a set of rules for deciding which tier a specific AI belongs to. They suggest looking at four main factors: how capable the system is, how much it can act on its own without human help, what kind of real-world consequences its mistakes could have, and what the system is actually being used for. A system might be very smart but only used for writing poetry, which keeps it in a lower tier. But if a slightly less smart system is designed to control a power grid or design biological agents, it must be placed in a higher tier because the consequences of failure are so severe. The decision of which tier a system belongs to should not be left entirely to the companies that build them. Instead, independent regulatory bodies or safety institutes should review the evidence and assign the tier, ensuring that the rules are applied fairly and consistently.

This approach combines two different safety boundaries. The first is a limit on how powerful a system is allowed to become, a concept the authors call the Capability Boundary. This sets a ceiling on the raw intelligence and autonomy of any AI, ensuring that no system is built that humans cannot control. The second is the Accessibility Boundary, which is the new idea introduced in this paper. It dictates that as a system gets closer to that ceiling, the number of people allowed to use it must shrink, and the rules for using it must get stricter. If we only have a ceiling but no rules on who can climb, the most dangerous tools could end up in the hands of anyone. If we only have rules on who can use them but no ceiling on their power, we might allow controlled access to systems that are too dangerous for anyone to handle.

The researchers acknowledge that this system is not a perfect solution and that it relies on institutions to function. They admit that determined individuals might still find ways to leak powerful models, and that the framework cannot completely stop the spread of dangerous technology. However, they argue that it raises the cost and difficulty of such proliferation, making it much harder for bad actors to get their hands on the most powerful tools. By organizing access into clear tiers, society can keep the benefits of open AI for learning and research while creating a secure zone for the most powerful systems. The result is a world where the most capable machines are not locked away from everyone, nor are they handed out to everyone, but are instead matched to the people and organizations best equipped to use them safely.