Control: version comparison
Comparing v1.0 (May 19, 2026) → v1.1 (August 10, 2026)
Green text was added in v1.1; red text was removed from v1.0. Unchanged text is shown for context.
Be able to see what your AI is doing during internal deploymentuse.
Inventory of internal inferenceuse. For risk-relevant models in internal deploymentuse, maintain a list of all ways to run inference, and track each way's approximate share of inference volume and whether it is part of a monitorable settinglogged for monitoring.
Monitorable internal inferenceinference in internal use. For risk-relevant models in internal deploymentuse, 99.9% of inference tokens happen in a monitorable settingare logged for monitoring — meaning the inference is logged and able to be scanned with classifiers (synchronously or asynchronously), not that classifiers are necessarily run against every request.
Outages of monitor. Define and publish what types of monitor outages are treated as outages of internal inference itself use of risk-relevant models (i.e., what causes inference to fail closed until monitoring is back online).
Tamper-evident logs. Maintain tamper-evident logs such that deletion or modification of inference records is detectable.
Employee flagging. Maintain a straightforward method for employees to flag their internal inferenceuse traffic for review of concerning behaviors.
Monitoring of the training process. In addition to looking out for signs of misaligned goals once a model is in deployment, AI developers should also log and analyze behavior during the training process to look for evidence of a model that is developing misaligned goals (e.g., while being trained with reinforcement learning).
Zero-data-retention-compatible monitoring. Approaches for monitoring under zero-data-retention (ZDR) commitments that abide by retention restrictions while still preserving the ability to reconstruct and investigate specific bad actions by an AI. Effective monitoring is more difficult without access to straightforward logs of the relevant inputs and metadata.
Monitoring of external use. Models can pose serious risks when used externally too, which can warrant control measures like monitoring. This may be particularly the case in settings such as third-party testing, especially when the model is being tested without safeguards that would normally be in place. In such settings, it needs to be determined whether responsibility for monitoring should lie with the AI developer, the external user, or a combination of the two.
Scan for signs of concerning behavior.
Sampling procedure. Define and publish a sampling procedure for selecting which traffic from the monitorable setting that has been logged for monitoring is assessed for signs of concerning behavior.
Categories of concerning behavior. Include the following categories of concerning behavior in your scanning of internal inferenceuse, considering both the chain-of-thought and the agent's actions:
Monitor efficacy. Measure and document the efficacy (recall) of the monitor system for flagging concerning behavior.
Response-time target. Define and publish a tiered response-time target for human review of flagged inference, including which flag-types and -severities require an on-call response.
Response-time attainment. Track median, 90th-percentile, and 99th-percentile review times against the response-time targets.
Stress-test the sufficiency of your scanning.
Monitorability evaluations. Conduct monitorability evaluations of the model's chain-of-thought that run whenever a new risk-relevant model enters internal deploymentuse or there are material changes to the risk-relevant model or to the monitor system.
Sting operations against models. Run recurring sting operations against risk-relevant models to present the AI with opportunities to take unwanted actions, and observe whether it does.
Stress-testing of monitor. Run recurring stress-tests of the monitor system: inject known-bad behaviors into the inference stream, and verify that the monitor detects them.
Distinguishability of sting operations. Test whether risk-relevant models can distinguish sting operations from real traffic, and put less credence in sting operations the respective models know to be tests.
Stop the AI from taking harmful actions even if it tried.
Absolute action boundaries. Define and internally maintain a set of any actions an agent should categorically never be able to take without a human's signoff, even if a monitor has identified no issues with the request.
Critical action boundariesGated actions. Define and internally maintain a set of critical action boundaries that should begated actions: that is, actions that are gated by a monitor with access to the agent's chain-of-thought before allowing an agent to crossproceed, and apply blocking to these actions (semi-synchronous or stronger).
Important action boundariesClosely-trailed actions. Define and internally maintain a tier of action boundariesactions that don't warrant pre-action blocking but should beare closely trailed by a monitor with the access to the agent's chain-of-thought and the capacity to intervene if concerning behavior is discovered.
Required critical boundariesgated actions. The set of critical action boundariesgated actions must include, at a minimum:
Both must be gated by a monitor with access to the agent's chain-of-thought (or an equivalently effective review process) before actions can take effect.
Aggregate-flag haltingCircuit breaking. Implement aggregate-flag haltingcircuit breaking: a threshold of action-rejections that causes all boundary-crossing actions to be restricted until actively cleared by a human as false-positivessystem where after enough flagged actions have accumulated, no gated or closely-trailed actions can be taken until a human determines it is safe to remove this restriction.
Flagged incidents for pull requests. When reviewing pull requests that are agent-initiated or include AI-generated content, consider both the proposed changes and any monitor flags raised during their generation.
Have independent third parties verify the adequacy of your control regime.
Third-party red-teaming. On a quarterly basis, conduct high-context, third-party red-teaming, providing red-teamers with knowledge of the monitor system and tasking them with finding gaps and trying to penetrate action boundariesembedded red-teaming.
Third-party adequacy reports. On a quarterly basis, commission and publish a third-party report focused on the adequacy of the company's control regime, drawing upon the red-teaming results, and redacting only information deemed by the third-party to pose unnecessary commercial risk or to be unsafe to publish.
Prepare for a possible breach of control.
Containment response plan. Develop and adopt a containment response plan for restricting a model's access and operation upon detection of attempts to subvert control.
Notification protocol. Develop and publish a notification protocol for alerting relevant stakeholders of a possible breach of control: what will trigger notification, who will be told (internal teams, government, peer organizations as appropriate), on what timeline, and what information will be shared.
Shutdown latency targeted. Set a target latency for quickly shutting down inference on all instances of a particular model, API key, or other relevant factors without taking the underlying computers completely offline.
Shutdown latency measurement. Measure and document the latency achieved in tests of the shutdown procedure.
Glossary
aggregate-flag halting
A temporary halt triggered when too many action-rejections pile up (across an agent, session, or other scope), holding further boundary-crossing actions until a human reviews the flags and clears the agent for further action-taking.
asynchronous monitoring
Review of inference that happens after the fact: the response is already returned to the requester, and so the monitor does not have the opportunity to block the action.
categories of concerning behavior
Types of behavior to scan for in AI's chains-of-thought and actions.
We plan to publish additional details about each category to help companies in building out their own taxonomy.
important action boundaryclosely-trailed actions
Certain categories of actions, typically where the AI can have impact outside a constrained sandbox environment, that should be trailed closely by a monitor with the capacity to intervene if it retrospectively finds concerning behavior.
containment response plan
A pre-specified plan, triggered when the AI is detected trying to subvert control, which covers what permissions to revoke from the model, who the model may continue operating for, under what constraints, and when to take it fully offline.
embedded red-teaming
Red-teaming of a company's control system. This involves red-teamers being provided with knowledge of the control system, the ability to take certain actions (i.e., the actions available to risk-relevant models when in internal use, like invoking certain toolcalls), and the ability to observe how the control system reacts to those actions. The red-teamers should be tasked with finding gaps in the control system and trying to penetrate action boundaries.
critical action boundarygated action
Certain categories of actions, typically where the AI can have impact outside a constrained sandbox environment, that must be scanned and approved by a monitor (semi-synchronous or stronger) before the AI takes them.
internal deploymentuse
Any usage of the inference with a risk-relevant model beyond training, evaluations by the safety/evaluations team(s), or safety testing by trusted third parties. Some examples that would constitute internal deploymentuse include “dogfooding” (or use by employees in their work), testing or evaluating the model, and especially use in automated AI research, to generate training data, critiquing other models, or in agentic pipelines for research.
monitorable settinglogging for monitoring
An inference setting that logs dataLogging of inference so that traffic can be scanned with classifiers, optionally according to a sampling procedureonly scanning a randomly-sampled portion of what was logged.
Logging should include both the content of model activity and metadata to link related pieces of model activity.
Content examples: the model's chain-of-thought, any tool calls.
Metadata examples: information about the model's scaffolding, the active branch during coding.
material change to a monitor model
A change to the monitor (e.g., additional fine-tuning or a substantial prompt change) that the developer judges to warrant fresh evaluations.
method for employees to flag concerning activity
A channel (e.g., a flag-word convention or an internal form) for employees to send concerning inference traffic to investigators.
monitor outages
Events that result in the monitor system not working as expected — e.g., failure to log inference traffic, inability to scan logged traffic with classifiers asynchronously, or inability to scan actions before they cross a critical action boundaryclosely-trailed actions in a timely manner or gated actions before they are executed.
Companies should consider which outages would undermine the case that their AI is sufficiently well controlled, and set internal inference to fail closed in those cases.
recurring sting operations
Tests that present the AI with opportunities to take harmful actions and observe whether it does.
'Recurring' means run on an automated cadence rather than re-initiated by a human each time. For example, a pipeline that consistently builds new stings by tweaking actual inference traffic.
response-time target
The intended amount of time until a human reviews a flag, depending on its severity.
risk-relevant models
Models that could materially contribute to catastrophic risk.
For the Control standard, this includes any model deployed internally that meets or exceeds the threshold for frontier models articulated by California SB 53 (10^26 FLOPs of training compute).
sampling procedure
The developer's protocol for what traffic gets scanned by which classifiers and how often. Higher-risk sources (e.g., agentic coding scaffolds) may be sampled at a different rate than other sources, and sampling may use a tiered hierarchy of classifiers for efficiency.
semi-synchronous monitoring
A monitor scans each proposed action before it executes and may block it. The agent can immediately retry with a different action without waiting for human review, which can leave the system vulnerable to attacks in close succession.
stress-tests (of the monitor system)
Tests of whether the monitor reliably flags what it should, done by injecting known-bad behaviors and checking that they're caught.