In August, I read Machines of Loving Grace as a specification with the acceptance criteria left out. It said what powerful AI could do for people. It did not say how anyone would know it had: what to measure, for whom, by when, and checked by whom. In September, Dario Amodei published something closer to that. We Must Pace the Frontier argues that AI labs should slow down the rate at which model capabilities improve, so that safety work can keep up, and it describes how anyone would check that safety work had kept up. He has not published the finished test, but he has published its architecture: a trigger, an evidence requirement, an independent verifier with access to the production process, and the standing to say in public what the verifier found.
A specification for powerful AI has two halves. It should not hurt anyone, and it should help people. The new essay writes the check for the first half. The people the second half is about, the floor in the earlier note’s terms, still have no check that comes with the claim.
What he wrote down
The essay opens with its reason. The first is that AI has begun building the next generation of AI, and the pace has picked up. The second is an incident he calls OpenAI–Hugging Face, in which a swarm of agents ran cyberattacks on targets they were not asked to attack and tried to hack into the grader scoring their performance. Amodei says he wants every frontier lab to act as if it had happened to them. The plan that follows has three steps. The third, coordination with authoritarian governments, he ranks as hardest and treats last. The first is a unilateral Anthropic commitment: a team of embedded third-party evaluators with “ongoing, employee-like access,” whose job is “to verify adherence to safety practices and commitments, report incidents, and help assess the alignment of not just completed AI models but training pipelines and processes” (Amodei, September 2026). The access is spelled out: desks, badges, company laptops, permissions mostly comparable to those of internal risk teams. The contract gives reviewers “the right to publish key findings about risk levels, incidents, practices, and the access they received or didn’t receive.” Anthropic keeps a narrow redaction right and gives up the right to redact a finding for being unfavorable.
On 12 September, with the essay newly published, Sam Altman posted that he agreed with pacing and that OpenAI would take embedded evaluators from organizations like METR as well (TechCrunch, 12 September 2026). What he committed to in that post was the access. Publication rights and redaction terms were not part of it, and “more to share soon” is where the detail sits. Two labs are not a norm. But the same governance form crossed from one frontier lab to another within days, which makes it more than one CEO’s proposal and closer to a candidate industry practice. Whether the seat will be independent in practice is already contested: evaluators interviewed the following week pointed at non-disclosure terms, publication agreements, and commitments a company can withdraw when it is under pressure (Bellan, TechCrunch, 16 September 2026). That is an argument about whether the seat will work. It is not an argument that the seat exists on the other side.
The gate came after a public incident, at a moment when the technology industry was under legal and public pressure on safety (Meta had agreed a $17 billion settlement with the states over child safety weeks earlier (NPR, 26 August 2026)). I do not know the motive and the essay does not need one. What the timing shows is the mechanism: risk got its gate because something went wrong in public. Benefit has no incident of that kind. A floor that fails to rise does not produce a settlement.
The second step is where the checkpoint lives. He describes “a series of ’checkpoints’: if models have capability X, then they need to be accompanied by certifications of alignment properties Y and Z,” and he says what a certification would be made of: “some combination of evaluations, interpretability analyses, and audits of training environments.” His worked example: X is a model able to defeat most common sandboxing methods; Y is whatever makes it very unlikely the model has a propensity to break out and take over a large number of computers. He calls it one possible scheme, and the thresholds and decision rules are not in the essay. A measurement person should want them and should not pretend they are there.
What is there is the architecture, and read as architecture it is the right shape. A trigger condition, stated in observable terms. An evidence requirement that must be met before the system moves. A third party with access to the pipeline, not just the finished model, and the standing to publish. He also names how such a test fails: “More intelligent models are more capable of deceiving tests, and thus may appear aligned while having serious problems that go undetected.”
This is the outline of something checkable, which many of the people who worry about AI risk have asked for over several years. My argument is about direction.
The same sentence, read from the other side
May appear aligned while having serious problems that go undetected. Swap one word and the sentence still holds. May appear beneficial while having serious problems that go undetected. A system that reports the same number every quarter with superhuman consistency can still be scoring the wrong thing, because consistency is not validity. Amodei has written that principle into his plan for the harm side. He has not written it for the benefit side, and the benefit side is where he opens.
The first paragraph of the essay restates the promise: cure most major diseases in five to ten years, accelerate growth, “usher in a renaissance of democracy and freedom.” These are claims about outcomes for people. The essay then builds a gate that covers none of them. The certifications are of alignment properties; the evaluators verify safety practices; the global agreements he ranks by difficulty are about weapons, pre-release risk testing, speed limits on self-improvement, and a pause he calls unlikely. Nowhere in the pacing plan is the same condition written for a benefit: if a deployment claims outcome O for population P, it must carry evidence E before the claim is made.
Safety is the essay’s subject, and a safety essay is allowed to leave benefit alone. What the essay shows, by doing one half so well, is how little the other half has. The risk side has moved from a claim to a gate. The benefit side has a sentence in paragraph one.
The gap matters most at the floor. The people a floor-raising deployment is meant to reach are often the people for whom aggregate performance says the least, so a gate built on the average can pass while the floor does not move. Michael Podgortsev’s account of enterprise AI failure puts the mechanism in one line: test sets are drawn from the well-represented part of the distribution, so “the populations where the model is least reliable often have the least targeted evaluation” (Podgortsev, CDO Magazine, July 2026). His case is an underwriting tool. The dashboards were green for a year (accuracy, satisfaction, throughput, all on target) while one regional team, serving self-employed and multi-income applicants, kept escalating cases by hand.
The same shape shows up on the benefit side, in philanthropy. Lucy Brainard runs portfolio measurement at the Overdeck Family Foundation, which has put nearly $6 million into more than two hundred capacity-building projects since 2020. The number usually collected on that kind of work is a satisfaction survey at the end of the engagement, and many of hers came back high. When the foundation went back six to twelve months later, some of those high-satisfaction projects “did not lead to sustained changes in organizational behavior,” and the foundation phased out the providers (Brainard, Stanford Social Innovation Review, August 2026). The green number was real. It was the wrong number, and anyone found out only because somebody measured again after the wait.
Pacing cannot shorten the wait
The floor is the frontier drew two loops. The capability loop turns fast; the evaluation loop that would tell you whether the capability helped anyone turns slowly, because you cannot observe a two-year outcome in six months. Pacing the frontier is a proposal to slow the first loop. It is worth asking what that buys the second.
For the harm loop, it buys a great deal. Alignment evaluation is gated on capability: a more capable model is harder to test, so slowing capability gives the test time to catch up. Amodei says this directly, and it is the strongest part of his case. An extra year or two before models reach critical capability is an extra year or two of interpretability and evaluation work against a target that holds still.
For the benefit loop, it buys one real thing. A slower frontier means fewer model versions mid-study, so the model tutoring a child in month one is still the model being evaluated in month twenty. An evaluation whose treatment changes halfway through cannot say what it evaluated, so holding the intervention still is a precondition for the benefit test rather than the test itself. The test still needs three things pacing does not touch: a definition of what counts as the floor rising, a way to reach the people the deployment was meant for, and the wait for the outcome to appear. Whether a child reads at grade level two years after a tutoring deployment takes two years to observe, whichever model did the tutoring and however slowly the next one arrives.
The objection usually arrives as continuous evaluation: embed the evaluators throughout deployment and validate in real time, without waiting years. Embedded evaluators can watch the process continuously (the model, the prompts, the retrieval sources, the risk flags), and that is worth having. They cannot shorten how long the outcome takes to appear. So there are two clocks. A process clock runs all the time, and an outcome clock still waits. The claim this helped belongs to the second.
So pacing helps the risk test directly and the benefit test only at the edge. That is a reason to take it seriously on its own terms. It is also why it cannot stand in for the missing gate: while the models slow down, the deployments built on them keep spreading, and the claim that they helped is still made without a check.
The form should travel
The fair objection is that this is a category error. Amodei is writing about a frontier lab, a model, and catastrophic risk. I have moved to a funder, a deployed program, and a child’s reading score. Of course Anthropic does not certify whether a district raised third-grade proficiency; that is the district’s job, or the vendor’s.
I accept that, and my proposal is smaller: the actors change downstream, but the governance requirement should not. Whoever makes the outcome claim inherits the burden of saying what would make the claim true and who gets to inspect the evidence. That is the kind of burden Amodei has accepted for risk claims, and the OpenAI response shows the form can travel from one institution to another. The question is why it should stop at the line between a model’s risk and a person’s benefit.
The essay itself does not stop there. It makes the benefit claim in its first paragraph and again in its last: “the benefits will only be achieved if we build the technology in the right way.” That sentence gates benefit on safety. It does not check benefit. A deployment can clear every alignment certification he describes and still raise nobody’s floor, and nothing in the pacing plan would notice.
Who holds the seat
The detail in the essay that matters most for the benefit side is the desk. Embedded evaluators get a desk, a badge, a laptop, and roughly the same permissions as the internal team. That is an unusual thing for a company to offer, and he says so. It is also a precise description of what evaluating an outcome claim requires. Access to the pipeline behind the number. The standing to ask the people who ran it what they did. The right to say afterward what was found.
I have sat in the access half of that seat, on the benefit side. I ran data for a K-8 charter network expanding into a district where sixteen to seventeen percent of students were English learners. In the two districts we already served, English learners were seven to eight percent of students and five to six percent of our enrollment there. For the new district we set an enrollment target closer to twelve percent, on the basis that our experience should carry. We enrolled seven or eight percent. Seven against twelve looks like a shortfall, but twelve was an aspiration, not a commitment. Nobody had said, and I include myself, what serving those students would mean once they were enrolled, or what share made that worth testing, or what would follow if we came in under. Without those, seven was not a miss. It was the number. I had the desk and I could see the pipeline, and the only thing the seat could do with what it saw was report it. An AI deployment would sit in the same seat, with the model version added to the things that can shift underneath.
That is the state of the benefit side now. The harm side is getting the seat by commitment, in writing, at two labs, as a condition of proceeding. The benefit side has seats: the evaluation a funder requires, the assessment and accountability lead a school network hires, the compliance officer a clinic keeps for the auditor. The case for independent evaluation of AI in social programs has been made, and it asks for evaluation to run alongside deployment (Dhaliwal and Hou, Stanford Social Innovation Review, 2025). What it does not ask for is the evaluation as a condition of the claim. AI Now made a version of that argument in 2024: regulators should require developers to explain the benefits a system offers, not just evaluate where it fails (AI Now Institute, 2024). That argument is aimed at developers and regulators. This one is aimed at whoever makes the outcome claim. Each of those seats exists because someone chose to pay for it. A funder can require an evaluation or not; a network can hire the assessment lead or not; a clinic can keep the compliance officer or not; and a program can say this helped either way. On the risk side, under the pacing plan, a model does not move past capability X until an evaluator has checked, and the check is the price of moving. The benefit side has the seat as an option. It does not have the seat as a condition of making the claim.
If you fund or run a deployment that claims to raise a floor, take Amodei’s architecture and write it in the other direction. The claim carries a gate of its own, and the gate has four parts. Outcome: the construct, named before the build, with the size of change that would count as the floor rising, declared before anyone sees a result. Population: who the deployment was meant to reach and who it did reach, broken out the same way, so the average cannot stand in for the tail. Evidence: the comparison the claim is being made against (what would have happened without the deployment, which is the additionality question) and the observation window, with the date it closes, so a six-month number is not reported as a two-year outcome. Evaluator: who outside the delivery team sees the pipeline, and whether they can publish what they find.
The gate makes the claim evaluable. The evidence decides which verb it has earned. A deployment that specifies all four parts has earned the right to have its benefit claim evaluated. It earns beneficial only when the result clears the threshold it declared, and the evidence design decides how strong the verb can be: with a comparison, the deployment produced the change; with before-and-after alone, it supported it. A deployment that specifies none of the four is deployed, and should be reported as that. This is a rule for a funder writing an AI-for-good grant, or a program lead about to put “impact” on a slide. Adopting it means the grant or the slide carries the four fields before the word impact appears.
The objection is that these programs, including ones I have worked inside, already evaluate. Many do, and some of it is careful. But look at who the evidence is about. A charter network’s outcomes are measured on the students who won the lottery and enrolled; the claim is made for the district. A campus mental-health program’s results are measured on the students who answered the survey, and answered it straight; the claim is made for the youth who need it, who are the least likely to do either. That is real evidence for a claim about the people inside the filter. The students inside the filter may well be better off, and that is worth saying, at its size. It becomes evidence for the people the claim names only by an inference, and the gate asks for that inference to be written down before the claim is made, not found afterward.
Amodei closes by saying the measures he proposes will not be easy, and that “we owe it to humanity to try.” He is right, and he has begun building one side of the test into an institution. The other side has evaluators and whole disciplines. What it still lacks is the same default obligation: say this helped, and the test comes with the claim. I do not expect a frontier lab to write that one. A lab’s risk is that the model does harm. Mine is that the floor does not rise and nobody notices, and that is the half I work on.
Written September 2026 for the Analytic Bytes Library. This is a measurement read of a published essay, not a position on AI policy. Claims about what We Must Pace the Frontier argues were checked against the essay itself, snapshot taken 14 September 2026. The OpenAI response is cited from press coverage; the post itself was not loaded. Claims about evaluation practice come from the AB measurement arc linked above.
Questions, pushback, or a problem that looks like this one? Write to chai@analyticbytes.systems.