Infrastructure is a governance map, not a target list
Frontier AI depends on advanced chips, semiconductor-manufacturing equipment, large data centers, cloud services, electricity, networking, and trained personnel. That concentration gives governments, operators, customers, and developers lawful ways to impose safety requirements. It does not justify trespass, sabotage, violence, or interference with power and communications. Physical attacks would endanger workers and communities, disrupt unrelated services, destroy evidence, and likely reduce society’s ability to manage an incident.
The useful question is institutional: which authorized actor can limit a risky activity, under what rule, with what evidence, and how can the decision be reversed safely? The answer changes across the AI lifecycle.
Four control surfaces that should not be confused
Training controls govern the creation or major improvement of a model. A frontier training run may use a large, geographically identifiable cluster for weeks or months. Relevant measures include customer due diligence, security standards, compute accounting, pre-deployment evaluations, and contractual or regulatory conditions on exceptionally large runs. Training controls act before a model exists in final form; stopping a run does not recall earlier weights.
Model-weight controls protect the learned parameter files. Weights can be copied, stolen, fine-tuned, and run elsewhere. Security may include hardware-backed access, separation of duties, encryption, monitoring, insider-risk procedures, and incident response. Once capable weights are released broadly, central revocation may be impossible. Open release can support research and competition, so restrictions should be based on demonstrated risk and paired with independent access where feasible.
Deployment controls govern a hosted model or application. An operator can revoke credentials, disable a tool, roll back a model version, limit rate or geography, place a user in a higher-assurance tier, and monitor abuse. These controls are comparatively precise and reversible. They fail, however, if downstream copies, cached outputs, or independently hosted weights remain available.
Inference controls govern the computation used when a system produces outputs or takes actions. Inference may occur in a central cloud, an enterprise environment, a phone, or a distributed cluster. A provider can constrain its own hosted inference but cannot automatically stop local copies. Inference-time compute, tool permissions, data access, and action volume may matter more than original training cost for a deployed risk.
Calling all four a “compute chokepoint” conceals these differences. A lawful intervention should name the relevant surface and expected effect.
Operational control inside an organization
Organizations need more than a dramatic “kill switch.” They need a practiced safe-state procedure. Abruptly terminating a system may corrupt data, interrupt clinical or industrial processes, strand users, or trigger unsafe defaults. The correct response might be privilege revocation, traffic reduction, isolation, rollback, or transfer to manual control rather than powering everything off.
A production plan should include:
- Inventory: identify every model, version, tool, credential, dataset, vendor, and downstream dependency.
- Authority: name the people who can restrict service and define when they may act without waiting for normal approval.
- Least privilege: give the system only the data and actions required for its task; use time-limited credentials where possible.
- Monitoring: log model versions, prompts or safe event summaries, tool calls, approvals, outputs, and configuration changes while respecting privacy.
- Containment: support rapid isolation from networks, tools, money movement, code deployment, or physical controls.
- Rollback: maintain a known-good version, compatible data format, and tested restoration process.
- Human fallback: preserve trained staff, instructions, access, and capacity to provide a degraded essential service.
- Exercise: run tabletop and technical drills, record failures, and correct them.
NIST’s AI Risk Management Framework calls for lifecycle governance, accountability, ongoing monitoring, contingency processes for third-party failures, and safe decommissioning (NIST AI RMF Core). It is voluntary guidance, not a certification that a particular organization has implemented these practices.
Privilege revocation is often the fastest brake
An AI system becomes more consequential when connected to email, production code, financial accounts, laboratory tools, identity systems, or operational technology. Revoking those privileges can reduce harm while preserving the model for investigation. Access should be segmented so one decision can disable a risky capability without collapsing unrelated services.
Credentials must not be embedded permanently in prompts or model files. Operators should use scoped service identities, short expiration, approval gates for high-impact actions, and independent controls that the model cannot modify. Break-glass access needs its own logging and review. A system should not be able to grant itself broader permissions.
For an external vendor, contracts should guarantee timely suspension, evidence preservation, data export, and support for migration. Otherwise the customer may discover during an incident that it cannot inspect logs or revert an automatic update.
Human fallback is infrastructure
Essential services need a workable degraded mode. That does not mean every process can instantly return to paper. It means operators decide in advance which functions must continue, at what minimum capacity, with which staffing and communications. Power, water, health, finance, transportation, and public benefits have different safety constraints.
A manual procedure that no employee has practiced is not a fallback. Organizations should train staff, retain necessary non-AI interfaces, test restoration from offline backups, and measure how long the degraded mode can operate. Vendors and public agencies should coordinate dependencies: a hospital’s plan may fail if its identity provider, cloud service, and pharmacy network all assume the others remain online.
The Cybersecurity and Infrastructure Security Agency recommends incident-response planning, asset understanding, segmentation, and recovery practices for critical infrastructure (CISA Cybersecurity Performance Goals). AI-specific response belongs inside, not outside, established safety and cybersecurity programs.
Government and customer leverage
Governments can attach conditions to procurement, licenses, grants, access to public resources, and regulated critical services. Cloud and data-center providers can conduct due diligence consistent with law. Utilities and local authorities can apply ordinary reliability, environmental, land-use, and emergency-planning rules without turning infrastructure policy into a proxy ban on all AI.
Customers have leverage through contracts. Before purchase, require system documentation, evaluation results relevant to the use case, security notification, version control, audit rights, incident cooperation, data portability, and an exit plan. A customer should know whether the vendor may substitute a new model silently and whether the service remains available during rollback.
These measures need due process. A restriction should have a defined legal basis, evidence standard, accountable decision-maker, duration, and review path. Emergency authority can be necessary, but indefinite secret control invites abuse.
Concentration creates leverage and fragility
Concentrated chip and cloud supply chains can make oversight practical, but they also create single points of failure, market power, and geopolitical vulnerability. Decentralization can improve resilience and competition while making recall and consistent safeguards harder. Neither concentration nor openness is inherently safe.
Policy should distinguish scarcity that reflects real engineering from scarcity created by exclusive contracts or lock-in. Interoperability, multi-cloud planning, common incident formats, and portable logs can reduce dependence without pretending every workload can move instantly.
The practical conclusion
Society retains meaningful leverage over AI through law, procurement, corporate authority, technical access control, and resilient service design. The right action is rarely a theatrical shutdown. It is a specific, authorized intervention at training, weights, deployment, or inference—combined with containment, evidence preservation, rollback, and continuity.
Infrastructure becomes protective when people know who may act and have rehearsed what happens next. Lawful control is strongest when it is precise enough to reduce risk without creating a second emergency.