All walkthroughs · Paper briefs

Buying Time Against AI Proliferation: The Economics of Governed Access

Tobias Sytsma (RAND Center for the Geopolitics of Artificial General Intelligence)
RAND Research Report RR-A4996-1, released 3 September 2026

Paper · Brief and rating · Dashboard entry

About 22 minutes · Download MP3

AI-generated walkthrough with synthesised voices: a host explains the paper and a discussant questions it. It covers claims, methods, key assumptions, citations and use so far, decision relevance, and what an evaluator should check. Every direct quotation was checked word for word against its source. Public sources only. Not an Unjournal evaluation or decision.

Transcript

Host
This is a walkthrough of Buying Time Against AI Proliferation: The Economics of Governed Access, by Tobias Sytsma, a RAND research report, number R R dash A forty-nine ninety-six, released in September twenty twenty-six by RAND's Center for the Geopolitics of Artificial General Intelligence. It has about twenty pages of main text and forty pages of appendixes. This is an AI-generated walkthrough, not an Unjournal evaluation or decision.
Discussant
What question is the report asking?
Host
Most AI governance analysis looks at supply: export controls on chips, licensing, which capabilities exist and who can build them. Sytsma looks at demand. Once capabilities exist, millions of firms and individuals decide whether to use AI and through which channel. Some channels are governed, meaning a provider can monitor use, restrict it, and update or revoke access, as with an application programming interface from a major lab. Others are ungoverned: leaked or stolen model weights, open-weight releases, unlicensed deployments. Policies such as liability rules, subsidies and enforcement change the relative cost of these channels. The author states the central question directly. He writes: "When policy changes the relative cost of AI access, how do users reallocate across governed and ungoverned channels, and under what conditions does that reallocation reduce, fail to affect, or accelerate uncontrolled proliferation of AI?" His image for this is a balloon. He writes: "Like compressing one end of a balloon, policies that make one access channel more expensive send users somewhere else, either into a channel that is easier to oversee or into one that is more difficult to oversee."
Discussant
And the headline results?
Host
Three. First, compliance burdens placed only on governed channels can backfire, pushing users toward ungoverned ones; in the simulations this happens in roughly a quarter of runs that apply such a burden. Second, three demand-side conditions predict whether a policy works: how responsive adopters are to cost differences, how effectively enforcement raises the cost of ungoverned access, and how costly it is to switch between channels. The pace of AI capability growth is not among the main predictors of which policy works. Third, capability growth does determine whether any of these price-based policies can work at all. Past some point, the value of frontier AI swamps every fixed cost wedge, and no instrument in the model has traction. He calls this the policy traction boundary.
Discussant
Let's get into the model. What is the state space?
Host
A unit mass of adopters, each in one of four states. Non-adoption. Intermediate AI, meaning bounded, safety-constrained tools that deliver productivity gains but cannot match frontier capability. Controlled frontier, meaning frontier models through monitored channels. And uncontrolled frontier, meaning frontier capability through channels without oversight. Adopters get revision opportunities that arrive as a Poisson process, and at each revision they choose a destination by comparing net value minus a one-time switching cost, plus an idiosyncratic shock. The shocks are type one extreme value, so you get standard multinomial logit choice probabilities. The logit scale parameter, which he calls psi, governs how responsive adoption is to value differences.
Discussant
So a dynamic logit adoption model, with no forward-looking behavior beyond what is folded into flow values.
Host
Yes. Net value for each state is value minus generalized cost. Value has three parts: intrinsic value, which rises with a single frontier capability index; linear network effects in each state's share; and for intermediate AI, an integration capital stock that accumulates with intermediate adoption and depreciates. That stock both raises the value of staying in intermediate AI and raises the cost of switching out of it, so it creates lock-in. On the cost side, intermediate AI pays only its price. The controlled frontier pays the frontier price plus a compliance and liability wedge. The uncontrolled frontier pays the frontier price plus an access friction that rises exponentially in enforcement intensity, scaled by what he calls the deterrence semi-elasticity. The uncontrolled channel also gets a compliance-avoidance benefit, and the two frontier channels can differ in intrinsic value, so ungoverned access can be up to roughly forty percent more valuable than governed access in the scenarios.
Discussant
You said leakage. Is that a choice?
Host
No, and this is the second channel of proliferation. Besides voluntary choice, the controlled frontier stock converts into uncontrolled frontier at a hazard rate, standing for weight theft, unauthorized replication or loss of monitoring. That hazard falls exponentially with enforcement, rises with capability, rises with the value gap between the uncontrolled and controlled channels, and falls with intermediate adoption. The uncontrolled state is treated as near-absorbing: adopters there cannot choose to leave, and it empties only through an exogenous recontainment rate, which is zero, one percent or five percent a year in the simulations. The reason given is that leaked weights copy at near-zero cost.
Discussant
And capability itself?
Host
A single index that grows through baseline research and development, deployment feedback from frontier use, proportional growth and a superlinear term meant to allow a fast takeoff, damped by a soft cap. Frontier value is a convex function of the index. Intermediate value rises with frontier capability but saturates at a ceiling.
Discussant
What are the policies?
Host
Five levers, each a continuous intensity from zero to one. S-Price subsidizes intermediate AI, lowering its price toward zero. S-Switch is integration assistance that cuts switching costs into intermediate AI by up to eighty percent. S-Both bundles those two. T is the compliance cost wedge on the controlled frontier, raising its cost burden up to half of flow value. And E is enforcement against uncontrolled access, which at full strength doubles enforcement intensity. Enforcement is distinctive because it acts on both channels: it raises the cost of choosing ungoverned access and suppresses the leakage hazard. The others act only on choices.
Discussant
How is success measured?
Host
With a metric called safe-time equivalent. Each year counts as one safe year minus an exposure index that rises with the ungoverned share. The exposure index is the ungoverned share divided by a scale parameter, raised to a curvature power, capped at one. With a scale of ten percent, a ten percent ungoverned share already counts as maximal exposure. Summing over a thirty-year horizon gives a number between zero and thirty. Time bought is the policy's safe-time equivalent minus the no-policy baseline in the same scenario, and success is defined as buying at least two years.
Discussant
And the simulation design?
Host
He uses Robust Decision Making, a RAND approach that stress-tests policies across many simulated futures without assigning them probabilities. There are forty-two uncertain structural parameters, forty-nine sampled quantities in total. He draws one thousand scenarios by Latin hypercube sampling, which stratifies each parameter's range, and runs each lever at eleven intensities: fifty-five thousand runs, plus thirty-three thousand runs for three combined portfolios. He sorts parameters into tiers. About twenty percent are anchored on outside literatures: for example, the deterrence semi-elasticity draws on the crime deterrence literature, the depreciation of integration capital on intangible capital estimates, and the compliance wedge, set between one and ten percent of flow value, on evidence about Sarbanes-Oxley and cyber insurance costs. About twenty percent are disciplined by internal consistency, and about sixty percent are exploratory, with wide ranges.
Discussant
So what comes out?
Host
The baseline itself is very dispersed. Baseline safe time runs from a quarter of a year to thirty years, median twenty-three. About a third of scenarios are above twenty-eight, leaving no room for a two-year gain, and about thirty percent are below five. Even when he restricts to scenarios where the four capability-growth parameters sit in the middle of their ranges, the interquartile range of baseline safe time runs from about two to about twenty-nine years. He concludes that "capability growth, alone, does not determine baseline urgency." Then the lever comparison. At the intensity that maximizes time bought, enforcement succeeds in forty-seven percent of scenarios, the bundled subsidy in about thirty-one percent, integration assistance twenty-two, the compliance wedge twenty-one, the price subsidy thirteen. Among the six hundred seventy-five scenarios where a two-year gain is attainable, enforcement succeeds about seventy percent of the time. It is the best or tied-best lever in seventy-seven percent of scenarios. When it succeeds, the median gain is about five and a half years.
Discussant
That sounds like a strong case for enforcement. How much of it is built in?
Host
The author is candid about this. He writes: "Enforcement against uncontrolled access outperforms other levers, though its advantage is structural rather than empirical". The model gives enforcement two margins and every other lever one. In the mechanism caveat section he adds that "the instrument hierarchy reported in the findings should be read as conditional on these mechanism assignments, not as an unconditional ranking of policy instruments."
Discussant
And the backfire result for the compliance wedge?
Host
The wedge produces negative time bought in twenty-two percent of its eleven thousand runs, or twenty-five percent of runs at positive intensity. The logic, in his words: "This is a simple cross-price result, where raising the price of one substitute without changing the price of the other redirects demand." Appendix B formalizes it. He defines gross uncontrolled proliferation pressure as the flow into the ungoverned state, by choice plus leakage, and computes each lever's first-order reduction of that flow per unit of effort. Proposition one gives closed forms. Proposition two derives the regions where each lever locally dominates. The compliance wedge has no such region: at any interior state its local effect on proliferation pressure is perverse. So wherever it does well in the simulations, it does so through slower stock effects, by shrinking the controlled stock from which leakage originates. The classification tree puts the wedge's favorable region where enforcement is effective, so burdened users do not flee to ungoverned channels, and where switching into the controlled frontier is cheap.
Discussant
And the traction boundary?
Host
That is proposition three. Fix any policy posture. Assume frontier value grows without bound, intermediate value is capped, and integration capital depreciates. Then every policy wedge shrinks to zero relative to frontier value, the probability of choosing intermediate AI goes to zero, and if leakage rises with capability, the leakage hazard diverges. He writes: "In the model, fixed instruments can delay proliferation, but they cannot permanently sustain the wedge on which their effectiveness depends."
Discussant
The classification tree is where the policy advice comes from. What does it say?
Host
He trains a classification tree on which lever is best in each scenario, with equal class priors so that rare winners show up. The first split is adoption responsiveness: below a threshold, in about seven percent of scenarios, no lever works well. Next is the deterrence semi-elasticity: when it is high, about fifty-four percent of scenarios, enforcement wins; when it is low, ecosystem levers are preferred, sorted by switching costs. He draws two practical messages. Policymakers should monitor adoption responsiveness, enforcement effectiveness and switching barriers, and measurement infrastructure, such as enterprise adoption tracking and weight security monitoring, may pay off more than any single instrument. And he notes that demand-side support, such as procurement preferences and integration assistance, is missing from the debate. He says these instruments "are nearly absent from the frontier AI policy debate."
Discussant
Does combining levers help?
Host
Somewhat. Enforcement plus the bundled subsidy raises success from forty-seven to fifty-four percent of all scenarios and from seventy to eighty percent of attainable ones. The median gain over the best single component is small, about six hundredths of a year, but the pair succeeds in thirty-nine scenarios where neither component does alone.
Discussant
How has the report been used and cited so far?
Host
Very little, which is unsurprising a month after release. OpenAlex lists the report with a digital object identifier and no citing works as of early October twenty twenty-six. We found no press coverage. A civic deliberation site, Society Speaks, created a discussion page from the report the day after release, with no participants when we checked. The closest related work is the author's own companion report from August, The Economics of AI Counterproliferation, which looks at how falling reproduction costs widen the pool of actors who want a dangerous capability and argues that export controls buy time without permanent containment. So any uptake will come later, and a search miss here is uncertainty about use inside government, which would not show up in public citations.
Discussant
Who would act on it?
Host
Three audiences. Regulators and legislators weighing compliance obligations on frontier developers, such as deployment licensing, liability, or open-weight restrictions. The report's message to them is conditional: "Absent credible enforcement against ungoverned alternatives, the substitution risk is a first-order concern rather than a second-order caveat." Security and law enforcement agencies, since the model treats weight security and action against illicit deployment as the most effective steering tool. And funders, given the argument for measurement infrastructure and the gap on demand-side programs. The report also discusses distillation, the practice of compressing a frontier model's capabilities into a smaller model, and shows the policy sign depends on whether distilled models act as leakage or as governed intermediate AI. The funding statement lists philanthropic donors including Coefficient Giving, Good Ventures, Founders Pledge and Longview, and says donors had no influence on findings.
Discussant
Why would it suit an Unjournal evaluation?
Host
It makes concrete, model-based claims that are already being framed for policy, it is clean enough for an industrial organization or trade economist to check line by line, and its weak points are the kind evaluation can surface: assumptions, internal consistency and whether the decision rules follow from the model. The report also has an unusual disclosure. The author says he used Claude and ChatGPT as thinking partners in specifying the model and writing the simulation code, used an automated replication-audit skill on the code, and used an AI referee tool before RAND's quality assurance. A human evaluation would add a different check.
Discussant
Then let me give the critiques. First, the hierarchy. If enforcement wins because it was given two margins, and the compliance wedge loses because it was given one, then the main ranking is close to an assumption. Real compliance regimes often include security requirements that reduce leakage. The author says as much in the limitations, but the key findings box leads with the backfire result as if it were a finding about the world.
Host
He would answer that the structural claim, instruments acting on both channels beat those acting on one, is the robust part.
Discussant
That is close to a tautology in this model, so an evaluator should ask what the model adds beyond it. Second, the observability claim. The tree's splits are on the logit scale, the deterrence semi-elasticity, and switching costs in model units. The report's own calibration appendix says the logit scale cannot be interpreted apart from the value levels. Saying these can be inferred from enterprise adoption data and enforcement records is a long step. An evaluator should ask what estimation strategy would identify them and whether the thresholds, such as a responsiveness of zero point eight two, mean anything outside this parameter box.
Host
Third?
Discussant
Success rates are shares of an arbitrary box. With uniform sampling over mostly exploratory ranges, forty-seven percent is a statement about the box, which RDM does not claim to be a probability distribution. The tree's leaves are also modest: one compliance-wedge leaf covers a quarter of scenarios and is right in twenty-four of two hundred forty-six. Fourth, the traction boundary. Proposition three needs frontier value to grow without bound, but the simulated capability index has a soft cap. An evaluator should check whether the simulations actually show the boundary or whether it is only an asymptotic result. Fifth, the welfare object. The exposure metric counts shares of adopters, all equally, so a hobbyist running leaked weights counts like a state lab; and with the scale as low as five percent, small shares saturate it. The author excludes well-resourced state programs as not price-takers, which removes the actors many people worry most about.
Host
He flags partial equilibrium and the single jurisdiction as limitations too. He notes that "a competing state can host ungoverned channels beyond the reach of coordinated enforcement", and says the single-population results likely overstate what enforcement can deliver.
Discussant
Yes, and the same applies to exogenous prices. Providers would respond to subsidies and wedges, and open-weight releases are supply decisions. Sixth, internal consistency, which a careful referee should go through. The backfire rate appears as roughly a quarter, twenty-two percent, and approximately one in five in different sections. The text says the wedge's good region needs a weak leakage response to enforcement in one place and a high deterrence semi-elasticity in another. Recontainment returns mass to non-adoption in one figure note and to intermediate AI in the equations. The constraint on integration effects is about seven units in the text and five and ten in the table. Several archetype parameters, such as a network effect of ten or a revision rate of zero point one two, lie outside the sampled ranges. And a footnote says price levels are stationary in reality where it seems to mean the reverse. None overturns the argument, but they suggest checking the code against the text.
Host
Is the code public?
Discussant
The report refers to an archetype script in the analysis code, but we did not find a public repository. An evaluator should ask for it. Last, the effort weights. The author calls them "stylized ordinal judgments rather than measured quantities", and they only affect per-effort efficiency, so they matter less than they first appear.
Host
To close on the author's own framing of what the window is for. He writes that a strategy which buys years of reduced exposure "but spends those years in political stalemate, institutional inertia, or complacent delay has purchased an option and let it expire." The report is a clear, honest, stylized framework. Its value for decisions depends on whether the mechanism assignments and the demand-side substitution assumption hold, and on whether its key parameters can be measured.

Sources