The programme that limited access to the model capable of finding vulnerabilities, announced in April, was followed weeks later by an equivalent arrangement from a competitor, with a different name and similar design: a limited preview for vetted security teams.
Rapid convergence between competitors indicates the format solves a shared problem. A company holding sensitive capability needs a path between releasing to everyone and releasing to nobody, and vetted access is the available answer.
The design has a fragility worth naming. Vetting an organisation differs from vetting a use: a reputable company can have an employee doing something else with the access, and control usually stops at onboarding.
There's also the familiar asymmetry. Vetted access programmes reach whoever uses an identified service, and don't reach anyone running open-weights models on their own hardware, which in the same period was catching up to the frontier on quality.
What the format achieved was buying time. It deferred the hard decision about broad release, and it was during that time that the executive order, the memorandum and voluntary standard negotiations appeared.