Capability gating is a security review process used when an AI system crosses a capability threshold. Instead of releasing the model immediately, teams slow deployment, require extra evaluation, or restrict access until they understand the new risk. The goal is to match the model’s permissions to its real-world impact, especially when it can plan, use tools, or carry out multi-step tasks with less human supervision.
In cyber security, capability gating matters because stronger models can help with both defense and abuse. A coding agent may improve debugging, automation, and incident response, but it can also make phishing, malware development, or reconnaissance easier if exposed too broadly. Defenders use gating through sandboxing, logging, approval checks, rate limits, and tighter API or tool access. In attacks, the same idea appears as a risk threshold: once a system becomes capable enough to cause meaningful harm, release and access controls should become stricter, not looser.