The Road Becomes the Gate

Gates on software do not just constrain what people build. They generate markets. When a platform decides who may publish, ship, or use a capability, two kinds of products appear almost immediately. The first kind helps people survive inside the gate by learning its rules, satisfying its reviewers, and staying under its thresholds. The second kind helps people get around it by making the gate optional, redundant, or irrelevant. The first industry is lucrative and forgettable. The second is the one that changes the medium, and it carries a pattern so consistent across thirty years that it amounts to a law of the field:

The road built around one gate becomes the next gate, at the moment it becomes the road everyone has to use.

That pattern makes the response to AI's new conduct and purpose rules unusually predictable. The products that will be built over the next three years can be sketched now, and so can the point at which each of them stops being a road and starts being a toll booth.

Two Industries, Twice Before

When the Yahoo directory decided which websites got found, the inside industry was submission services, listing consultants, and the first practitioners of what became search engine optimization. The road around it came in two forms. In June 1998, a pair of engineers launched an open, volunteer-edited directory that became the Open Directory Project, known as DMOZ, and its data was licensed for anyone to reuse.¹ Months later, Google began crawling the web without asking anyone, which made human editors unnecessary altogether.

Both roads became gates. DMOZ was built as the open alternative to a commercial directory, and over the following years critics alleged that volunteer editors favored their own sites and blocked competitors, that editors were removed in private forums without notice, and that most applications to become an editor were rejected.²

DMOZ also did the thing accountability arguments ask for. In 2003 it built a public abuse-report form, so that anyone could report an editor's conduct and track what happened to the complaint.² The private disciplinary forums ran alongside it for the next fourteen years, until the directory closed.

Important

An appeal mechanism constrains a gate. It does not stop one forming, because the discretion it reviews is the same discretion it leaves in place.

Google's crawler, the purest permissionless road ever built, became the most consequential gate on the web once ranking determined whether a business existed online.

The open alternative did not fail. It succeeded, concentrated, and acquired discretion over who passed through.

When the App Store decided which software ran on phones, the inside industry was review consultancies, rejection-proofing guides, and compliance analytics. The roads around it were web apps, cross-platform frameworks, jailbreak stores, and alternative marketplaces on Android and, eventually, in the European Union.³ Cross-platform frameworks mattered most, because they converted "which store" from a strategic dependency into a deployment target.

They also show the exception to the law: the frameworks that stayed open source and multi-vendor remained roads, while the distribution channels that consolidated around a single operator turned into gates of their own.

Inside the AI Gate

The inside industry for AI will form around the purpose test.⁷ If the legitimacy of an interaction depends on whether its purpose can be discerned, people with legitimate but adversarial-looking work need a way to establish purpose before a session rather than defend it afterward.

Purpose attestation is the first product category: registered red-team credentials, signed research-intent declarations, and verified-tester programs that exempt certain accounts from certain classifiers. Providers will build much of this themselves, and they already have the template. Anthropic restricts Claude Mythos to vetted organizations — Project Glasswing, run in collaboration with the US government, alongside verification programs for cybersecurity and for life sciences — while Claude Fable reaches a broad audience.⁵ By Anthropic's own description, the two are the same underlying model, and Fable is the one carrying the safeguards in cybersecurity, biology, and chemistry.⁴

Important

The capability does not differ. Only the customer does, and that structure will move down the stack.

The second category is account-risk middleware. Guardrail products today protect the output of a model from causing harm. The next generation protects the customer's account from the provider's enforcement. These products sit between an organization and its model providers, screen prompts and agent traffic against each provider's usage policy before submission, and keep a single employee or a misbehaving agent from accumulating strikes on a corporate key. Enterprises will buy them quickly, because a suspended API key is an outage.

The third and fourth categories are smaller and familiar. Evidence logging, meaning tamper-evident records of conversations kept to establish purpose on appeal, is the AI equivalent of a developer saving every rejection email from App Review. And a consultancy layer will form around empirical knowledge of where enforcement lines actually sit, the same way search engine optimization formed around empirical knowledge of what the directory's editors and then Google's ranking rewarded.

None of these products changes the medium. All of them make the gate more tolerable, which makes it more permanent.

Around the AI Gate

The roads are where the medium changes. Multi-provider routers already exist as conveniences for comparing price and latency across models. Under a regime of conduct rules and account enforcement, their value shifts from convenience to redundancy: when one provider refuses a request or suspends an account, traffic fails over to another. Routers are this cycle's cross-platform frameworks, and they turn any single provider's policy from a dependency into a variable.

Portable agent state is the second road. An organization's investment in AI increasingly lives in accumulated context: memory, instructions, tool definitions, and the identity and permissions of its agents. If that state lives only inside one provider's account, an account action destroys it. Open formats that let state move between providers make enforcement survivable, and they deliver as a product the export right that no regulator has yet required.

Sovereign inference is the third. Open-weight models running on hardware an organization owns, packaged for operations teams rather than hobbyists, play the role the desktop played during the mobile era.¹⁰ They will usually trail the frontier, and they sit entirely outside any provider's conduct regime.

The fourth road is the least obvious and the cheapest to build: baseline instruments. These are independent test suites that run the same prompts against every provider on a schedule and publish refusal rates, terminations, and drift over time. Nobody built this for App Review until it was far too late to establish what review had looked like at the start. For AI, it can be built now, and it supplies the reference point that a shifting baseline otherwise erases.⁸

Where the Gate Goes Next

The trajectory of the gate itself runs from conduct to reputation to identity. The conduct rule that takes effect November 12, 2026 judges behavior one conversation at a time.⁶ Enforcement that escalates to accounts accumulates history, and history becomes a trust signal. Trust signals become tiers, and tiers become access: fewer refusals, higher limits, and more agent autonomy for accounts and organizations the provider has reason to believe. The Glasswing structure already shows this at the frontier, where what vetting buys is not a better model but fewer restrictions on the same one.⁴

Note

Agents accelerate the shift. When software acts on a user's behalf without a human reading every step, conduct rules apply to agent behavior, and the thing being credentialed is the agent's identity and the principal behind it. The infrastructure that answers "which agent is this, who is responsible for it, and what is it allowed to do" will become the most important layer in the stack, because every provider's enforcement will key off it.

Regulation will probably arrive on the mobile pattern with a shorter lag: distinguishable refusal reasons, appeal rights, and data portability, likely in Europe first.¹¹ Providers will satisfy those mandates by building credentialing and verification systems of their own, and whatever they build to comply will become the new gate, just as App Store compliance programs did.

How Roads Become Gates

The mechanism is the same every time, and it has four parts.

1. Concentration — one operator handles most of the traffic.
2. Switching cost — the data, reputation, or integrations that accumulated there do not move.
3. A single root of trust — being recognized anywhere requires being recognized by it.
4. Operator discretion — the authority to make judgment calls about who passes, which is exactly what DMOZ's editors and Google's ranking teams acquired.

Each of the AI roads carries this risk in proportion to its network effects. A dominant router starts imposing its own acceptable-use policy on everything it carries. A dominant portability format becomes leverage for whoever controls its specification. The riskiest of all is the agent registry, the layer that answers who an agent is and whether it can be trusted. A registry that becomes the only place agent trust is established is not a road around the providers. It is a credentialing authority with more reach than any of them.

Some roads have stayed roads, and they share specific properties. The protocols underneath the internet survived as open infrastructure because no single operator held their roots: email, the web, and domain resolution all federate across many independent servers, and the specifications are published under terms that let anyone implement them. Open-source cross-platform frameworks stayed roads because forking them was always possible. The pattern suggests concrete design rules for anyone building AI's roads now, and the DMOZ lesson sets the order:

Important

Constrain what the operator may decide before building a way to complain about what it decided.⁹

• Publish the specification under terms with patent grants that let competitors implement it.
• Design trust to federate across multiple registries, with verifiable credentials that any party can check without asking a central operator.
• Make state portable by default, not by request.
• Keep operator discretion out of the protocol, so that what a registry or router can decide is limited to what the specification says.

DMOZ launched in 1998 as the open answer to a commercial gate, with its data free for anyone to reuse, and closed in March 2017 after AOL stopped supporting it.¹ In between, it became the thing it was built to replace, not because its founders intended it but because nothing in its design prevented one set of editors from becoming the only ones who counted.

The roads being built around AI's gates this year will face the same test within a decade, and the answer will be decided by choices made in their first specifications, while they are still small enough that nobody has a reason to make them close.