The Permission Layer
How AI markets become dangerous when regulation closes the exits.
The case against classical-liberal AI politics begins with a legitimate fear: AI could become the control layer of modern life. If a small set of approved systems come to mediate speech, employment, finance, medicine, and identity, political liberty will shrink even while those systems stay nominally private.
That fear deserves attention, and private ownership alone does not produce the outcome. A competitive tool turns into a permission layer through a familiar institutional process, as incumbent firms, public agencies, procurement rules, compliance burdens, and national-security claims harden an open market into an administered one. Classical liberalism has no reason to flinch at the danger, because its own tradition supplies the vocabulary for it: public-choice theory, rent-seeking, regulatory capture, monopoly privilege, and political authority laundered through private institutions.
The current market still looks contestable
AI today looks more like a tournament than a settled regime. Large firms compete at several layers of the stack at once — frontier models, coding agents, search, open-weight releases, consumer assistants — and users move among systems, developers switch APIs, enterprises multi-source, open weights keep pressure on the closed vendors, inference costs keep falling, and model quality turns over fast enough that yesterday’s leader can lose its practical edge in a few product cycles. Each of these is a feature of the market as it stands now, observable but not guaranteed to hold.
Shullenberger’s sovereignty claim has to explain why a market with rapid model churn, open-weight alternatives, falling inference costs, and live API switching should already be treated as a political control structure. A company with millions of users has power in the ordinary commercial sense. It takes on political character only when customers, developers, institutions, and rivals can no longer realistically route around it, and the burden sits with the centralization thesis to trace the path by which preference becomes dependency, dependency becomes exclusion, and exclusion becomes rule.
Scale economics are real
The competitive picture could change, because frontier AI has serious scale economics: data centers, advanced chips, energy contracts, capital, and scarce talent. A market can concentrate through ordinary economic force without any regulator picking the winner, and a classical liberal should concede that at once. High fixed costs, network effects, data gravity, and a customer preference for integrated systems can all drive concentration. Concentration does not prove coercion, but it does kill any lazy assumption that competition maintains itself.
The liberal question is contestability. Can new entrants train or fine-tune capable systems? Can customers leave with their data and workflows? Can developers route across providers, and open models keep circulating? Can specialized systems still beat general ones in particular domains, and inference keep getting cheaper? A concentrated market with live entry, real substitution, and portable customers belongs in a different political category from a closed market protected by law, and the difference is the whole argument.
“Essential” is a dangerous word
The claim that AI may become essential cannot carry the weight placed on it, because anything valuable can be redescribed as essential. Food is essential, housing is essential, search and payments and cloud hosting are all essential, and AI may well become essential for many kinds of work. None of that converts a private firm into public property. A company does not forfeit its rights because it built something useful enough that people came to rely on it, and a model provider does not become a public utility because customers prefer its system.
Exit gives the analysis the edge that “essential” cannot. Can customers leave without losing their business? Can rivals reach those customers, and developers build substitutes? Can a lawful competitor get chips, cloud, distribution, and payment rails, and can an institution choose another vendor without regulatory punishment or procurement lock-in? “Essential” invites political opportunism. Exit keeps the argument tied to actual control.
Dependency can exist without coercion
Digital markets manufacture dependency by means that look nothing like old-fashioned force. Network effects, switching costs, identity graphs, stored data, and default settings can all make leaving expensive, and a person can stay legally free to go while facing real losses for going. Calling every such loss coercion stretches the word until it breaks. A service that is hard to leave because it is useful and well-integrated is not the same thing as a state mandate, a legal prohibition, or a threat, and liberal analysis has to keep those categories apart.
Dependency still earns scrutiny. A liberal order can defend property rights while favoring portability, interoperability, anti-tying enforcement, and a hard look at exclusionary conduct, all of which preserve the conditions that make markets work without turning successful firms into wards of the state. AI sharpens the issue because the product may become a cognitive routing layer. A general assistant wired into your work, correspondence, code, payments, and documents is far harder to leave than a standalone app, and practical exit can rot away long before legal exit disappears.
Agents are portable by architecture
The usual objection to AI portability pictures an enterprise agent as a proprietary mind that spends years absorbing tacit institutional context until it cannot be moved. That picture mistakes a bad hosting pattern for the nature of agents. Most durable agent value lives outside the foundation model. Prompts, tool schemas, MCP servers, workflow graphs, memory stores, and integration code can all be represented as external artifacts. The model supplies reasoning, language, and tool use; the substrate around it can be stored, versioned, audited, exported, and reattached to a different model.
Portability will never mean identical behavior after a switch, since different models carry different inference patterns, latency, tool-use habits, and refusal boundaries. That variance is real, and it is ordinary implementation friction, not proof of captivity. A useful portability regime would aim at the substrate: let users and enterprises export prompts, tool definitions, workflow graphs, memory records, logs, and integration specs in documented formats where feasible. The goal is not to copy an agent’s soul but to stop vendors from turning hosted state into a hostage asset. Architecture decides most of the politics. Agents built on open protocols, external memory, and replaceable models keep exit alive; agents buried in proprietary environments with opaque memory and non-exportable workflows destroy it.
Property becomes political when it governs non-owners
Private property protects liberty by carving out bounded zones of control. You can own a house, a shop, a server, a model, or a dataset without ruling anyone else’s life: customers can leave, competitors can enter, dissenters can build around you. The trouble starts when owning an asset gives the owner standing authority over people who have no realistic way around it. A payment processor that can shut lawful firms out of commerce holds a power no restaurant holds. A dominant app store that gates all software distribution is a chokepoint, not a bookshelf. An identity provider fused into public services has stopped being a convenient login button.
AI could cross into that category. A chatbot with competitors is an ordinary product. An approved AI layer required by banks, hospitals, courts, employers, or government agencies becomes part of the civic operating system, and at that point private ownership turns into the surface through which public authority is administered. Valuable assets become political instruments when law, procurement, standards bodies, or protected chokepoints make them unavoidable.
Capture will speak the language of safety
The most plausible road to AI centralization runs through regulation. Incumbents compete while the market is open, then develop a taste for strict standards once they have the lawyers, compliance departments, government relationships, and capital to survive them. AI offers unusually convenient language for this. Safety, alignment, national security, misinformation, child protection, and biosecurity all name genuine concerns, and all can be used to write rules that freeze the market in place.
The pattern is predictable. Safety regulation becomes licensing, licensing becomes an incumbent moat, government pre-release review becomes de facto approval, and liability rules crush open-source developers while large vendors absorb the cost. Evaluation regimes get written by the firms being evaluated, procurement locks public agencies into approved providers, and national-security arguments restrict chips, weights, and APIs. The market keeps private ownership and loses its openness: firms still compete, but inside a politically managed zone. That zone is the thing classical liberals should be attacking.
Dangerous capability requires narrow law
Not every AI risk can be left to clean up after the fact. Fraud automation, cyber intrusion, scalable impersonation, and dangerous biological assistance can spread faster than ordinary civil remedies can answer, and capability can matter before any visible downstream act appears. A model that materially lowers the barrier to mass fraud or biological design creates a risk at the point of access and deployment, and a liberal regime should admit this without handing the state a general power to license intelligence.
Rules written in advance should target conduct, deployment context, and demonstrable reckless enablement. Fraud, impersonation, intrusion, and extortion already sit inside the criminal law. High-stakes integrations — medical decisions, weapons, financial access, critical infrastructure, identity verification — can carry domain-specific duties. But the risk category has to stay narrow. General-purpose model development should not require political approval, open-source publication should not be suspect by default, and frontier labs should not win veto power over future competitors through safety boards and evaluation cartels they helped design. A legitimate restriction has to name all four of its parts: the capability, the access condition, the misuse pathway, and the remedy, and it has to leave lawful general-purpose development no more constrained than that specific harm requires. A rule aimed at a specified fraud, intrusion, or deployment context can fit inside ordinary law. A rule that hands officials open-ended discretion over lawful computation is the approval regime incumbents have wanted all along.
A liberal AI program
A classical-liberal AI policy defends entry, exit, and contestability at every layer of the stack. On entry, that means protecting open-source development, keeping compute markets open, and refusing to let licensing thresholds or mandatory release approval become moats for the firms big enough to clear them. On exit, it means portability for data, workflows, logs, agent state, and identity where feasible, plus interoperability so competitors do not have to ask incumbents for permission. On conduct, it means liability for concrete misconduct and deceptive claims, clear enforcement of contracts, real penalties for fraud and intrusion, and scrutiny of tying, exclusion, and collusion.
The same policy resists state-backed censorship infrastructure, approved-model lists, politicized compute allocation, and any regulatory scheme that makes only large firms safe enough to operate. Public-private coordination earns suspicion exactly when it hands incumbents privileged access to regulators, procurement, or the writing of the rules. Nothing in this is anti-company. The aim is to keep market position from converting into legal privilege, and to keep governments from turning AI risk into the pretext for a managed computational economy.
Postscript
Classical liberalism fails if its defenders go naive about corporate power the moment that power puts on private-sector clothing. A firm can be self-interested, manipulative, exclusionary, censorious, and politically ambitious, and a liberal is under no obligation to pretend otherwise. But corporate ambition still does not justify a licensing state. The remedies are open entry, legal neutrality, portability, liability for misconduct, and a refusal to let public authority harden into an incumbent moat.
AI centralization, if it comes, will come through an alliance: firms seeking shelter from competition, agencies seeking control over deployment, politicians seeking censorship and surveillance, and bureaucracies seeking a permanent approval role over new technology. AI stays a technology market for as long as the exits stay open, while users can switch, developers can build, models can circulate, and no agency gets to pick permanent winners. Close those exits through licensing, procurement, liability asymmetry, or compute control, and it becomes an administrative system in a market’s clothes. Catching that conversion is what classical liberalism is for, and AI is the test of whether its defenders mean it or only ever cheered whoever was winning.