Gov-cloud model gating: FedRAMP and the compliant government stack

status: watch, opened 2026-09-12, last moved 2026-09-12. AI microsoft openai anthropic us regulation

• The thread: which frontier models carry government-cloud certifications (FedRAMP Moderate etc.) and which are locked out of the compliant stack — the government-market mirror of the consumer bundling race. Seeded by request: a shop limited to FedRAMPed models via GitHub Copilot. Precision bar applies: report published authorizations, not assumptions.
• 2026-09-12: opened. Baseline capture — GitHub Copilot's "Restrict Copilot to FedRAMP models" enterprise policy (GitHub docs, current as of Sep 12) allows only: GPT-4o mini, GPT-4o, GPT-4.1, GPT-5.2, GPT-5.2-Codex, GPT-5.3-Codex, Claude Haiku 4.5, Claude Sonnet 5, Claude Opus 4.8, Claude Opus 5. Enforcement carries a 10% AI-credit premium (compliance-certified endpoints). Docs note availability changes over time and new models "may take additional time" to certify. Everything current-gen is absent: GPT-6 Astra, Fable 5.1, Gemini, Grok — none FedRAMP-listed here. Adjacent track: OpenAI's GSA distribution deal (openai-bundling thread) is the other government-market leg.
• Watch for: FedRAMP Moderate authorizations for GPT-6-gen/Astra, Fable/Mythos-class, Gemini, or Grok (watch the FedRAMP marketplace and GitHub's policy page); whether M365-Copilot Grok ever gets a government-compliant SKU; OpenAI's federal expansion vs compliance gating; how agency AI policies track the list.