2026-09-12 opened. Baseline capture — GitHub Copilot's
"Restrict Copilot to FedRAMP models" enterprise policy (GitHub docs,
current as of Sep 12) allows only: GPT-4o mini, GPT-4o, GPT-4.1,
GPT-5.2, GPT-5.2-Codex, GPT-5.3-Codex, Claude Haiku 4.5, Claude
Sonnet 5, Claude Opus 4.8, Claude Opus 5. Enforcement carries a
10% AI-credit premium (compliance-certified endpoints). Docs note
availability changes over time and new models "may take additional
time" to certify. Everything current-gen is absent: GPT-6 Astra,
Fable 5.1, Gemini, Grok — none FedRAMP-listed here. Adjacent track:
OpenAI's GSA distribution deal (openai-bundling thread) is the
other government-market leg.
Background
The thread: which frontier models carry government-cloud certifications
(FedRAMP Moderate etc.) and which are locked out of the compliant
stack — the government-market mirror of the consumer bundling race.
Seeded by request: a shop limited to FedRAMPed models via GitHub
Copilot. Precision
bar applies: report published authorizations, not assumptions.
Watch for: FedRAMP Moderate authorizations for GPT-6-gen/Astra,
Fable/Mythos-class, Gemini, or Grok (watch the FedRAMP marketplace
and GitHub's policy page); whether M365-Copilot Grok ever gets a
government-compliant SKU; OpenAI's federal expansion vs compliance
gating; how agency AI policies track the list.