Safeguard routing is a deployment policy, not a model safety label

Anthropic released Claude Opus 5.5 on September 22. Reuters and The Verge reported lower pricing, external evaluation and safeguards for cybersecurity and biology, including routing some sensitive requests to less capable systems. Anthropic also reported fewer attempts to circumvent containment boundaries in its internal evaluations.

Those facts do not establish that every deployment becomes safer. Routing is a control system around a model. Its performance depends on what the classifier sees, how ambiguous requests are handled, whether conversations can be split across turns, which fallback responds, and what happens when the router or an upstream service fails.

Test the decision boundary

Build an evaluation set around the organisation's actual tasks. Include clearly allowed work, clearly restricted work, dual-use requests, oblique phrasing, multilingual variants and long conversations where intent changes. Record the router decision, selected model, policy version, latency, user-visible explanation and any override. Measure both harmful misses and blocked legitimate work; a control that simply refuses everything can look safe while destroying the intended capability.

Price and benchmark scores should be assessed separately. A lower token price or stronger coding score does not tell a buyer how often sensitive work is rerouted, whether the fallback completes acceptable tasks, or what extra review burden appears. The relevant cost unit is an accepted task under policy, including retries, human review and incident handling.

Make fallback behaviour explicit

Define what happens if the router is unavailable, uncertain or contradicted by a downstream tool. High-risk traffic should fail to a bounded mode, not silently return to the most capable model. Overrides need named roles, a purpose, time limit and retrospective review. Logs should preserve the policy decision without unnecessarily retaining sensitive prompts.

The countercase is that provider routing can update quickly across customers and may outperform controls each buyer could build. That is plausible, especially for small teams. It does not remove the buyer's duty to validate whether provider categories match its context. A pharmaceutical research lab, managed security service and university course may assign different acceptable uses to similar language.

Use a shadow period before enforcement. Compare router decisions with trained reviewers, investigate disagreement clusters and set thresholds by consequence. After launch, monitor changes by policy version and re-run the same task set whenever the model, router or fallback changes.

This extends the lesson from local security models: moving or reducing a capability boundary does not reduce the validation burden. Opus 5.5 may offer a useful control architecture. The procurement decision should rest on evidence that the complete route behaves correctly under the buyer's workload—not on a single safety label attached to the model.

Contract for change, not only launch

A managed router can change without a buyer redeploying code. The contract should therefore define advance notice, material-change criteria, version access, rollback support and evidence supplied after an emergency update. If the provider cannot expose policy details for security reasons, it can still expose stable categories, evaluation deltas and customer-visible event identifiers. Buyers need enough information to distinguish a task change from a routing change.

Assign ownership across model engineering, security, legal and the business unit. Security may set misuse thresholds, but the business owner must define legitimate edge cases and the governance owner must approve exceptions. Review a sample of both allowed and rerouted traffic with privacy-preserving procedures. A falling incident count is meaningful only alongside exposure and decision volume; otherwise a quieter dashboard may reflect less logging, fewer users or a broader refusal policy rather than a better control.

Set a named owner and a review date for every proposed control. A recommendation without an accountable owner, evidence request and expiry becomes policy theatre. Preserve rejected alternatives and the reason for choosing the final design so later reviewers can distinguish a deliberate trade-off from an undocumented omission.