Anthropic expanded its Cyber Verification Program (CVP) this week, restructuring how it decides which security professionals get access to reduced safeguards on its models. The mechanism is worth noting: it's not a flat permission toggle, it's a tiered identity-verification system that gates capability. Anthropic's own description is direct: We're launching a new, expanded version of our Cyber Verification Program (CVP), which makes advanced cyber capabilities and reduced blocking classifiers available to qualifying security professionals. The company frames the underlying problem in blunt terms: Cybersecurity is inherently dual use: the same capabilities that enable a security team to find and fix a vulnerability can also help a malicious actor exploit it. Because of that, general-release models ship with conservative safety classifiers that block most offensive-security workflows by default. The fix isn't a single access flag — it's a graduated trust ladder. The updated access tiers make specific model capabilities available to security professionals based on the scope of their cyber work. Each has different verification requirements and security controls. The base tier, Defense Access, covers incident response and vulnerability analysis and is open to a wide range of applicants: security teams at companies, nonprofits, universities, and government bodies who are defending systems they own or maintain; operators of critical infrastructure of any size, such as regional hospitals or municipal utilities; smaller security firms; open-source maintainers; and individual researchers with a track record of reported vulnerabilities. A second tier, Red Team Access, extends that to authorized penetration testing, but only for in-house red teams, government red teams, and security and penetration testing firms. organizations authorized against specific systems. What makes this relevant to agent infrastructure rather than just AI product policy: it's a working example of binding model/agent capability to verified organizational identity rather than to a static API credential. The same key doesn't unlock the same powers for everyone holding it — the vetting status attached to the identity behind the key does. That's the opposite design pattern from the static-secret problem that keeps surfacing in MCP deployments, and it previews a shape other agent platforms will likely need as autonomous systems get access to higher-stakes tool calls: capability tied to a verified, revocable identity claim, not a blanket credential. It's a narrow, single-vendor program, not a standard. But it's a live instance of identity-gated capability scaling that other labs and enterprise agent platforms will be watching, and possibly copying.