Two release notes, one distribution story

Two things showed up in release notes last week that I think are the same story, and the story is about who owns the pipe from frontier model to classified workload.

The first: Palantir's April 2026 Foundry release notes confirm that AI FDE, the in-product surface Palantir has been shipping into AIP customers, now includes a full AIP Evals workflow. Function authoring, evaluation suite creation, LLM-as-judge scoring, all in-IDE.¹ Nothing leaves the Foundry boundary. The second: on 14 April, Microsoft made GPT-5.1 available on Azure OpenAI for IL2, IL4, and IL5 enrollments, i.e. US government classified networks up to Secret.²

Neither is, in isolation, a market-moving disclosure. Palantir has been building evals functionality into AIP for over a year; Azure Government has been sliding frontier OpenAI models up the impact-level ladder since GPT-4. But taken together they describe the shape of the defence AI stack in 2026, and the shape is worth drawing.

Palantir has been building evals functionality into AIP for over a year; Azure Government has been sliding frontier OpenAI models up the impact-level ladder since GPT-4.

The stack, concretely. In an IL5 enclave today, the customer can now: run GPT-5.1 inference against classified data; wire that inference into Foundry ontology objects; author a function that calls the model; build an evaluation suite against a curated dataset; and score the outputs with an LLM-as-judge, all within the accredited boundary. Twelve months ago that workflow required either exporting prompts and outputs to a dev environment (not permitted) or running the evals by hand in a spreadsheet (done, reluctantly). The friction is gone. This matters because evals are the thing that makes a defence AI deployment auditable, and auditability is the thing that gets the deployment past the accreditor.

What's a case of what. This is the FDE market structure frame doing its work. Recall the question the frame asks: how does AI capability actually get deployed into an enterprise, via a central centre-of-excellence, via embedded forward-deployed engineers, or via a vendor-owned platform that absorbs the FDE function into product? Palantir has always been the third answer, and AI FDE is the product-ification of what used to be the human FDE's job: writing the glue, defining the evals, maintaining the prompt library. The release note is modest. The implication is that the FDE function is now a SKU.

On the Microsoft side, the IL5 enablement is the boring infrastructure half of the same story. Someone has to run the GPUs inside the SCIF-equivalent boundary. Azure Government is the incumbent. The interesting thing is not that GPT-5.1 is available, of course it is, eventually, but the cadence. GPT-5.1 general availability was November 2025. IL2/IL4/IL5 in April 2026 is roughly a five-month lag, down from the nine-to-twelve months that GPT-4-class models took to clear accreditation. The defence distribution lag is compressing, which is what you'd expect once the accreditor has done the work once and the subsequent models are delta-reviews against an approved baseline.

Where the safety-as-market-position frame fits. The AI safety as market position frame predicts that defence-grade deployments diverge from consumer deployments on exactly the axes that safety teams care about: evaluation infrastructure, red-teaming surfaces, provenance, audit logs. What you're seeing in the Palantir release note is evals-as-product, which is the enterprise-defence version of what Anthropic's RSP or OpenAI's Preparedness Framework is at the lab level. It is the same posture pointed at a different buyer. Palantir's pitch to a G-series programme office is not "our model is safer", Palantir doesn't have a model, it is "our pipeline makes your use of someone else's model auditable". That is a market position, and it is one that scales with every additional frontier model that Azure drops into IL5.³

Where the frame breaks, or at least bends. The part I keep circling is whether this is durable vendor lock-in or a commoditisation pattern in disguise. The optimistic read for Palantir is that once AIP Evals is the accredited evaluation harness for GPT-5.1 on IL5, switching costs compound: the eval suites are artefacts, the function library is an artefact, the LLM-as-judge rubrics are artefacts, and all of them live in Foundry. The pessimistic read is that an eval suite is a YAML file and a dataset, and the moment a competitor ships an equivalent in-boundary harness, Databricks on Azure Government, or for that matter a Microsoft-native Fabric-based eval tool, the artefacts port. I don't have enough evidence to call it either way, but I'd note that the thing Palantir is selling here is workflow rather than data gravity, and workflow moats historically have shorter half-lives than data moats.

Inference economics, briefly. The inference economics frame nudges me to ask who is paying for the GPU-hours behind IL5 GPT-5.1. The answer is: the government customer, on a cost-plus or consumption basis, through Azure Government's pricing. These are not margin-pressured tokens. Classified inference pricing is, let's say, healthy, the accreditation overhead is real and the competitive set is Azure, AWS GovCloud (with Anthropic via Bedrock), and Oracle Government. Defence is one of the few places in the 2026 AI market where the inference-economics pressure hasn't arrived, because the customer is buying compliance as much as capability. This is worth noting because most of the frontier labs' margin story depends on exactly these kinds of non-commoditised inference pools existing. They do, for now.

What this is a case of. The pattern: frontier model vendor (OpenAI) ships capability; hyperscaler (Microsoft) ports capability into accredited boundary; platform vendor (Palantir) wraps capability in workflow the accreditor will sign off on; customer (DoD programme office) buys the wrapped thing, not the raw model. Each party captures a distinct rent. OpenAI captures the capability rent; Microsoft captures the infrastructure-plus-compliance rent; Palantir captures the workflow-plus-audit rent. The interesting question is which of these three rents is most defensible over a five-year horizon. My current priors, held lightly: Microsoft's is the stickiest (accreditation is a moat), OpenAI's is the most contested (Anthropic is live on AWS GovCloud, and the customer wants second-source), Palantir's is the most contingent on continuing to out-ship on workflow.

What to watch. Three things. First, when Anthropic's Claude family reaches IL5 parity on AWS GovCloud, that's the second-source test for the capability layer. Second, whether Microsoft starts shipping its own accredited eval tooling inside Azure Government; if it does, Palantir's workflow moat narrows materially. Third, any disclosed expansion of AIP Evals to non-OpenAI model backends inside Foundry on IL5, that would be Palantir explicitly positioning as model-agnostic on classified networks, which is the hedge that matters most for its long-run rent.

The release notes were boring. The stack they describe is not.

Footnotes

¶