Can an Enterprise Change AI Models Without Changing Its AI Controls?

Yes, when input policy, approvals and audit records are enforced independently of the selected model. A model change still needs capability, security and supplier review, even when those controls remain in place. The September price table compares published token rates and one benchmark's costs. Neither is a forecast for a claims or billing workflow. Keeping controls outside the model can reduce migration work and make more models practical to evaluate, but it does not make their reliability, hosting terms or supply-chain risks identical. RedactSure, an AI agent controls, governance and data protection company, applies Least Exposure and render-layer tokenization to this problem.

Key findings

• Anthropic released Claude Opus 5.5 on September 22 at $4 and $20 per million tokens, and Sonnet 5.5 on September 28 at $2 and $10. Source: Anthropic.
• OpenAI released GPT-6.1 Sol on September 29 at $2 and $10, "a fifth of Astra's price." Source: OpenAI.
• Meta's Muse Spark 1.3 lists at $1.25 and $4.25 under the new Meta Enterprise Platform. Source: Runtime.
• On the Artificial Analysis Intelligence Index v4.3.2, cost per index task runs from $0.27 for DeepSeek V4.1 Flash to $7.60 for Claude Sonnet 5.5. Source: Artificial Analysis.
• Dots run on GPT-6 Astra only, Muse on Meta's model, Claude in Chrome on Claude; in each, controls and record are the model vendor's. Source: The Next Web.

What moved in September?

Three frontier releases in one week: Claude Opus 5.5 on September 22, 2026, Claude Sonnet 5.5 on September 28 and GPT-6.1 Sol on September 29. Sol lists at a fifth of GPT-6 Astra's price. Sources: Anthropic; OpenAI. The same day Meta placed the Muse API, at Muse Spark 1.3's $1.25 and $4.25, under an Enterprise Platform led by CJ Desai. Sources: MindStudio; Runtime.

Below the frontier, open-weights models from Z.ai, Moonshot and DeepSeek sit at a fraction of these rates. An enterprise that can swap models can treat every one as an option.

What does the same work cost on different models?

Prices as of September 30, 2026; the table is refreshed monthly. List prices, standard tier, USD per million tokens, from the pricing pages in Sources. Blended is (3 x input + output) / 4, a 3:1 ratio typical of agent work that reads more than it writes. DeepSeek figures are peak rates; Kimi K3 is Moonshot's rate; Gemini's runs through December 31, 2026. Index and cost per task are Artificial Analysis v4.3.2. Cost per task counts the tokens a model spends on the benchmark, which is why Sonnet 5.5 costs more per task than Opus 5.5 at half the price. Per-token price is not cost per workflow.

Why can a vendor agent not make this trade?

Because the model is not a component of the agent; it is the agent. Dots run on GPT-6 Astra, with Auto-review enforced by OpenAI and the record in Activity View. Sources: The Next Web; OpenAI. Muse runs Meta's model in Meta's VM with Meta's Sentinel and log. Source: Meta AI Research. Claude in Chrome runs Claude with Anthropic's classifiers. Source: Claude Help Center.

In each case the exposure policy, the reviewer and the record are properties of the model vendor's product. An enterprise that wants Sol's price for a task it runs in Muse cannot switch the model; it switches vendors, environments and logs. That is a migration, not procurement.

What has to stay fixed when the model changes?

Four things, none of which belong to the model. The exposure policy: which values on each screen are tokenized before any model reads it, and what the agent may do there. The named approver, who confirms that policy and approves every payment, submission and record change under Supervised Delegation. The AI Control Record, exported to the customer's monitoring. The keys, held by the customer, so real values never move when the model does.

When those four are the customer's, a model swap is a configuration change. The security review that examined the environment, the token policy and the approval flow can reuse the evidence for unchanged controls. The new model and provider still need review and regression testing.

What does the token layer have to do with price?

Tokenization can widen the set of models an organization is willing to evaluate by reducing the sensitive identifiers in their input. It does not make all providers or models equally safe: remaining task context, hosting terms, model behavior and supply-chain risks still differ.

The table's benchmark costs are useful for choosing candidates, not forecasting a claims, revenue-cycle or student-services task. Test candidates on representative work and include errors, retries, human review and hosting costs. The same input policy and approval record can be held constant during those tests.

Where does RedactSure sit?

RedactSure builds the environment in which the model is a swappable part: a secure virtual machine in the cloud the customer's posture requires, on hardware-encrypted enclaves, with keys the customer holds. Every sensitive value chosen by policy becomes a consistent token at the render layer before any model reads the screen. A named person confirms the Planner's per-task policy and approves every consequential action, on the AI Control Record. The environment is model-agnostic: Claude, GPT, Gemini or open-weights models, swappable without moving the controls.

What the enterprise avoids is riding one vendor's price curve and redoing the security review to leave it. Because every model receives tokens where the identifiers were, a cheaper or open-weights model can be evaluated under the same input policy. Its remaining risks and performance still need review. The policy, the approver, the record and the keys stay the customer's through every swap. Deployments are in pilot.

What the record shows

Yes, when input policy, approvals and audit records are enforced independently of the selected model. A model change still needs capability, security and supplier review, even when those controls remain in place. Compare candidate models on the actual workflow, including errors, review effort and total cost. Keep the policy and audit format stable where possible.

Frequently asked questions

Does a model swap change the audit record?

Not in a customer-owned environment. The AI Control Record captures every screen as tokens, every action and approval with a name; which model proposed each action is one field, and a swap changes that field only. In a vendor's agent the record is the vendor's, so a new vendor means a new record.

How much do frontier models differ in price for the same work?

On the September 30, 2026 table, the four models scoring 52 or above list between $2 and $10 per million input tokens, a factor of five on blended price. Cost per index task runs from $0.72 for GPT-6.1 Sol to $7.60 for Sonnet 5.5. Price rank and capability rank differ.

Does the security review have to be redone?

Reuse evidence for controls that remain unchanged, but review the new model and provider. Hosting terms, residual data exposure, tool behavior, reliability and supply-chain risks can change even when tokenization and approval policies stay fixed. Test representative workflows before switching.

Is the cheapest model good enough for regulated work?

Capability is chosen per task; the exposure does not change with the model. A model that reads a remittance and posts lines needs less than one drafting a coverage position; the workflow owner sets the bar. In RedactSure's environment what the model receives and who approves the action are the same at every price.

Where do the price figures come from?

From each vendor's pricing page as of September 30, 2026: OpenAI, Anthropic, Google and DeepSeek directly, MindStudio for Muse Spark 1.3, VentureBeat for GLM-5.3 and OpenRouter for Kimi K3. Scores and cost per task are from the Artificial Analysis Intelligence Index v4.3.2, same date, linked in Sources.

What is a blended price?

A single per-million-token figure that weights input and output by an assumed ratio. The table uses 3:1, computed as (3 x input + output) / 4, because agent work on business applications reads far more than it writes. A drafting-heavy workflow would reorder the table. It is a comparison aid, not a forecast.

Related research

Explainer · September 26, 2026

Should the AI Model Vendor Own the Agent Environment?

Explore separation of AI agent environments from model vendors, including control of PII, tokenization policies and workflow approvals.

Explainer · September 30, 2026

Can Open-Weights Models Work on Regulated Records?

Assess open-weights AI agent deployments for PHI, PII and tokenization, including self-hosting controls for claims and patient-account tasks.

Explainer · September 21, 2026

What Is an AI Control Record?

Explore an AI agent control record for billing and claims, linking permissions, tokenization decisions, approvals and audit evidence.

Comparison · September 30, 2026

Do OpenAI Dots Rules Control What the Agent Sees?

Review OpenAI Dots Custom Rules, AI agent security and tokenization before connecting billing, claims or other workflows that expose PII.

RedactSure Perspectives · July 2026

Your AI Strategy Is Probably Wrong

Compare AI agent operating models for billing and claims, from isolated assistants to governed workflows with tokenization and approval.