A gated model asks users to request access and share their contact details with the model's authors. That is an access and usage control. It is not a safety review of the files. Gated or not, treat the weights, format and any code with the same care before you load them.
What gating is, in the platform's words
Hugging Face documents gated models as a feature that lets authors enable access requests. Users must agree to share their username and email address with the authors to reach the files. The documentation says a common use is early access to research models before a wider release.
There are two approval modes. Automatic approval grants access once the user requests it. Manual approval lets authors review each request. Access requests are always granted to individual users, not to whole organizations.
Authors can also reject a user, and rejected users cannot request again. Authors can cancel an approval, which sends the user back to pending.
What gating does not tell you
| You might assume | What is actually true |
|---|---|
| The files were security reviewed | Gating is an access control chosen by the author |
| Only trusted people hold a copy | Automatic approval lets any requester in |
| A company approval covers everyone | Access is granted per individual user |
| The file format is safe | Format is a separate question |
| The license is permissive | Gating is separate from the license, read both |
Gating answers who can download. It does not answer what the download contains, or what the terms of use are. Those two questions need their own checks.
What it means for your team
- Individual accounts. Because approval is per user, a model approved for one engineer is not approved for the next. Decide who holds access and keep it recorded. Shared accounts to get around this create their own risk.
- Contact details are shared. Requesting access shares an email address with the authors. Use an address you are comfortable sharing, and read the author's terms.
- Tokens. Downloading a gated model needs an access token. Keep the token scoped to read access and out of images and code. A separate post on this blog covers keeping a token out of a Docker image.
- Copies. Once downloaded, files can be copied around. The gate does not follow the file, so check the license terms about redistribution before moving a copy to an internal registry.
A short intake routine
Before using a gated model, run the same intake you would for any model.
- Read the license and any acceptable use terms. Record them.
- Prefer weights in a format that does not run code on load, and pin a specific revision.
- Check the repository for extra Python files, and for any option that asks you to trust remote code.
- Load for the first time in an isolated environment.
- Record the source, revision, hash and approver.
Authors: a note on your side
If you publish, gating can help you learn who uses a model and set expectations. It is not a substitute for clear licensing, a model card and safe file formats. Anyone you approve receives the files, so publish formats that are safe to open.
Quick check
Does a gated model have a safer file format?
Not by default. Check the files yourself, since gating controls access and not format.
Can my whole organization share one approval?
No. The platform documentation says access requests are granted to individual users rather than entire organizations.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning and policies and gates, which help you track the libraries around your models. A free scan is available.
Sources
- Hugging Face Hub documentation: Gated models, read 19 October 2026.
Last reviewed: 19 October 2026.
