GPT-6 Sol and Luna change cost, risk and routing decisions

At a glance

What this is: A vendor comparison argues that GPT-6 Sol, GPT-6 Luna and GPT-6.1 Sol should be routed by workload because cheaper tiers reduce token cost without removing the need for separate security and governance controls.

Why it matters: IAM, NHI and AI governance teams should treat model choice as a policy decision, because routing, access control and logging need to follow the workload, not just the model family.

By the numbers:

• Luna is 20 times cheaper per token, but only 12.6 times cheaper per benchmark run.
• OpenAI reports instruction hierarchy defender success of 99.97% for Sol and Luna and 99.99% for GPT-6.1 Sol.
• SonarSource found 285 vulnerabilities per million lines from GPT-6 Sol against 178 for Astra.

Context

GPT-6 Sol and GPT-6 Luna sit in the same model family, but they are not interchangeable controls. The article frames them as different operating points for cost, throughput and risk, with routing decisions becoming part of the security design rather than a simple procurement choice.

For identity and access teams, the real question is how model choice intersects with delegation, tool use and policy enforcement. When a model can call functions, search the web or use MCP, governance has to control who can invoke it, what it can touch, and when a higher tier is justified.

Key questions

Q: How should security teams implement routing for AI workloads when cost and latency vary across models?

A: Security and platform teams should use a routing layer that evaluates each request against policy, rather than hardcoding one default model. That lets them set per-route thresholds for cost, latency, and capability, then fail over or fall through when a tier is too expensive or too slow. The goal is consistent governance, not a permanent winner for every prompt.

Q: Why can a cheaper model still cost more in production than a stronger one?

A: Because task cost includes more than token price. A cheaper model may write longer answers, need more retries, or force escalation to a stronger model, which raises the real cost per completed task. Teams should measure output length, fallback rate and time-to-completion before assuming a lower token rate will save money.

Q: What breaks when model safety and performance are judged only at the family level?

A: Model-family approval hides differences in tool behaviour, cyber posture and output quality between tiers. If you treat one family as uniform, you can miss a weaker model’s higher failure rate or a stronger model’s broader attack surface. Governance should be specific to the exact model version and the exact workload it will handle.

Q: What should teams do when an AI system can call privileged tools?

A: Teams should apply least privilege at the tool layer, require strong parameter validation, and log every action to an auditable identity trail. The model should never be able to widen its own scope based on phrasing or conversation context. If a tool can export data, delete records, or modify accounts, its permissions need explicit governance.

Technical breakdown

How model tiering changes routing decisions

Model tiering is not just a pricing ladder. It is an operational control that decides which workloads receive more capable reasoning, which receive faster throughput, and which require escalation. In this article, Luna is positioned for repeatable, high-volume tasks, while Sol and GPT-6.1 Sol are used for more complex agent work. That means routing policy becomes part of the security boundary: if a workload can trigger tool use, data access or external calls, the selected model tier affects both cost and control expectations. See the AI Agent Authorisation Guide.

Practical implication: Treat model routing as an access-control decision, not a convenience setting.

Why cost per token is not the same as cost per task

Token pricing only captures part of the bill. A model that is cheaper per token can still cost more per task if it generates longer outputs, needs more retries or requires escalation to a stronger tier. The article’s own arithmetic shows this clearly: Luna’s token price is far lower, but the task-level difference narrows once output length and fallback routing are included. For governance, this means the relevant unit is the workload, not the model SKU.

Practical implication: Budget and approve AI usage by task class, retry rate and escalation rate, not by headline token price alone.

What model-specific security controls actually need to follow the tier

The article shows that security characteristics do not flatten across model tiers. Prompt injection resistance, tool-failure honesty, cyber classification and code-risk signals all vary by model and by evaluation method. That matters because a routing gateway can enforce the chosen tier, but it cannot prove the tier is safe for every use case. The control point is therefore layered: policy at the gateway, runtime inspection around tools, and separate evaluation when the model tier changes. See the Agentic AI Security Guide.

Practical implication: Revalidate controls whenever a workload moves between model tiers or starts using tools in production.

NHI Mgmt Group analysis

Model tiering has become a governance control, not just a cost lever. When one model is cheap but another is stronger on agent work, routing policy determines how risk is distributed across the programme. That makes model selection part of control design, especially where tools, external search and delegated actions are involved. The practical conclusion is that teams need policy-based routing, not ad hoc developer choice.

Security evidence does not travel cleanly across tiers. The article shows that prompt injection resistance, cyber classification and code quality all vary by model and by benchmark source. That means a single approval for a model family is too coarse for production use. The right unit of governance is the specific model, the specific workload and the specific action boundary.

Routing is the new blast-radius decision for AI operations. If a cheap model can handle most requests and a stronger model only sees escalations, the security value is in constraining where the stronger model is allowed to act. That shifts attention from model preference to control placement, especially around tool use, data access and human approval. The practitioner conclusion is to govern escalation paths as carefully as the primary model.

AI agents and model tiers intersect with NHI governance the moment they call tools. Once a model can use function calling, web search or MCP, it is no longer just generating text. It is operating through delegated access that needs lifecycle control, scope limits and auditability. Teams should treat those delegated pathways like any other privileged non-human access and bind them to policy and review.

Read next: AI Agent Identity Security Buyer's Guide

What this signals

Routing policy is now part of AI security architecture. The meaningful control is no longer which model exists in the catalog, but which workload is allowed to reach which tier under what conditions. That makes model governance a policy enforcement problem, not a procurement checklist.

Delegated model access should be governed like other non-human access. Once a model can invoke tools, search the web or act through MCP, the identity and authorisation question becomes central. Teams should design the same kind of scope limits, logging and review they would expect for any privileged machine workflow.

For practitioners

• Define routing rules by workload class Separate simple, repeatable tasks from multi-step agent work and route each to a default tier before developers choose a model ad hoc.
• Gate higher-tier models behind policy Require approval or policy evaluation before workloads can move from Luna to Sol or from Sol to GPT-6.1 Sol when tools or sensitive data are involved.
• Red team each model tier separately Re-test prompt injection, tool misuse and code-generation risk whenever the workload changes model or starts using a new capability such as function calling.
• Measure escalation rate and retry cost Track how often Luna requests have to escalate to Sol and how often retries erase the expected savings from cheaper token pricing.
• Apply runtime inspection to tool calls Inspect prompts, tool invocations and outputs at the gateway so model choice does not become the only control on delegated actions.

Key takeaways

• Cheaper model tiers still need explicit routing rules because task complexity, retries and escalation can erase the expected savings.
• Security posture varies by model version and by workload, so a family-level approval is too coarse for production governance.
• Once models can call tools, they inherit identity and privilege questions that belong in the same control plane as other delegated access.

Related NHI Mgmt Group resources: AI Agent Authorisation Guide · Agentic AI Identity Guide · Agentic AI Security Guide · Shadow AI and AI Agent Discovery Guide

Key terms

• Model routing policy: Model routing policy is the logic that decides which model, cluster, or workflow step handles a request. It shapes cost, latency, quality, and exposure because it controls when requests are escalated, when fallbacks happen, and which identities are used along the path.
• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
• Escalation Rate: Escalation rate is the proportion of alerts or investigations that a system passes to human analysts for review. It helps teams judge whether automation is appropriately selective, whether the model is overconfident, and whether the workflow preserves human accountability where needed.
• Tool-Enabled Model: A tool-enabled model is an AI system that can call functions, search content or interact with external services during execution. Once tools are available, the model becomes a governed runtime actor and must be controlled with scope limits, logging and review.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and workload identity in practical terms. It helps practitioners connect identity control to the wider security decisions that govern AI and automation.