--- title: "Open licence, closed access: a Hugging Face model in Apache 2.0 behind a login" description: "A Hugging Face repository declares an Apache 2.0 licence, yet downloading a file returns HTTP 401 without authentication: the licence is not the access channel." url: https://csidia.com/en/notes/licenza-aperta-accesso-chiuso-modello-gated/ lang: en date: 2026-08-17 label: "Observatory" publisher: CSIDIA S.r.l. (https://csidia.com/) italiano: https://csidia.com/note-operative/licenza-aperta-accesso-chiuso-modello-gated/ --- # Open licence, closed access: a Hugging Face model in Apache 2.0 behind a login On 15 August the repository `orcarouter/Qwen3.8-27B-Uncensored-FP8` appeared on Hugging Face: the `createdAt` field reads **2026-08-15T05:45:04Z**, last modified the following day. We verified it in person on 17 August, querying the public API and attempting to download a file without authenticating. At that moment: **4,285 downloads**, **344 likes**, **20 files**, of which **7 `.safetensors` shards**. The declared tags: `abliterated`, `uncensored`, `ai-red-team`, `red-teaming`, `image-text-to-text`, `function-calling`, `reasoning`, `fp8`, `block-fp8`, `vllm`, `mtp`. The public metadata declare `license: apache-2.0` and `base_model: Qwen/Qwen3.8-27B`; we also checked the base model’s card, and it too is Apache 2.0 — the two licences match, so this is not [the trap of a derivative that changes licence along the chain](https://csidia.com/en/notes/derivati-pesi-licenza-cambia-strada) we wrote about for another model family. There is, however, a second field, and it has nothing to do with the licence text: `gated: "auto"`. We query a file in the repository without an account — first `README.md`, then the `LICENSE` file — and the response is HTTP 401, with this message, verbatim: “Access to model orcarouter/Qwen3.8-27B-Uncensored-FP8 is restricted. You must have access to it and be authenticated to access it. Please log in.” The `LICENSE` file is listed among the repository’s 20 files in the API, but its text cannot be read without accepting conditions that are, in turn, unreadable without logging in. On the public page, without logging in, two sentences appear, verbatim: “This repository is publicly accessible, but you have to accept the conditions to access its files and content.” and “You need to agree to share your contact information to access this model”. ## Two different planes Apache 2.0 is among the most permissive licences there are: whoever receives it may use, copy, modify and redistribute the work without asking anyone’s permission. But it governs what can be done *with* the file once obtained — not the channel through which the file reaches whoever wants it. The gate, the access request, is a decision made by whoever administers the repository, not a clause of the licence: Apache 2.0 neither obliges anyone to keep a download channel open to all comers, nor forbids it. Hugging Face documents the mechanism publicly: a repository with access requests enabled is a *gated model*; if whoever administers it leaves the default setting in place, access “is automatically granted to the user when requesting it” once the user has shared their information — what Hugging Face calls *automatic approval*. The alternative, which must be chosen explicitly, is manual approval, where every request sits in a queue until someone accepts it. The value we read in the API, `gated: "auto"`, corresponds to the first case — the default. We report it because it is what the public documentation says about that field, not because we verified it ourselves: we hold no account with which to complete an access request. The same documentation explains what the form collects by default: the requester’s username and email. Whoever administers a repository can add further fields — company, country, intended use — by customising the form. Which fields appear on *this particular* repository is something we have not verified: seeing that requires the same login the 401 denies us. ## Why a register cannot stop at `apache-2.0` A model register that notes only the licence declared on the card — here, `apache-2.0` — has written something true. It has not written everything. Over the past fortnight we have checked registers at opposite ends of the same spectrum: a repository [with no declared licence at all](https://csidia.com/en/notes/qwen3-8-huggingface-download-senza-licenza), another [under MIT, with no second document narrowing it](https://csidia.com/en/notes/deepseek-v4-pro-mit-senza-usage-policy), and, yesterday, [a permissive licence with a revenue threshold above which a separate contract is required](https://csidia.com/en/notes/qwen-2-4t-licenza-soglia-cinquanta-milioni-uso-interno). This case adds a fourth point on the same spectrum: a declared licence, consistent with the base model, entirely unambiguous — and a distribution channel that still requires identifying yourself before the files are handed over. Three things the single line `apache-2.0` does not say: 1. **The licence is not the access control.** Knowing a model is Apache 2.0 does not say whether it can be redownloaded from the same repository tomorrow, nor whether the repository will still exist, nor under what conditions it was first obtained — conditions that can change without the licence field moving by a comma. 2. **The gate collects data on whoever downloads.** Whoever does this at a company, to bring a model into production, does so almost always with a personal account: a corporate decision — what information to share, with which counterparty — taken by one person, and almost never logged anywhere anyone else can later consult. 3. **The model has its guardrails removed and can call functions.** The tags declare both together: `abliterated`, `uncensored`, `function-calling`. We have not tested it and make no claim about its behaviour — [we wrote about this before](https://csidia.com/en/notes/modelli-abliterated-rifiuto-tolto-dai-pesi), regarding thousands of derivatives given the same treatment: refusal stripped from the weights, not from the conversation. Here we note it alongside a declared capacity to invoke tools: a model that refuses nothing and can act on external systems, if it enters a system that touches real data or processes, is an architectural choice that someone at the company must have approved in writing — not a detail discovered afterwards. [See the service](https://csidia.com/en/solutions/ai-governance) · [Talk to an engineer](https://csidia.com/en/contact) ## What we don’t know We have not downloaded the model, we hold no account with which to accept the conditions, and we have not read the model card in full: the 401 prevents this without authenticating, and everything we report comes from the public metadata and the repository’s public page. We have not tested the model and make no claim about its quality or real-world behaviour. We do not know who the author is — the account is named `orcarouter`, nothing more — nor what exact conditions the access form imposes, because reading them requires the same login the download denies. And we offer no legal classification: whether a model with its guardrails removed falls into a category under the AI Act depends on the actual use made of it, a judgement for whoever puts it into service, not for us. ## Sources - [Hugging Face — orcarouter/Qwen3.8-27B-Uncensored-FP8, model card](https://huggingface.co/orcarouter/Qwen3.8-27B-Uncensored-FP8) - [Hugging Face — documentation on gated models (automatic approval, data collected)](https://huggingface.co/docs/hub/en/models-gated) - [Hugging Face — model API (metadata, files, tags)](https://huggingface.co/api/models/orcarouter/Qwen3.8-27B-Uncensored-FP8) - [Hugging Face — Qwen/Qwen3.8-27B, base model (licence)](https://huggingface.co/Qwen/Qwen3.8-27B) Note by CSIDIA S.r.l. (Vignola, MO, Italy): https://csidia.com/en/notes/licenza-aperta-accesso-chiuso-modello-gated/ · Who we are and what we do: https://csidia.com/en/at-a-glance/ · engagement@csidia.com