Open licence, closed access: a Hugging Face model in Apache 2.0 behind a login
7 min read
On 15 August the repository orcarouter/Qwen3.8-27B-Uncensored-FP8 appeared on Hugging Face: the createdAt field reads 2026-08-15T05:45:04Z, last modified the following day. We verified it in person on 17 August, querying the public API and attempting to download a file without authenticating. At that moment: 4,285 downloads, 344 likes, 20 files, of which 7 .safetensors shards. The declared tags: abliterated, uncensored, ai-red-team, red-teaming, image-text-to-text, function-calling, reasoning, fp8, block-fp8, vllm, mtp. The public metadata declare license: apache-2.0 and base_model: Qwen/Qwen3.8-27B; we also checked the base model’s card, and it too is Apache 2.0 — the two licences match, so this is not the trap of a derivative that changes licence along the chain we wrote about for another model family.
There is, however, a second field, and it has nothing to do with the licence text: gated: "auto". We query a file in the repository without an account — first README.md, then the LICENSE file — and the response is HTTP 401, with this message, verbatim: “Access to model orcarouter/Qwen3.8-27B-Uncensored-FP8 is restricted. You must have access to it and be authenticated to access it. Please log in.” The LICENSE file is listed among the repository’s 20 files in the API, but its text cannot be read without accepting conditions that are, in turn, unreadable without logging in.
On the public page, without logging in, two sentences appear, verbatim: “This repository is publicly accessible, but you have to accept the conditions to access its files and content.” and “You need to agree to share your contact information to access this model”.
Two different planes
Apache 2.0 is among the most permissive licences there are: whoever receives it may use, copy, modify and redistribute the work without asking anyone’s permission. But it governs what can be done with the file once obtained — not the channel through which the file reaches whoever wants it. The gate, the access request, is a decision made by whoever administers the repository, not a clause of the licence: Apache 2.0 neither obliges anyone to keep a download channel open to all comers, nor forbids it.
Hugging Face documents the mechanism publicly: a repository with access requests enabled is a gated model; if whoever administers it leaves the default setting in place, access “is automatically granted to the user when requesting it” once the user has shared their information — what Hugging Face calls automatic approval. The alternative, which must be chosen explicitly, is manual approval, where every request sits in a queue until someone accepts it. The value we read in the API, gated: "auto", corresponds to the first case — the default. We report it because it is what the public documentation says about that field, not because we verified it ourselves: we hold no account with which to complete an access request.
The same documentation explains what the form collects by default: the requester’s username and email. Whoever administers a repository can add further fields — company, country, intended use — by customising the form. Which fields appear on this particular repository is something we have not verified: seeing that requires the same login the 401 denies us.
Why a register cannot stop at apache-2.0
A model register that notes only the licence declared on the card — here, apache-2.0 — has written something true. It has not written everything. Over the past fortnight we have checked registers at opposite ends of the same spectrum: a repository with no declared licence at all, another under MIT, with no second document narrowing it, and, yesterday, a permissive licence with a revenue threshold above which a separate contract is required. This case adds a fourth point on the same spectrum: a declared licence, consistent with the base model, entirely unambiguous — and a distribution channel that still requires identifying yourself before the files are handed over.
Three things the single line apache-2.0 does not say:
- The licence is not the access control. Knowing a model is Apache 2.0 does not say whether it can be redownloaded from the same repository tomorrow, nor whether the repository will still exist, nor under what conditions it was first obtained — conditions that can change without the licence field moving by a comma.
- The gate collects data on whoever downloads. Whoever does this at a company, to bring a model into production, does so almost always with a personal account: a corporate decision — what information to share, with which counterparty — taken by one person, and almost never logged anywhere anyone else can later consult.
- The model has its guardrails removed and can call functions. The tags declare both together:
abliterated,uncensored,function-calling. We have not tested it and make no claim about its behaviour — we wrote about this before, regarding thousands of derivatives given the same treatment: refusal stripped from the weights, not from the conversation. Here we note it alongside a declared capacity to invoke tools: a model that refuses nothing and can act on external systems, if it enters a system that touches real data or processes, is an architectural choice that someone at the company must have approved in writing — not a detail discovered afterwards.
See the service · Talk to an engineer
What we don’t know
We have not downloaded the model, we hold no account with which to accept the conditions, and we have not read the model card in full: the 401 prevents this without authenticating, and everything we report comes from the public metadata and the repository’s public page. We have not tested the model and make no claim about its quality or real-world behaviour. We do not know who the author is — the account is named orcarouter, nothing more — nor what exact conditions the access form imposes, because reading them requires the same login the download denies. And we offer no legal classification: whether a model with its guardrails removed falls into a category under the AI Act depends on the actual use made of it, a judgement for whoever puts it into service, not for us.
How we solve this
Comply: the register of models in production becomes a control that runs on the client’s own systems — for each model: version and digest of the artefact, channel and date of acquisition, whether the repository was gated and who accepted the conditions, the licence archived in the wording of that day, approved uses and who approved them — with the dated trail ready to show an inspector, a client in a tender, or a board.
Decide: the same system holds models, data, contracts, archives and documents together in a single operating model, on which AI agents execute decisions with a human operator in command, for large enterprises, defence, government and healthcare. Keeping the artefact inside the client’s own perimeter, rather than fetching it again each time from someone else’s repository, is what makes the system independent of the survival of a channel that can close from one day to the next: the repository can disappear, the gate can change its conditions, the account that accepted can leave the company — the duty to document what runs in production remains regardless. Always in the two delivery modes — on-premise, on self-contained machines that require no deep integration into the client’s network, or dedicated cloud with a dedicated VPN and a data centre in Italy — and always with shared governance: you need not already have, in house, someone who administers these systems.
From the first session, at no cost, comes the dated register of the models in production: for each one, how it was obtained, whether the channel is still open, and what you have archived — including the boxes left blank. It stays with you even if we do not carry on together.