Why it matters
METR’s February account describes confidentiality levels, project-specific access, codenames and practice handling sensitive questions. Technical measures include centrally managed membership, restrictions on external sharing, device controls and authorization for model transcripts. The useful distinction is between norms that reduce conversational slips and controls that restrict access. This is a dated description of METR’s own arrangements, not an independent audit or proof that those measures prevent every breach.
My takeaway: Label sensitive evaluation material consistently across documents and collaboration tools. Restrict model completions and transcripts to the evaluation team, review access, and rehearse disclosure edge cases such as calendar titles and negative confirmations. Log near misses and use them to improve both policy and enforcement.