---
title: Who Owns the Tokens? Drafting Internal Papers on Open Models
description: "If your data is your moat and you plan to train a model on it, the text your teams generate today is tomorrow's training data. Permissively licensed open models give you far more control over those tokens."
canonical_url: https://superlinked.com/blog/who-owns-the-tokens
last_updated: 2026-11-11
---

Companies now write a lot of their internal material with AI: research memos, analyst notes, internal papers, design docs, incident write-ups, contract summaries, notes from sales calls. If your company has a data moat, where the data your teams produce is part of how the business makes money, and you want to build a model on it someday (most likely by fine-tuning one), then all of that is training data for that model. Whether you can actually use it depends on a question most teams never ask when they pick a model: who owns the tokens that came out of it?

I think about this as ownership more than cost. I'll start with why companies with a data moat end up training on their own material, then why text generated by the closed models gets in the way of that, and how much more control you get over the tokens when you generate them with a permissively licensed open model. That last part is what I'd call sovereign AI for your own company. The example is a recipe from the [SIE cookbook](https://github.com/superlinked/cookbook): a made-up biotech, Corvane Bio, drafting short internal papers on open models so the library it builds is one it can train on later.

<BlogSieCta />

## Your Data Is the Moat

The companies that have written about this keep coming back to the data, not the model. Bloomberg trained BloombergGPT on its own financial data in 2023 ([the paper](https://arxiv.org/abs/2303.17564)), and by 2026 its head of Terminal products said that model "is actually not used at all in any of our products"; the products run on a mix of commercial models, open-weight models and "smaller, custom language models that we build ourselves" ([A-Team Insight](https://a-teaminsight.com/blog/inside-bloombergs-askb-roadmap-the-data-moat-behind-the-ai/)). The one big model was a step along the way. What lasted was the data and the habit of building on it.

Eli Lilly is about as clear a data moat as you'll find. Its TuneLab models were "built through over $1 billion in research investment" and trained on Lilly's own preclinical data, and Lilly has opened them to other biotechs ([Lilly](https://investor.lilly.com/news-releases/news-release-details/lilly-launches-tunelab-platform-give-biotechnology-companies)). Thomson Reuters built its own model, Thomson, on "a strong open-source foundation", and says it "remains fully owned and controlled by Thomson Reuters" ([press release](https://thomsonreuters.com/en/press-releases/2026/august/thomson-reuters-leverages-its-world-class-data-assets-to-launch-its-own-frontier-model)).

The payoff tends to show up as accuracy and cost too. Bridgewater fine-tuned Qwen3-235B on expert judgment in its own financial tasks and, by its own measurements, reached 84.7% average accuracy against 78.2% for the best frontier model it tried, at 13.8 times lower inference cost per task ([Bridgewater AIA Labs](https://www.bridgewater.com/aia-labs/learning-to-replicate-expert-judgment-in-financial-tasks)). Harvey and Engram trained a 27B model on a law firm's knowledge and reported it competitive with leading frontier models at 90% lower cost per query, which Harvey calls research results ([Harvey Tenet](https://www.harvey.ai/blog/post-training-update-harvey-tenet)). Nice numbers, but they're the bonus. The reason these companies train on their own material is that nobody else has it.

## Why Closed-Model Output Gets in the Way

A lot of teams trip over this without noticing. If data is part of your business and you want to build a future model on it, you can't necessarily use all the closed-source models to produce that data. Their terms come with IP restrictions or licensing conditions on what you may do with the output, and training a model on it is exactly the kind of use they care about. OpenAI's and Anthropic's business terms, for example, give you the output and bar you from using it to build models that compete with theirs ([OpenAI Services Agreement](https://openai.com/policies/services-agreement/), [Anthropic Commercial Terms](https://www.anthropic.com/legal/commercial-terms)). Both allow some uses: OpenAI's agreement makes an exception for internal models that categorize, classify or organize data (embeddings or classifiers you don't distribute), and [Anthropic's help page](https://support.claude.com/en/articles/12326764-can-i-use-my-outputs-to-train-an-ai-model) lists non-competing tools like summarization and extraction as fine, while it names models for open-ended text generation as off limits. So what you're allowed to do depends on your agreement and on the model you mean to train. Whether your fine-tuned research assistant "competes" is a question for your lawyer, and I'd rather not have the question at all.

Watermarking is a separate point from the terms. Google watermarks Gemini's text with [SynthID-Text](https://deepmind.google/en/blog/watermarking-ai-generated-text-and-video-with-synthid/), and Anthropic said in August 2026 that text from its new Claude models will carry an imperceptible pattern in its word choice ([TechCrunch](https://techcrunch.com/2026/08/11/anthropic-says-it-will-watermark-text-generated-by-its-ai-models/)); both say the mark is there to label AI-written text (Anthropic points to the EU AI Act). Anthropic is also clear that detecting it is a signal with limits: it's unreliable on short passages and on text that's been heavily edited or mixed into other writing ([how Claude marks AI-generated content](https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content)). So it won't prove which sentence in your library came from Claude, but it does leave a provenance signal in the text that points back to the model. And the providers actively look for people training on their output: Anthropic [uses classifiers and behavioral fingerprinting](https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks) on its API traffic to catch labs like DeepSeek, Moonshot and MiniMax doing it against its terms. Those cases show the providers enforce the clause. Fine-tuning your own model on your own papers is a much smaller thing than what those labs did, but it's the same kind of use. And with a watermark in the text, your own records are no longer the only evidence of where it came from.

Put the terms and the watermarks together and you get an awkward situation a few years from now. You've built up thousands of internal documents, they're exactly the material you'd want to train on, and a good share of their sentences came out under terms that may not let you do what you want with them. And you probably don't know which sentences.

**Note:** I'm an engineer, not a lawyer. This is how I read the terms for a made-up company. Ask a lawyer about your own agreements.

## Owning the Tokens

When a permissively licensed open model (such as one under Apache 2.0) does the work, you get far more control over the tokens. No provider terms limit what you train on them. Not every open-weight license is like that, so check the license of the model you pick before you rely on this. The three models in the example below are open weights under Apache 2.0, a license that puts no conditions on what they write. The license doesn't settle everything, though: you still need the rights to the source material you feed in and quote, and copyright law decides how much of any machine-written text can be owned at all (the [US Copyright Office](https://www.copyright.gov/ai/Copyright-and-Artificial-Intelligence-Part-2-Copyrightability-Report.pdf) wants human authorship). A watermark is a separate question again. Text watermarks like SynthID are added by whoever serves the model, so on your own servers that's your call, but check it for the model and serving setup you actually use.

Running those models on your own servers takes it one step further. You decide where the input goes (usually nowhere), you pin the model version that wrote each draft, and nobody retires it on you the way OpenAI shut down `text-davinci-003` on 4 January 2024 ([OpenAI deprecations](https://developers.openai.com/api/docs/deprecations)). When you do upgrade, finding the regressions is your job, which is the price of owning it.

That's what I mean by sovereign AI for your own company: the data and the model that writes with it are yours, what you do with every token that comes out is up to you, and so is the model you train on them later. If you're building a moat, you don't want the bricks generated under somebody else's license.

None of this says every document belongs on a model you host. If the material is all public, say a review of forty published papers, I'd happily draft it with a large hosted model; it'll hold more of them in mind at once than the 27B in the example below, which gets an 8,192-token window on SIE Serverless, and you'd never train on a summary of other people's work anyway. The line I draw is around the documents that hold what only you know and the writing you'd one day want a model to learn from.

## An Example: Internal Papers at a Made-Up Biotech

Corvane Bio is made up, and so is its data. It's a worked example of owning the tokens, from the [cookbook's internal paper recipe](https://github.com/superlinked/cookbook/tree/main/healthcare/draft_internal_paper_from_outline).

A scientist at Corvane knows what she wants to say about her program's latest liver finding, and she has it as an outline. Then she spends half a day turning it into prose and finding the study report behind every number. The company writes a short paper like this whenever a program has something worth sharing, the papers go into an internal library, and Corvane's plan is to fine-tune its own research agents on that library later. So these papers are the moat in the making, and Corvane wants to own every token in them.

The steps are the same for every paper (search, find evidence, draft, check), so it runs as a fixed workflow. ([When to Use a Workflow and When to Use an Agent](/blog/agentic-vs-workflows-small-models) has how I decide that.) The models search, rank and draft, and Python does anything that has to be exact (holding back queries, checking quotes).

![Flowchart of the paper recipe: the 27B writes PubMed queries and Python holds back any that name something internal. The embedding model and reranker score the PubMed abstracts and the internal reports; passages under 0.5 are not used, the rest go to the 27B to draft, Python checks every quote, and the scientist reviews the result](/blog/who-owns-the-tokens/flow.webp)

The PubMed queries are the one thing that has to leave the company, so they get the most care. [`Qwen/Qwen3.8-27B-FP8`](/models/qwen-qwen3-8-27b-fp8) (at 27B, on the verge of a large model, though open) writes short PubMed queries for each section, and Python holds back any query that names something on the `never_send` list (CVN-114, Corvane, report ids, however they're spelled), repeats a number from the outline or copies more than three words in a row from it. [`Qwen/Qwen3-Embedding-4B`](/models/qwen-qwen3-embedding-4b) finds the passages nearest each bullet, internal reports and PubMed abstracts together, and [`Qwen/Qwen3-Reranker-4B`](/models/qwen-qwen3-reranker-4b) [scores whether each one supports the bullet](/rerank), keeping the best two that score 0.5 or more. Then the 27B drafts each section sentence by sentence [as JSON](/structured-output), with the bullet each sentence came from and the exact words it quotes, and Python keeps a citation only if those words are really in the passage.

**Pro-tip:** put your own code names and report id prefixes in `never_send` before the first run, not after you spot one in `queries.md`.

Run it on SIE Cluster or SIE Local inside the company, and the outline, the study reports and every draft stay on Corvane's servers, and the PubMed queries are the only part of the work that goes out.

![What leaves the company: on SIE Serverless the outline and internal passages go to SIE; on SIE Cluster or SIE Local only the PubMed queries leave, and queries.md lists every one](/blog/who-owns-the-tokens/what-leaves.webp)

### What Came Out

I ran it on [SIE Serverless](/serverless) with the made-up data, and every step and check ran. The misses are the interesting part. The quote check proves the quoted words exist in the passage, but not that they support the sentence: for "GalNAc-siRNA drugs are taken up mainly by liver cells", both quotes were real, and neither quite said that. The model also added sentences the outline didn't have. And I planted one bullet on purpose, a made-up claim that another company halved its dose. Nothing backed it, and the review table the recipe writes next to the paper (`review.md`) said so, but `paper.md` stated it with a straight face anyway. The model was very confident about a company that doesn't exist. That's why the scientist still reads the draft, and the review tells her where to look. The workflow is meant to give her back much of that half day, but the company is made up and I didn't time anyone.

### Training on the Papers Later

Each run also writes `review.md`, a table of every sentence the model drafted, the bullet it came from and the words it quotes. That table is what turns the library into training data you can trust. Every finished paper gives you the scientist's outline, her edited text and a list of which sentences a model wrote, and without that list you'd be fine-tuning partly on your own model's earlier output and never know how much (and a model trained on its own output tends to learn its own mistakes).

![The loop: an open model at a pinned version drafts, the scientist edits and review.md records what the model wrote, finished papers go into the library, you fine-tune a LoRA on them, and declare it in the model profile on your own SIE deployment for the next drafts](/blog/who-owns-the-tokens/tune.webp)

I'd start with the open model as it is and let the papers pile up. When there are enough, you train a LoRA adapter (a small set of extra weights on top of the base model) on your own hardware and serve it on your own SIE deployment by declaring it in the model's profile ([LoRA adapters in SIE](/docs/engine/lora/)). The tokens an Apache 2.0 model or a scientist you employ wrote come with no provider terms on training. The quotes are different: some come from PubMed abstracts, which aren't yours to train on. `paper.md`'s reference list marks each source as an internal report or a PubMed paper, so use it to mark the quotes from PubMed papers in `review.md` and leave them out of the training set. [Off the Shelf or Fine-Tuned](/blog/small-open-models-across-industries#off-the-shelf-or-fine-tuned) covers when the tuning is worth it.

## Run It Yourself

The easiest way to see this is to run the recipe on SIE Serverless with the made-up data. You need [uv](https://docs.astral.sh/uv/), an [SIE API key](https://console.superlinked.com/console/keys) and an internet connection to PubMed (no key needed).

```bash
git clone https://github.com/superlinked/cookbook && cd cookbook
cp .env.example .env    # then set SIE_API_KEY
cd healthcare/draft_internal_paper_from_outline
uv run recipe.py
```

On SIE Serverless the outline and internal passages do go to SIE to run the models, which is fine for made-up data. For real unpublished work, point `SIE_BASE_URL` at the models running in your own cloud, with `Qwen/Qwen3-Embedding-8B` in place of the 4B (which has no self-hosted image in SIE v0.10.1, so recheck the similarity thresholds); [Choosing Between SIE Serverless, SIE Cluster and SIE Local](/blog/choosing-where-small-models-run) and the cookbook's [SELF_HOSTING.md](https://github.com/superlinked/cookbook/blob/main/SELF_HOSTING.md) cover the setup. Once the models run there, give it one of your own outlines and reports:

```bash
uv run recipe.py --outline my_paper.md --papers ~/our-reports
```

Time it against writing the paper by hand, counting the fact-checking and editing, to see how much it really saves.

## Conclusion

If your data is your moat, the text your teams generate with AI is part of it, and you want as much control over those tokens as you can get: no provider terms on what you train, no watermark you didn't choose, and a record of which sentences a model wrote. Check the model license and your rights in the sources either way. Permissively licensed open models running where your data already lives give you that, and the papers you write this year become the model you train next year. Keep the large hosted models for public material.

I'd love to hear whether you're already keeping track of which of your documents a model wrote, and what your `never_send` list ends up holding. Until next time.