Nvidia did two seemingly opposite things in the same stretch of time in August. It quietly trimmed a proposed funding guarantee on an OpenAI data center project in Ohio, from a reported 250 billion dollars down to something under 120 billion. (yes, both crazy numbers, but maybe less crazy when lower?) Days earlier it announced financing platforms with Apollo, BlackRock, Blackstone, Brookfield, Goldman Sachs, and KKR, built to mobilize more than 500 billion dollars of third-party capital for AI compute.

Less exposure and more money, from the same company, inside the same news cycle, aimed in the same general direction. (The market spent about an afternoon deciding whether to be alarmed, then the buzz-network teams went back to arguing about which model won which benchmark.)

However, when you unpack it, those two moves are the same move underneath. Pull risk off one balance sheet and spread it across a market that exists to hold risk. In my opinion it is the most important thing that happened in AI that week, and it was barely covered as an AI story, because it does not look like one. It looks like finance.

The money has to come from somewhere.

I have been following a thread across a few issues now. (ok, I'll be honest, I follow a lot of threads, but this time I am going to talk about one of the bigger recurrent ones) Your best model loses to a worse one, because the model was never the moat. Then the moat showed up a layer down, in agent memory, where the thing your organization teaches the system becomes the thing you cannot take with you when you leave.

Every time I follow that control point down a layer and call it the basement, the basement turns out to have a basement (can basements have basements?).

For most of this year the sensible answer to "what is under the models" was the physical world. Chips, power, land, water, data centers, and the capital that builds them. This makes sense, physical things are the base... Also, as of this summer, incomplete. Two gates have appeared underneath the concrete, and neither one shows up on a vendor comparison chart.

The first gate is permission. The second is credit.

Picture a company signing a ten-year lease in a premium building in a desirable location. The tenant negotiates hard on the visible number, the rate per square foot, and wins a few points. Huzzah! Everyone shakes hands and celebrates.

What the tenant never reads is the building's own capital stack. The construction loan, the refinancing date, the covenants, the debt-service coverage the lender insists on. That paperwork sits in a drawer three parties away, and it is where the tenant's real terms (even if indirectly) live. Rent is stable and the elevators work, right up until the landlord's refinancing goes sideways. Then the promised second lobby never gets built, maintenance gets thin, the building trades hands, and a ten-year lease turns out to be a document in somebody else's restructuring.

The tenant negotiated the number on the page. The lender set the actual conditions.

Enterprise AI is signing leases right now, at enormous (really…, like never before seen enormous) scale, in buildings whose financing nobody in the room has read. (Or even if they do read them, the understanding simply isn't there.)

None of this is new, by the way. We ran this exact routine with cloud, and many tech leaders have the scar tissue to prove it.

The pitch was elegant. Stop buying servers. Capacity becomes infinite and instant, you pay only for what you use, and a capital expenditure turns into a line item that flexes with the business. Tada! For a while it even felt true.

Then everyone discovered that "infinite" is a marketing term while capacity is a physical one. Anyone who has tried to stand up a particular instance type, in a particular region, on a soon to be bad afternoon has met the error message that explains the difference. (It is a very polite error message. But learning you can't have what you thought was "infinite" in a polite way is no better than any other.)

So an entire apparatus grew up to manage the gap between the promise and the physics. Reserved instances. Savings plans. Committed spend agreements with the discount tiers attached. Capacity reservations. Multi-region and multi-availability-zone architecture. Spot markets for the brave.

Every one of those is a risk-transfer instrument wearing an engineering costume. Spot says you hold the risk and we will pay you (well... offer you a discount anyway) for holding it. Reserved and committed say we will carry the price risk if you carry the volume risk. Multi-region says you will buy capacity twice to insure yourself against your provider having a bad day. The architecture diagram got (and often still gets) the attention, but what was being negotiated underneath it was who eats the loss when the capacity is not there.

The lesson nobody printed on a slide: elasticity was always a financial product dressed as a physical property. Somebody was holding the capacity risk the entire time, and the only question was whether you knew it was you. (Plenty of shops found out during a launch. Or a quarter close. Or a pandemic.)

Now watch the same instruments get rebuilt for tokens. Provisioned throughput units. Model capacity reservations. Committed spend with a model provider instead of a hyperscaler. Deals with committed tokens not users, optional reserved capacity, and more are already hitting enterprise deals. There is a FinOps Foundation working group on the subject, which is how you know something has stopped being novel and started moving towards a discipline.

One difference that I really want you to think about. The capacity behind your cloud reservation was already built, already energized, and already being amortized by somebody. The capacity behind your AI reservation frequently is not. You can not buy a guarantee against a building that has not broken ground, sitting on a grid that has not approved it.

Which is where the two gates come in.

The permission layer used to be invisible because it always said yes. Those days are done.

Texas is the loudest and most noticeable example since they were openly inviting builds into the state. The state's interconnection queue swelled to roughly 474 gigawatts of requested load, something north of five times its record peak demand, with about ninety percent of it tied to data centers. Governor Abbott directed regulators and ERCOT to audit the queue before anything advances, on the entirely fair theory that a number that large describes hope more than demand. Duplicates, speculative filings, and hopeful placeholders piled up until the planning process buckled under them.

Virginia asked the next question. Its regulators ordered Dominion to develop a tariff assigning dedicated transmission costs more directly to the large loads that cause those facilities to get built. Translation: if AI needs a new substation, AI can pay for the substation, rather than quietly distributing the bill across everyone's residential meter. (I live in Texas, but there is a reason beyond government tax rebates I installed solar.)

New York went first and hardest, with a statewide moratorium pausing state environmental permits for new hyperscale data centers for up to a year while it writes standards for energy, water, ratepayers, and communities. (When in doubt double or triple the NIMBY bureaucratic paperwork is a tried and true political tool.)

So what happens when a gate says no? You build your own power. xAI put gas turbines on the ground at Colossus rather than wait in an interconnection queue, and others will copy it (and are copying it), because a turbine you own beats a queue you are stuck in. However, a turbine relocates the permission problem rather than solving it. Same problem, different clothes: air permits, local objection, a fuel supply, and in xAI's case a Clean Air Act suit from the NAACP over turbines that had been running without the permits. What settled it came out of Washington rather than out of engineering. The federal government moved to intervene on xAI's side and have the case dismissed, arguing the site was national security infrastructure. (Isn't that just a brand new kind of trump card that doesn't appear on anybody's risk register? I know it wasn’t on my bingo card.) That is a new party at your capacity table.

Before you go planning on self-generation yourself, the escape hatch has a queue of its own. GE Vernova has something like 10 gigawatts of turbine capacity left across 2029 and 2030 combined, on lead times around three years. Its own CEO says the turbines are not the gating item on a project that long. Permitting, construction, and fuel are.

None of these are AI policy... They are utility policy, land-use policy, and ratepayer politics, which is why they are easy to miss and hard to route around. Software can abstract almost anything. You cannot containerize a substation, and you cannot A/B test your way past a public utility commission.

Somewhere in your provider's roadmap is capacity that has not been permitted yet. That is now a real number in your risk model.

The capital story is stranger, wilder, and further along than most boards realize.

Meta and BlackRock formed a venture around a roughly 14 billion dollar data center campus in El Paso, financed with about 12.5 billion dollars of debt, with outside institutional capital absorbing construction and ownership risk while long-term leases support the borrowing. That is the financing structure of a toll road or a port terminal. Data centers are being reclassified, in real time, as an institutional asset class alongside utilities.

The Bank for International Settlements noticed, publishing a bulletin characterizing the AI buildout as a large capital-investment surge with increasingly significant debt financing, capable of making an economy look overheated and more productive at the same time. (When the central bankers' central bank writes a note about your sector's leverage, that is not a stock tip. It is a weather report, or more specifically a weather warning about conditions being right/wrong.)

Which brings us back to Nvidia doing both things at once. Trimming a guarantee is a company deciding how much downside it wants on its own books. Building 500 billion dollars of third-party financing channels is that same company making sure the buildout continues anyway, funded by people whose business is owning long-lived assets and pricing risk.

So the price you pay for compute in 2028 is being set right now, by credit quality, lease terms, and who holds the bag if demand disappoints. A benchmark on a model is akin to a sprinkle on a cake, which means, it's nice and all but it has nothing to do if the cake doesn’t actually arrive.

The model question, which AI are we using, is the easy one and increasingly the wrong one. Try these instead, and notice that none of them are technical.

Has the capacity we are counting on been permitted? Not planned, not announced, not in a press release with a nice render. Permitted, powered, and out of the queue. If a meaningful share of your provider's committed capacity is sitting in an audit in Texas or a moratorium in New York, your roadmap has a dependency your architecture diagram does not show.

Who carries the downside on the compute we depend on? If your provider's cost of capital moves two points, or its financing partner reprices risk, does that reach your contract? Everyone modeled the technology risk. Almost nobody modeled the counterparty's balance sheet.

Could we leave, and what does it cost in months rather than dollars? (The old axiom of time = money has never been more true.) The June version of this question was about code that only runs well on one vendor's silicon or model. (And that is still important.) It is also now about capacity you cannot replace quickly, because the replacement is waiting on a substation.

Nobody asks these while things are working, which is when they are cheapest to ask.

The model race gets the headlines because it is visible and it changes weekly (daily?). The stack race gets the outcomes because it is invisible, right up until the day you try to leave and discover you cannot. What changed this summer is that the stack race stopped being about who has the most chips and became about who is willing to hold the risk, and who is willing to grant the permission.

So here is the one I would put on your next agenda, and I would love to know how it lands: your AI strategy now has a landlord and a lender. Do you know who they are?

Someone forwarded you trouble.
They clearly think you can handle it. Trouble Worth Making is where I work out loud on how to stop bolting AI onto a pre-AI company and actually rebuild the operating model underneath it. One issue every week or two, no filler, the occasional uncomfortable question.

If the person who sent this has good taste (obviously, they do), subscribe here and get the next one straight from the source.