NIST SP 800-218A PS.1.1: Store all code and model elements on least-privilege terms, with reward models and weights kept apart (High)

What does PS.1.1 require?

Code storage governed by least privilege extends to the models themselves, their weights, the pipelines, any reward models and every other model element whose confidentiality, integrity or availability needs protecting, whether or not they sit in the same place or under the same mechanism. Direct access to models and their elements is minimised wherever they are stored or run; reward models are stored separately from models and data; access to model weights is indirect only. The organisation may go further by preventing all human access to weights and by requiring that model development happen only inside approved environments.