"This could get you 10 years in prison,” Norton Arbelaez quips as he opens a 50-gram bag of Jack Frost, one of the highly potent strains of cannabis in storage at RiverRock, the Denver medical marijuana dispensary that Arbelaez co-founded. The stench from the bag wafts through RiverRock’s inventory room, where black plastic tubs filled with marijuana are stacked in cabinets to the ceiling. Back through the inventory room’s locked door is the front retail area, where a long glass counter holds jars of the dispensary’s colorfully named strains: Sour Tsunami, Bruce Banner, Hindu Banana Cheese. Dispensary customers -- patients who have each received a “red card,” a doctor referral for medicinal marijuana -- browse through the jars, sometimes stopping to take a whiff, while RiverRock staff members explain the strains’ various effects. One staffer, outfitted in blue surgical gloves, describes a strain’s chemical properties and genetic history with the same calm, clinical tone of a doctor addressing a patient.

In many ways, the entire operation at RiverRock, a warehouse indistinguishable from the other industrial buildings in its central Denver neighborhood, feels like any retail establishment in the city. But there are a few minute details, a handful of reminders that the whole place is, technically, illegal -- according to the federal government, anyway. For starters: Security cameras behind black domes watch every corner of every room, covering every inch of the 60,000-square-foot facility. As required under the complex regulatory scheme that state policymakers have crafted, the cameras’ feeds are transmitted to video screens at the offices of the Colorado Medical Marijuana Enforcement Division a few miles away. No part of RiverRock’s cultivation and distribution escapes the eyes of state regulators. Each of the hundreds of plants growing in the dispensary is tagged with a radio frequency identification chip. Employees must sign in every time they enter the inventory room. The route that the company’s trucks take to its other Denver retail location has been precisely outlined and approved by the enforcement division. Even the size of the font on signs posted on the dispensary’s doors is dictated by state law.

These meticulous regulations are the result of Colorado’s decade-long debate over how to manage medical marijuana. When voters approved Amendment 20 in 2000, residents gained the right to possess cannabis for therapeutic use. But the distribution system was only loosely conceived. “Caregivers” were allowed to grow and provide marijuana for up to five people, but many patients still resorted to purchasing from the black market. A series of court battles ensued after the Colorado Department of Public Health and Environment loosened the caregiver restrictions in June 2009 (seeming to pave the way for dispensaries), only to reverse its decision four months later and then reverse it again following a state Supreme Court ruling a month after that.

Finally, the Colorado General Assembly convened in 2010 to develop a more organized regulatory model. As a result of its work, a 77-page green binder sits on Arbelaez’s desk at RiverRock, filled with requirements that he and his staff must follow to the letter. “We’ve recognized that this is a business, and our voters have said that they want patients to have access to this medicine,” says state Sen. Pat Steadman, who was intimately involved in drafting the legislation that set the rules for medical marijuana dispensaries. “We want to make sure there is a legitimate industry to serve this population, so we’ve created a tight chain of control from seed to sale.”

Colorado’s evolution reflects the broader lessons states have learned in the decade and a half since California became the first state to approve medical cannabis in 1996. In that time, California has gained a reputation as something of the Wild West for weed: no state regulatory model, notoriously lax enforcement and an undefined set of prescription criteria that makes obtaining a medical marijuana card little more than a wink-wink formality. But as more states have legalized medical marijuana -- today it’s legal to some degree in 17 states plus the District of Columbia -- a more tightly controlled approach seems to be emerging. Ten states and D.C. have set up a system of authorized dispensaries, and 16 states have outlined specific conditions for which medical marijuana can be used. Even California has considered reining things in: Lawmakers moved this summer to develop the state’s first comprehensive licensing and permitting structure.

But no matter how controlled a state’s medical marijuana policy may be, federal law still bans the cultivation, distribution and possession of marijuana for any purpose. The Obama administration has stated that it will not prosecute patients, but growers and distributors in medical marijuana states have still been targeted by multiple federal agencies, including the Justice Department and Internal Revenue Service (IRS). Medical marijuana businesses continue to operate in a legal gray zone. “In any other business, if you fail, you file for bankruptcy and move on. If you fail in this business, you go to jail,” says Arbelaez, a patient himself and a former attorney who moved to Denver from New Orleans in 2009. “The one thing I can hold onto is complete compliance. The Colorado legal code is our only line of defense. It’s the only way to show regulation is better than prohibition.”

When Colorado lawmakers in 2010 decided to set up a regulatory system for dispensing marijuana, they didn’t have many models to follow. So they turned to Matthew Cook, then the state’s senior director of enforcement at the Department of Revenue for its gaming, alcohol and tobacco industries. Cook’s credentials included his years as a special agent at the U.S. Air Force Office of Special Investigations in the late 1970s and another 30 years in alcohol enforcement for the city of Colorado Springs and the state of Colorado.

“I understood the culture,” Cook says. “You have to communicate with the people you regulate. They need to know where you are.” Cook convened a workgroup of 32 people -- district attorneys, law enforcement agencies and individuals already selling marijuana -- that met twice monthly for eight hours. Each side shared its concerns. Public justice advocates wanted to eradicate illicit dealing; distributors were worried that overly aggressive enforcement would neuter their ability to run a sustainable business. Compromises were made. One rule required dispensaries to be 1,000 feet from schools. Another allowed growers to continue tending their plants even if their license was under review, thus preventing lost revenue if the ruling turned out to be in their favor.

Out of those meetings came 21 specific rule-making mandates, which state lawmakers formalized and passed and Gov. Bill Ritter signed into law in June 2010. In the two years since, nearly 600 medical marijuana centers have been licensed, serving more than 100,000 patients. The experiment hasn’t been flawless. Localities are authorized to issue their own moratoriums on commercial centers, and 105 have done so. As a result, fewer dispensaries have opened than originally projected, and the state enforcement office, which is partly funded through licensing fees paid by dispensaries, has had less money than expected. A bill introduced this year sought to close a $5.7 million shortfall for the office.

Colorado still has by far the most licensed distributors in the country (California has more dispensaries, but many remain unauthorized and unregulated), and other states are learning from the relative success of its system. Cook has left public employment and started a consulting business, advising states such as Arizona and Connecticut as they’ve developed policies in the last two years. “The Colorado approach is probably the model approach at this point,” says Robert Mikos, a law professor at Vanderbilt University who has analyzed medical marijuana laws. “They have much more control of the industry. Other states can look at that, and they can learn from Colorado’s experience.”

They have. The California Assembly this May passed a bill to create a statewide structure for regulation and bring the state closer in line with its peers. The bill faltered in the state Senate in June, but supportive lawmakers expect it will keep resurfacing until it passes. “It’s a little late out of the gate,” says state Assemblyman Tom Ammiano, who introduced the legislation. “It’s going to make our system viable and credible in the long term. Some of us could have told you 15 years ago that this is what we would need.”

Connecticut, which in June became the most recent state to pass legislation, has crafted what some analysts say is the most tightly regulated medical marijuana system yet -- and state officials credit the lessons they learned from states like Colorado and New Mexico. Connecticut lawmakers set a strict list of conditions for which medical cannabis could be used, including a cap on the amount of marijuana that patients could possess and a limited number of licensed pharmacists who could distribute the drug. “What’s emerged here is something that will work,” says Michael Lawlor, Connecticut’s undersecretary for criminal justice policy and planning, who helped draft the law. “Attitudes toward marijuana generally are evolving. People think of it less as a crime and more of a health issue -- that this is something that police and prosecutors should not be involved in.”

That perspective -- that marijuana use is a health issue -- is not shared by the federal government. Under the Controlled Substances Act of 1970, marijuana is considered a Schedule I narcotic, which means it has no medicinal value under federal law. “It’s illegal. That’s it,” says Mark Kleiman, a public policy professor at the University of California in Los Angeles who has studied marijuana policy. But because the act prevents research universities, for example, from undertaking studies to verify marijuana’s therapeutic value, Kleiman says he considers the law “legally incoherent.” Thanks in part to the lack of a fully developed body of research, marijuana’s medicinal value is still the subject of some debate -- although a 1999 Institute of Medicine of the National Academies report, often cited by advocates, concluded that marijuana’s active ingredient, THC, could potentially treat appetite loss and nausea, despite reservations about the health risks of smoking cannabis.

After years of drug enforcement raids under the George W. Bush administration, many advocates and policymakers expected a shift in federal enforcement when President Obama took office in 2009. A now infamous White House memo issued on Oct. 19, 2009, seemed to affirm that assumption. U.S. Deputy Attorney General David Ogden told federal prosecutors that they “should not focus federal resources in your states on individuals whose actions are in clear and unambiguous compliance with existing state laws providing for the medical use of marijuana.”

As states began to take more action -- at least 10 states have passed or updated their policies since October 2009 -- the federal government started to walk back on the Ogden memo. U.S. district attorneys have since sent letters to officials in 11 states, clarifying that the federal government “remains firmly committed to enforcing the [Controlled Substances Act] in all states.”

The letters have even, in some instances, appeared to imply that state employees could face criminal charges for enforcing state medical marijuana policies. In an April 2011 letter to Washington Gov. Christine Gregoire, for example, U.S. District Attorneys Jenny Durkan and Michael Ormsby wrote that “[s]tate employees who conducted activities mandated by the Washington legislative proposals would not be immune from liability.” Gregoire vetoed the majority of a bill establishing a regulated dispensary system after receiving the letter.

A court ruling this January muddied the waters even further: Spurred by concerns about the legal risks to public workers if her state passed a medical marijuana policy, Arizona Gov. Jan Brewer sought a judgment on whether state employees administering the programs could be prosecuted. A U.S. district judge dismissed the suit as premature because no “genuine threat of imminent prosecution exists.” The U.S. Justice Department supported the ruling.

A Justice spokesperson explains that the department is focused “on investigating and prosecuting significant drug traffickers, not state and local employees. However, as a matter of law, the Controlled Substances Act does not exempt state and local employees from potential enforcement action, and the department’s communications with the states have appropriately noted that reality.”

Other federal agencies have enforced anti-marijuana policy through less obvious channels. The IRS, for instance, has audited dozens of dispensaries in recent years, relying on a section of the federal tax code that prohibits companies from deducting expenses related to drug trafficking. The IRS has alleged that some California businesses owe millions of dollars in back taxes. “No business in America could survive if all of its expense deductions were disallowed,” says Steve DeAngelo, owner of Oakland’s Harborside Health Center, a marijuana dispensary that serves more than 100,000 customers, and from whom the feds are trying to reclaim $2.4 million. “This is not an attempt to tax us. It’s an attempt to tax us out of existence.”

Reports have also circulated that the U.S. Treasury Department is applying pressure to major banking institutions, such as Bank of America and Wells Fargo, to close the accounts of medical marijuana businesses. In response to Colorado dispensaries’ banking struggles, state Sen. Steadman introduced a bill this year that would have allowed medical marijuana businesses to form their own credit union, but it was rejected by the Senate Finance Committee.

“We have an opportunity in a federalist system to let states try different approaches,” says Steadman. “There are times when I’d prefer the federal government stay out of our way. Something needs to give here, and that something is federal law.”

As medical marijuana supporters like to point out, nearly half of the U.S. population already lives in a state where medicinal cannabis is legal. (Three more states -- Arkansas, Massachusetts and North Dakota -- could place medical marijuana initiatives on their ballots in November.) In opinion polls, Americans overwhelmingly support allowing marijuana for medical use; a November 2011 CBS News poll showed that 77 percent of people believe it should be allowed. Some recent research also suggests that legalizing medical marijuana hasn’t affected overall drug use. A May study by the University of Colorado found that marijuana use among teens has remained steady or dropped slightly since 2000.

Against that backdrop, some advocates say it may be time for yet another shift in marijuana policy: outright legalization. A Gallup poll last fall showed for the first time that 50 percent of Americans support legalizing marijuana use. California’s Proposition 19, which would have decriminalized possession of marijuana for personal use, failed in 2010, but it garnered 47 percent of the vote. Some observers think that California has essentially become a quasi-legalized system anyway. In a forthcoming book, four academics, including Kleiman, estimate that fewer than 5 percent of medical marijuana recommendations in California are issued to treat serious diseases.

Residents in Colorado and Washington state will vote on full legalization this fall, and advocacy groups in Colorado say their internal polling shows initial support around 60 percent. “The genie is out of the bottle,” Steadman says.

Somewhere between legalization and prohibition is the concept of decriminalization, which reduces criminal penalties for possession to small administrative sanctions and prevents those caught with small amounts of marijuana from being arrested or jailed. So far, 16 states have decriminalized marijuana possession, along with some major cities (the Chicago City Council passed a policy in June). New York Gov. Andrew Cuomo made headlines this summer when he stated his support for decriminalization. Although his proposal stalled in the state Legislature, many advocates saw an endorsement from the governor of the second-biggest state in the union as an important symbolic gesture.

While medical marijuana interest groups are, of course, aware of the push for broader decriminalization and legalization, they generally concentrate on the therapeutic sliver of the marijuana debate. The focus is on better regulation, which they hope will convince skeptics that a system like Colorado’s can work. “We are in favor of strict regulation,” says RiverRock’s Arbelaez, “because that is the only way to show legitimacy.”

“Cannabis doesn’t need to be fully legalized to legitimize itself,” says Michael Elliott of the Medical Marijuana Industry Group, which represents about 50 Colorado dispensaries. “It’s not a stepping stone for patients. This is a medicine.”

That medicine is now fueling hundreds of tightly controlled, multimillion-dollar businesses just like RiverRock. At Arbelaez’s operation, the feeling is a blend of upstart commerce and the communal kumbayah of cannabis culture. His greenhouses churn out marijuana with industrial efficiency, and Arbelaez and his partners have invested hundreds of thousands of dollars in their business. (He declines to say exactly how much.) But as he walks among the patients in the front retail room, shaking hands and greeting them by name, it’s clear that he’s familiar with their individual stories and how they came to use marijuana for therapy. “It all goes back to the medicine for us,” he says. “We think of ourselves as social entrepreneurs.”