The argument starts with an admission
In a post published on Saturday afternoon, titled “Models as Insider Risks in the Super Intelligence Era”, Microsoft’s chief executive Satya Nadella argued that organisations deploying frontier models should borrow the controls they already use for powerful people inside the building — and stop treating a vendor’s assurances as a substitute for their own.
The argument opens with something nobody can currently do. With conventional software, Nadella wrote, “we had the tools and capability to trace behaviors to a specific code path”. With frontier models, “we can’t attribute model behaviors and outputs to specific inputs of training data or configurations of model weights” — and yet, he wrote, those models are being deployed “with access to our most sensitive data and giving them the ability to take mission-critical actions on our behalf”.
His conclusion is a transfer of responsibility rather than a transfer of trust. “We simply can’t outsource responsibility for what intelligence does on our behalf,” he wrote. “A model provider’s assurances do not relieve us of that responsibility.” The phrase he uses for the design goal is that “we need to separate the supply of intelligence from the authority over it”.
Why the controls have to sit outside the model
Nadella’s objection to the obvious fix — have one model watch another — is that it does not reduce opacity, it stacks it. “You can and you should use models to adversarially test and verify each other,” he wrote. “However, you can then end up with an opaque model inside an opaque orchestration layer, watched by another opaque model. Essentially nested black boxes.”
The alternative he reaches for is older than the field. The controls that govern what a model can access and what it can do “must sit outside the model”, because of “an information security principle dating back to the 1970s that a program must not be able to bypass or tamper with the mechanisms that enforce its permissions”. In practice that means separating the model from the harness that orchestrates its work and from the action space that defines what it can do.
He also set a floor on reasoning transparency, and named the thing he does not want used as an excuse. Chain-of-thought transparency is “a non-negotiable”, he wrote, and “‘Neuralese’ cannot be a justification for model reasoning to be opaque” — while conceding that transparency alone is not dependable, because “we don’t yet know how to make model outputs themselves consistently faithful or transparent”.
Seven principles, including the brake
The post lists seven design principles. Model diversity: no single model should be the only dependency for an important outcome, or verify its own work. Observe everything: “Every meaningful model action must leave tamper-proof human readable evidence.” Verifiability: test the whole system, including failures, attacks and edge cases, not only successful tasks. Independent controls: an organisation should be able to decide for itself what a model can reach and do. Independent auditability: “No single model should control both a system’s behavior and the evidence required to determine whether that behavior is aligned with the original intent.”
Then containment, which is the line that travelled furthest. “We must assume a model is compromised and contain it from the start,” Nadella wrote. “Think of it like an emergency brake. An authorized person should always be able to pause or shut down a model mid-task.” More capable models, he added, will need containment technology the industry has to standardise on.
The seventh is incident disclosure: when these systems fail or are compromised, “timely disclosure to those affected” plus a way to share what went wrong, which controls failed and how to prevent a repeat — including, he specified, implementation details that change how agents behave at runtime.
What to watch
Nadella committed Microsoft to nothing specific in the post, and the principles are stated as an argument rather than a product roadmap or a standard. What makes them worth reading anyway is who is making them and the direction they point: away from asking whether a given model can be trusted, and towards building systems that do not require it to be. His closing line puts it plainly. “The most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least.”
Two of the seven — observability and incident disclosure — are also the subjects of live policy fights. Whether Microsoft argues for them in those venues, and not only on its chief executive’s feed, is the thing to watch next.
