Satya Nadella published a post at the weekend arguing that frontier models, closed and open weight alike, should be governed inside companies the way security teams already govern powerful insiders. The piece, titled Models as Insider Risks in the Super Intelligence Era, is a design argument rather than a product announcement.
His starting point is that conventional software could be traced to a specific code path and today’s frontier models cannot, yet they are being handed sensitive data and the authority to act. The proposed fix is to separate the supply of intelligence from the authority over it, and to wrap non-deterministic models in deterministic system design, human controls and documented operating procedures.
He lists six principles: model diversity, so no single model becomes a sole dependency or verifies its own work; observability, with every meaningful model action leaving tamper-proof, human-readable evidence; continuous verification covering failures and attacks rather than just successful tasks; independent control over what a model can access; independent auditability; and containment. On containment he writes, “Think of it like an emergency brake”, with an authorised person always able to pause or shut down a model mid-task.
Why it matters: Microsoft is among the largest deployers of agentic AI in enterprise software, so this reads as a statement about where its own engineering is heading rather than an abstract safety view. Nadella also calls chain-of-thought transparency non-negotiable and rejects opaque model reasoning as a justification. What the post does not do is commit Microsoft to shipping any specific control, set a timeline, or say who would count as authorised.