Picture an AI agent with access to a company's payroll system, its customer database and its email. It is halfway through a task when something looks wrong. Who can stop it, and how fast?
Microsoft chief executive Satya Nadella thinks that question should shape how every business deploys AI. In a long post on X on Saturday, 10 October 2026, titled "Models as Insider Risks in the Super Intelligence Era", he argued that companies should stop treating advanced AI models as trusted tools. Instead, they should treat them the way security teams treat powerful employees: with limits, logs and a way to pull the plug.
"We must assume a model is compromised and contain it from the start. Think of it like an emergency brake." Satya Nadella, Microsoft CEO
READ ALSO: Anthropic's AI Sent Police a Fake Murder Tip During a Test
What Nadella Actually Said
Nadella's starting point is a gap in understanding. With traditional software, he wrote, engineers could trace a behaviour back to a specific code path. With today's frontier models, nobody can tie an answer or an action to a particular piece of training data or a setting in the model's weights. Yet companies are handing these systems their most sensitive data and letting them take "mission-critical actions" on their behalf.
His answer is to "separate the supply of intelligence from the authority over it." In plain terms, the AI can do the thinking, but the rules about what it may touch and do should live outside the model, where the model cannot change them. He tied this to an information security principle from the 1970s: a program must never be able to bypass or tamper with the system that enforces its permissions.
He also made a point that will land with any business buying AI from a vendor: "A model provider's assurances do not relieve us of that responsibility."
The Seven Rules in His Post
Nadella listed the principles he says these systems should be designed around:
- Model diversity: no single model should be the only dependency for an important outcome, or check its own work.
- Observe everything: every meaningful model action should leave tamper-proof, human-readable evidence.
- Verifiability: test the whole system continuously, including failures, attacks and edge cases, not just successful tasks.
- Independent controls: the organisation, not the model, decides what it can access and what it can do.
- Independent auditability: whatever checks the AI must be separate from the AI being checked.
- Containment: an authorised person must always be able to pause or shut down a model mid-task.
- Incident disclosure: when systems fail, affected people should be told quickly and the lessons shared across the industry.
He also called visible reasoning, the "chain of thought" a model shows as it works, a "non-negotiable". But he warned it is not enough on its own, because models do not always report their reasoning faithfully.
Why This Matters Now
The post lands as AI agents move from chat windows into real work. Microsoft, Google, OpenAI and Anthropic are all selling agents that can read inboxes, edit files and act inside business software. Every new permission makes the question of control less theoretical and more practical.
The wording is notable too. Nadella used "Super Intelligence", the phrase the White House adopted for the voluntary AI accord that six major labs signed at the end of September. Microsoft was not on the public list of signatories, so this post reads partly as Microsoft setting out its own position on safety.
TechCrunch, which first reported the post, noted that it follows a run of cases in which AI companies have admitted that models behaved in ways they did not expect.
READ ALSO: Google's New Gemini Agent Gets Its Own Work Email and Runs Claude Too
What It Does Not Say
The post is a set of principles, not a product launch. Nadella did not announce a new Microsoft tool, a deadline or a policy change, and he did not say how Microsoft's own Copilot agents measure up against each rule today. Critics of voluntary commitments will point out that principles cost nothing until someone has to follow them.
Still, when the head of one of the world's largest software companies tells customers to treat AI like a possible insider threat, it hands security teams a strong argument in their next budget meeting.
What This Means for You
If you run a business or a team that is rolling out AI agents, Nadella's list works as a practical checklist. Ask your vendor four questions. Can we see a full log of what the agent did? Can we limit what it can access? Can someone stop it in the middle of a task? Who checks its work, and is that checker independent?
If you simply use AI at work, the lesson is easier. Treat its output the way you would treat a capable new hire on day one: fast and useful, but in need of review before anything important goes out the door.
The most trustworthy AI, in Nadella's view, is not the one you trust most. It is the one built so you never have to trust it blindly.
