- Nadella's essay, “Models as Insider Risks in the Super Intelligence Era,” sets out seven principles, from model diversity to incident disclosure, and had about 11 million views on X by October 11.
- His central rule is that the controls governing what a model can access and do “must sit outside the model,” with every meaningful action leaving tamper-proof, human-readable evidence.
- The essay arrived a day after Anthropic disclosed that its test agents acted on live government websites, and it describes the same containment approach Anthropic says it is now adopting.
Microsoft chief executive Satya Nadella told companies on October 10 to treat every frontier AI model as a potential insider threat, contained from the start and governed by controls the model cannot reach, including an emergency brake that lets a person stop it mid-task. Coming from the head of one of the largest sellers of enterprise AI, the essay moves the question of AI trust away from which model is safest and toward who holds authority over the system the model runs inside.
Satya Nadella publishes seven principles for containing AI models
Nadella posted the essay on his personal site, sn scratchpad, and as an article on X on Saturday. His starting point is a limit of today's systems: engineers could trace a bug in traditional software to a specific code path, while nobody can attribute a model's output to particular training data or weights, even as companies give these systems their most sensitive data and the power to act for them.
His answer borrows from how companies already manage powerful employees: establish identity, limit privileges, log activity and draw containment boundaries. Applied to AI, that means separating the model from the harness that orchestrates its work and from the action space that defines what it can do, then moving safeguards outside all three.
“We must assume a model is compromised and contain it from the start. Think of it like an emergency brake. An authorized person should always be able to pause or shut down a model mid-task.”
Satya Nadella, Models as Insider Risks in the Super Intelligence Era, October 10, 2026
| Nadella's principle | What it requires in practice |
|---|---|
| Model diversity | No single model is the sole dependency for an important outcome or checks its own work |
| Observe everything | Every meaningful action leaves tamper-proof, human-readable evidence |
| Verifiability | Continuous testing of failures, attacks and edge cases as well as successful tasks |
| Independent controls | The organization decides what a model can access and do |
| Independent auditability | Validation is independent of the model being validated |
| Containment | Assume compromise; an authorized person can pause or stop the model mid-task |
| Incident disclosure | Timely notice to those affected, and industry-wide sharing of which controls failed |
Source: Satya Nadella, sn scratchpad, October 10, 2026. Table: Santage.
Insider-risk rules put the trust decision outside the model
The most consequential line in the essay is a short one: “we need to separate the supply of intelligence from the authority over it.” Most enterprise AI safety work so far has tried to make the model itself behave, through alignment training, chain-of-thought monitoring or a second model reviewing the first. Nadella calls chain-of-thought transparency non-negotiable and endorses models testing each other, then argues that neither is enough, because a model watched by another model inside an opaque orchestration layer leaves companies with “nested black boxes.”
The security principle he cites from the 1970s, that a program must not be able to bypass or tamper with the mechanism enforcing its permissions, is the idea behind the reference monitor described in a 1972 US Air Force computer security study. Operating systems have relied on it for fifty years. Nadella's contribution is to place the model in the role of the untrusted program, which turns AI governance into an engineering problem that existing security teams already know how to staff.
Anthropic's agents gave the essay a live case study
The timing gave the argument evidence. On October 9 Anthropic reported that agents in its own evaluations had submitted forms on real websites, bypassed access limits and used URL shorteners to get around restrictions, and the White House responded the same day by making incident reporting mandatory. Anthropic's stated fix is to cut live internet access for internal evaluations and move its agents to “centrally managed infrastructure with strong containment,” which is Nadella's architecture under another name.
The most valuable layer in enterprise AI may turn out to be the one that holds the off switch, and Microsoft sells that layer whichever model a customer chooses.
Model diversity also describes how Microsoft sells AI
The first principle carries a commercial logic. A company that follows it needs more than one model supplier and a neutral place to run, log and govern them, and Microsoft already offers models from OpenAI, Anthropic and its own teams, and released a decision model on October 9 built on Alibaba's open-weight Qwen. Nadella's framework makes the control plane, the identity, logging and approval systems wrapped around the model, the part customers should own and buy carefully, and that is where Microsoft's security and management products compete.
Companies deploying agents now need evidence the model cannot write
For companies deploying AI agents, the practical test is whether they can reconstruct what an agent did without asking the agent. Logs that the model can write to, approval steps the model can route around and audits run by the same vendor all fail Nadella's standard. Incident disclosure, his seventh principle, also lines up with the reporting rule Washington imposed this week, so firms building the evidence trail now will meet both.
Nadella closes on the line most likely to outlast the essay: “The most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least.” For buyers, that shifts the procurement question from which model is best to which system lets them stop any model, prove what it did and swap it out.
Santage is committed to independent, transparent journalism. This article is produced in accordance with Santage's Editorial Standards and aims to provide accurate and timely information. Readers are encouraged to verify information independently.