Satya Nadella wants organizations to govern powerful AI models the way security teams govern highly privileged insiders: assume that mistakes and compromise are possible, limit access, and keep the enforcement system beyond the actor’s control.
In an X Article published Oct. 10, Nadella argues that today’s frontier models are harder to trace than traditional software. A conventional program can often be followed to a specific code path. A model’s output, he writes, cannot be cleanly attributed to one piece of training data or a particular configuration of weights.
That uncertainty becomes more consequential when an agent can reach sensitive data or take actions in business systems. Nadella’s answer is not to assume that a model is malicious. It is to design for the possibility that any sufficiently capable participant can make a mistake or be compromised.
Put authority outside the model
The central design principle is to separate intelligence from authority. According to Nadella’s proposal, the rules determining what a model may access and which actions it may take should live outside the model itself.
That means treating the model, the software that coordinates its work, and the set of available actions as distinct layers. Permissions and safeguards should be enforced by deterministic systems that the model cannot bypass or alter. In practice, a capable model could suggest or attempt an action, while an external control layer decides whether that action is allowed.
Nadella connects this approach to established enterprise-security practices: verify identity, grant the least privilege needed, log activity, and build containment boundaries. The “insider risk” analogy is therefore about architecture and access, not an accusation of intent.
