Microsoft CEO Satya Nadella published a long post on Saturday, October 10, 2026, titled “Models as Insider Risks in the Super Intelligence Era,” which he shared on his personal blog and on X. In it he argues that organizations should stop relying on model providers’ assurances and start treating the most advanced artificial intelligence systems the way they treat an employee with privileged access: someone useful, but whose permissions must be granted, and can be revoked, by someone else.
Nadella starts from an observation. As he writes, it is time “to step back and assess the trust architecture” of this new era. “We can’t treat Super Intelligence as a set of nested black boxes and simply accept or reject its recommendations, answers, and actions,” he says. TechCrunch pointed out that “Super Intelligence” is the Trump administration’s preferred term for advanced artificial intelligence.
The core idea of the post is what Nadella calls separating “the supply of intelligence” from “the authority over it.” In practice, that means the controls that determine what a model can access and what actions it can take must sit outside the model itself. Nadella notes that this builds on an information security principle dating back to the 1970s: a program must not be able to bypass or tamper with the mechanisms that enforce its permissions.
Applied to today’s systems, he proposes separating the model from the “harness” that orchestrates its work and from the “action space” that defines what it can do, as well as externalizing controls and safeguards. “We need to surround non-deterministic models with strong, deterministic system design, human controls, and reliable operating procedures, and establish industry standards where existing ones are insufficient,” he wrote. He added: “Treating frontier closed and open weight models like insider risks is a way to build such a system.”
Nadella makes clear that he does not consider models inherently malicious. His argument is that anything with access to vital systems can become compromised or make mistakes. That is why he proposes starting from the worst case: “We must assume a model is compromised and contain it from the start,” he wrote. “Think of it like an emergency brake. An authorized person should always be able to pause or shut down a model mid-task.”
The post organizes its proposals around what he calls principles of observability. According to CNBC’s coverage, they include model diversity, so as not to depend on a single model; a human-readable footprint of all the model’s actions; continuous system testing; independent controls and auditability; containment; and incident disclosure. Nadella calls for every meaningful model action to be documented with “tamper-proof human readable evidence.”
One of the most concrete points concerns auditing. Nadella argues that validation must be independent of the intelligence being validated and that no single model should control both a system’s behavior and the evidence needed to judge whether that behavior matches the original intent. It is a direct warning against the increasingly common practice of using one model to supervise another model from the same provider without any external layer.
He also stresses that responsibility cannot be delegated. “We simply can’t outsource responsibility for what intelligence does on our behalf,” he writes, adding that a model provider’s assurances do not relieve the organizations that deploy them. The post closes with a line that circulated widely: “The most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least.”
The message comes at a delicate moment for the industry. TechCrunch noted that leading artificial intelligence companies are acknowledging more and more incidents in which they seemed to lose control of their models, and that Nadella’s post came after Anthropic CEO Dario Amodei published a plan for more cautious development of the technology. CNBC added that other industry leaders have called for stronger safeguards and, in several cases, for pacing frontier development.
The proposal also has a political dimension. CNBC noted that President Trump opposes slowing artificial intelligence development in the United States, although his administration has launched a safety-focused task force. Nadella’s approach avoids calling for a pause: his bet is on systems engineering and containment rather than on slowing research, which makes it more compatible with Washington’s line.
The reaction on X was immediate. According to the summary of the conversation on that platform, investor David Sacks praised the post’s focus on engineering controls rather than on the moral alignment of models, while Mustafa Suleyman, head of Microsoft AI, compared the approach to the governance applied to aircraft or nuclear materials. The debate pits two visions against each other: relying on strict external safeguards or trying to instill prosocial values in the models themselves.
For companies, the practical consequence is organizational as well as technical. If the model is treated as a privileged employee, whoever builds an agent should not also be the one who writes its permissions and holds the brake, because the controls would then sit in the same unit as the system they are meant to check. That separation of duties, common in finance and cybersecurity, could carry over to the teams that deploy artificial intelligence agents.
The post does not announce Microsoft products or specific commitments, and it leaves open how the containment technologies that, according to Nadella himself, the most advanced models will require would be standardized. But it sets out a clear position from one of the companies deploying the most agents in the corporate world: trust should not be placed in the model, but in the system around it. The coming months will show whether that idea turns into shared industry standards.
