Nadella lists 7 principles for AI models as insider risks

Microsoft CEO Satya Nadella says companies should treat frontier AI models, closed and open weight, like insider risks. He made the case in an essay posted on X on Oct. 10, “Models as Insider Risks in the Super Intelligence Era.”

His reason: “any sufficiently capable actor with access to important systems can make mistakes or be compromised.” Models need not be malicious, he wrote.

The rule in English

The controls on what a model can see and do must sit outside the model, Nadella wrote, apart from the harness that runs its work.

“We must assume a model is compromised and contain it from the start,” he wrote. “Think of it like an emergency brake. An authorized person should always be able to pause or shut down a model mid-task.”

The seven principles

Nadella listed seven:

• Model diversity: no one model is the sole dependency for an important outcome or checks its own work.
• Observe everything: every meaningful action leaves “tamper-proof human readable evidence.”
• Verifiability: test the whole system, including failures and attacks.
• Independent controls: organizations decide what a model can access and do.
• Independent auditability: “Validation must be independent of the intelligence being validated.”
• Containment: the emergency brake.
• Incident disclosure: timely notice to those affected and shared lessons industrywide.

Who it binds

No one. It is an opinion essay. It announces no product, timeline or standard.

Nadella puts the burden on deployers. “A model provider’s assurances do not relieve us of that responsibility,” he wrote.

What it means for you

Founders and IT leads running agents: check whether a person outside the model can stop it mid-task, and whether its logs can be read without trusting the model.

What’s next

Nadella calls for industry standards where existing ones fall short, including for containment; the essay names no body or timeline.