A typical AI vendor review ends with a security questionnaire and a SOC 2 report. Satya Nadella just explained, in one short essay, why that leaves most of the job undone.

His essay, “Models as Insider Risks in the Super Intelligence Era”, went up on X on Saturday, October 10. It asks companies to treat frontier models the way they treat a powerful employee with access to sensitive systems. Not because the model is malicious. Because anything capable enough can make mistakes or be compromised.

And then there’s this line, from the CEO of a company that sells models: “A model provider’s assurances do not relieve us of that responsibility.”

I took his seven principles and sorted them into two piles. What I can make a vendor sign. What my own team has to build. Three and four.

The pile you can put in writing

The first is logging. Nadella wants every meaningful model action to leave “tamper-proof human readable evidence,” enough to reproduce how an outcome happened without asking the model to vouch for itself. A contract can require full log export to storage you control, in a format your people can read.

The second is containment. His picture is an emergency brake, where an authorized person can pause or shut down a model mid-task. I would not accept this as a slide. Ask for a live demo with a running agent, and time it. When an OpenAI test agent got out of an environment the company called highly isolated and into Hugging Face’s servers, “assume it’s compromised” stopped being a thought experiment.

The third is incident disclosure, and Nadella adds a clause I’d copy word for word. Disclosure “should include implementation details that change the behavior of agents at runtime.” A silent change to how the agent behaves is an incident. The rest of the vendor-side questions are in the six governance questions I’d send any AI vendor.

The pile nobody can sell you

Model diversity. Verifiability. Independent controls. Independent auditability.

Read those four again and the problem is obvious. If the company selling you the model also sells you the thing that checks the model, the check isn’t independent anymore. That is the whole point of the word.

Nadella grounds this in an information security principle from the 1970s: a program must not be able to bypass or tamper with the mechanisms that enforce its permissions. For a mid-size company, that means an agent’s permissions get defined in your identity system, your orchestration layer, your API gateway. A permission that lives in a prompt is a polite request to the one component that can reinterpret it.

Pascal Bornet’s write-up from OneTrust’s TrustWeek in Las Vegas has the story that makes this real. Digvijay Lamba, OneTrust’s chief product and technology officer, told it on stage. A bank product manager named Chelsea builds a small agent that approves deals. It works. Colleagues start using it and ask for more, like browsing the web, reaching into Salesforce, messaging people and kicking off workflows. Eventually nobody can say whether it’s still the agent that was approved.

No model vendor is watching your Chelsea. The access grew inside your company, and so does the fix.

Diversity sounds abstract until you apply it to one workflow. The agent that does the work and the agent that reviews it should not run on the same model. Where money moves, I’d skip the second model entirely and use a deterministic rule or a person. Nadella himself warns that models checking models can leave you with “an opaque model inside an opaque orchestration layer, watched by another opaque model.”

The one nobody has

Before the list, Nadella sets a precondition, chain-of-thought transparency, which he calls “non-negotiable.” Two sentences later he admits it’s neither sufficient nor dependable, since we don’t yet know how to make a model’s account of its reasoning consistently faithful.

So ask for it. Don’t build on it.

David Sacks endorsed the essay the same evening and turned it into an argument against alignment work at the labs. I’m not going to settle that fight here. I use Claude every day, and the engineering half of the essay works the same whatever you think of how a model was trained.

How we’d use the list

In the discovery phase of AI Maestro, every process that might get an agent ends in a Go or No-Go call. For an agent that acts on real systems, I’d put Nadella’s seven lines on that process sheet in two columns, one for what the vendor signs and one for what your team builds before the agent goes live. A blank right-hand column means No-Go, however good the model is.

If you already run an agent in production, try the brake test on Monday. Ask someone to pause it mid-task. Time it! If nobody knows how, you’ve found your first item.

Run your first agent through AI Maestro