Satya Nadella didn’t post a thread last Sunday. He published a full essay as an X Article, titled “The Reverse Information Paradox,” and it crossed ten million views in under 48 hours. Microsoft’s CEO doesn’t usually write at that length, so I read it twice, and I still don’t buy the fix he lands on.

He opens with economist Kenneth Arrow’s 1962 Information Paradox: a seller can’t price what they know without revealing it, and the moment they reveal it, they’ve already given it away for free. Nadella flips that paradox for the AI era. The seller isn’t the one at risk anymore. The buyer is. Every prompt you write, every correction you make, every tool call is intelligence your AI vendor absorbs and learns from. “The buyer risks giving away knowledge, just in order to use what they bought,” he wrote. And the better you want the model to perform on your business, the more of that knowledge you have to feed it.

His fix is what he calls a trust boundary: private evals, your own memory and traces, models tuned inside your tenant, nothing crosses to the vendor without explicit consent. He organizes it into five capabilities, the five C’s. Control means owning your evals, memory, and traces. Capability means training inside the limits of your own tenant instead of shipping your data out. Choice means decoupling orchestration from any single model vendor so you don’t get locked in. Cost means combining context, models, and tasks efficiently. Compound is the continuous learning loop the first four make possible. He backs it with a quote from Palantir CEO Alex Karp: “What the technical customers want is control over their compute, their models, their data stack, and their alpha.” Karp went further: they want to know they own the means of production, and that it isn’t being transferred to someone else.

That’s not a random citation. Palantir sells to the most demanding technical buyers on the planet: governments, banks, insurers, defense contractors. If that segment is already writing this into procurement requirements, it’s not a product-marketing idea. It’s a buying condition showing up in enterprise contract negotiations right now. Nadella never says what a company without a bank’s legal department is supposed to do about it.

Most of the companies I talk to are in exactly that spot. They’re not Palantir customers. They don’t have a procurement team large enough to demand a custom data-handling clause from a hyperscaler. What they have is a standard enterprise agreement, a handful of AI pilots running against it, and no internal answer to the question Nadella is implicitly asking: what, specifically, would you lose if your AI vendor learned everything you fed it this quarter? Until someone in the company can answer that with a list, not a feeling, the trust boundary is a slide, not a control.

It’s a more complete framework than anything Nadella has said on this before, and the diagnosis is right. Knowledge leakage to vendors is real, and most companies aren’t even measuring how much competitive advantage leaves through their API calls. But the whole framework rests on an assumption almost nobody is questioning: that the company already knows what knowledge it’s trying to protect.

A Boundary Around Nothing Is Still Nothing

I wrote about a narrower version of this argument three weeks ago, when Nadella made a shorter comment on the same underlying idea in a post about the model as your company’s database. The point then was that you can’t embed in weights what you haven’t documented first. Ask most companies how they make their key decisions and you get the official policy, not the actual process.

This week’s essay is a much richer version of the same idea, and the critique holds up just as well, maybe better. Building a trust boundary is an architecture decision. It requires knowing, precisely, what data, what criteria, what decision patterns you’re protecting behind it. If you can’t name that knowledge, there’s nothing to put inside. You’ve built an expensive lock around an empty room.

Ask any executive what proprietary knowledge they don’t want their AI vendor learning, and most of the time you’ll get a generic answer: “our customer data,” “our IP.” That’s not an operational answer. An operational answer sounds like: “the criteria our risk team uses to reject an account in the first ninety seconds of review, which never got written down because it lives in two people’s heads.” That’s the kind of knowledge a trust boundary should protect. And it’s exactly the kind of knowledge almost no company has put in writing.

Control Is the Pillar We’ve Already Been Building

Of the five C’s, Control comes closest to something we already know how to build: owning your evals, your memory, your traces. I’ve written about this twice in the last few weeks, first on why evals are the new process documentation, then on why the eval is the asset that compounds while the prompt depreciates. Both posts make the same argument Nadella is now making at industry scale: the success criteria you codify in your evals belongs to you, is portable, and survives every model swap and every vendor swap.

But even Control inherits the boundary’s core problem. Owning your evals presupposes you have evals to own. Aaron Levie put it bluntly a few weeks ago: almost all progress on agents comes down to evals, and most of the B2B companies I talk to run zero evals a day. It’s not that they haven’t claimed ownership of their evals. It’s that none exist. In practice, Control doesn’t start by protecting something that’s already there. It starts in the same place everything else does: someone sitting down with the operations team and writing out, for the first time, what makes a decision good.

Compound Doesn’t Work Without a Loop You Don’t Have Yet

The most ambitious pillar in the framework is Compound: the continuous learning loop that accumulates over time, the reason building the other four is worth it. It’s also the one that collapses fastest if you skip the documentation step.

A loop that compounds needs two things: clean signal and an explicit standard to measure each iteration against. Without those, what accumulates isn’t competitive advantage. It’s noise stored at higher volume. A company logging every model interaction without ever defining what separates a good answer from a bad one has built a large file, not a compounding asset. Nadella’s Compound sounds like an investment that grows on its own. In practice, it only compounds if someone put the quality standard in place from day one, the same way an eval only measures something once someone has already defined what “good” looks like for that specific process.

Take a sales team running an AI agent to score inbound leads. If the team just logs every score the model produces and moves on, a year of that history teaches you nothing, because nobody ever recorded which of those scored leads actually closed and which went nowhere. What compounds is the version where someone tied every score back to the real outcome, deal won or deal lost, from week one. Eighteen months in, that second team can tell you exactly which signals the model gets wrong and why. The first team just has a bigger spreadsheet of guesses.

What We Do About This in AI Maestro

The first two phases of AI Maestro exist for exactly this gap. Before we talk about which model to run, which orchestration vendor to pick, or how to structure a trust boundary, we map the real processes in your operation and write down, on paper, the judgment that currently lives undocumented in your most experienced people’s heads. The Opportunity Score we produce at the end of that work is, in Nadella’s language, the inventory of what goes inside the boundary before you build the boundary.

Nadella is right that companies need protection from what leaks out of every interaction with an AI vendor. But a boundary around nothing is still nothing. The work starts by documenting what you know, not by deciding how to hide it.

Document what your company knows before you build the boundary