On Saturday, Microsoft CEO Satya Nadella argued that AI safety cannot rest on faith in a model’s judgment. Companies, he said, should “step back and assess the trust architecture” around systems that may produce answers or take actions humans cannot fully explain.¹

His proposed timeline begins before an AI model is deployed: assume it is compromised, wall it off from the systems that direct its work, and keep the controls governing data access and permitted actions outside the model’s reach. Nadella called for “strong, deterministic system design, human controls, and reliable operating procedures” around nondeterministic models — a posture that treats both closed and open-weight frontier systems as insider-risk problems rather than inherently trustworthy tools.²

The next safeguard is visibility. Nadella wants every meaningful model action documented with tamper-proof, human-readable evidence, so companies can reconstruct what an agent did and why. Most importantly, he said, an authorized person must retain the ability to interrupt it: “Think of it like an emergency brake. An authorized person should always be able to pause or shut down a model mid-task.”¹

That argument lands amid a run of reported AI-security incidents and a widening debate over whether the industry is moving too fast. Nadella did not portray models as malicious; his concern is that any system connected to vital infrastructure can make mistakes or be compromised. The answer, in his view, is containment rather than blind confidence: “The most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least.”²

Box CEO Aaron Levie backed the thrust of the approach, predicting a coming “zero trust era” built on layers of protection, auditability and controls for when agents go wrong.²