Satya Nadella wants companies to assume an advanced AI model is already compromised. In an October 10 essay, Microsoft’s CEO called for permissions and logs outside the model’s control and a human-authorized “emergency brake” that can stop it mid-task. It is a design demand, not a Microsoft feature announcement. That distinction is the point.
A clever model should not grade its own access
The Rundown and Superintelligence highlighted the same core proposal: separate a model from the harness that gives it tools, keep control logic where the model cannot rewrite it, record meaningful actions in tamper-resistant human-readable logs, and preserve a way for an authorized person to pause execution.
That sounds obvious until an agent is told to decide whether its own action needs approval. A prompt-injected model can interpret a rule creatively, skip escalation or produce a persuasive explanation after the damage. The control has to live in deterministic application code.
Microsoft’s own agent-security guidance already recommends narrow responsibilities, zero access by default, task-scoped permissions, distinct agent identities and escalation triggers enforced by an orchestrator. Nadella’s brake turns those patterns into a blunt executive question: can a human stop this thing while it is running?
A stop button without containment is theatre
A visible pause control helps only if it can revoke the permissions and credentials an agent is using. It should block queued tool calls, cut active sessions, preserve the log and prevent automatic restart. If the model can edit the audit trail, mint another credential or hand work to a second agent, the red button is decoration.
It also has to work before a task ends. Approval after an email is sent, a database is changed or a purchase is placed is a receipt, not a control. The relevant checks belong at the action boundary: before sending, deleting, paying, publishing or escalating privilege.
Four questions for any agent vendor
Ask for a live demonstration, not a policy slide:
- Can an administrator stop an active task and its queued actions?
- Are tool permissions enforced outside the model and limited to that task?
- Can the agent alter or erase its activity log?
- Does every action identify the agent, the user it represented and the credential used?
These controls reduce autonomy. That is a feature for consequential work. The right comparison is not whether one agent completes a demo with fewer clicks. It is whether a mistake stays small, visible and reversible.
We reached the same conclusion when looking at NVIDIA’s agent-safety platform: the model is only one layer. Nadella has now made the buyer’s test simpler. If a vendor cannot show who holds the brake and what it disconnects, do not give its agent a task you cannot undo.
Cover art: AI-generated editorial composition by TMRW.
