On October 10, Microsoft's CEO Satya Nadella published "Models as Insider Risks in the Super Intelligence Era." The argument is short. Nobody can trace why a model does what it does, yet companies are giving models their most sensitive data and letting them act. So don't take the model's word for what it will do, and don't take the model provider's word either. As he puts it:

A model provider's assurances do not relieve us of that responsibility.

His answer is an old security idea applied to a new kind of insider:

we need to separate the supply of intelligence from the authority over it.

The model supplies the thinking. The company running it keeps the authority over what the model can reach, what it can do and when it stops.

That split is the job SatGate does for AI agents. SatGate sits between your agents and the services they use, and every request an agent sends through it is checked against limits you set. Here is how his principles line up with what SatGate does today, and where it stops.

The controls sit outside the model

Nadella:

the controls that govern what a model can access and what actions it can take must sit outside the model.

And:

Orgs should be able to independently determine what a model can access and what actions it can take.

In SatGate you set each agent's budget, the tools it may use, rules on what those tools may do (buy only, or one account only) and an end date. The agent gets a token with those limits built in. SatGate checks each request against them before it reaches the service. The model can't change those limits. Neither can a prompt that tricks it, and neither can the model provider, because the limits live in your SatGate account and not in the model or the provider's settings.

Evidence the model didn't write

Nadella:

Every meaningful model action must leave tamper-proof human readable evidence. If it can't be observed, it can't be trusted!

He also asks that no single model control both what a system does and the evidence of what it did.

SatGate signs a receipt when it refuses an agent over a budget, a missing payment or a tool permission. In Control mode, where SatGate enforces your limits, it also signs one when an agent spends from a budget. The receipt names the tool or route and says whether SatGate allowed or refused it and why. It doesn't name the agent or include the call's arguments. A SatGate Cloud receipt can be checked with the open-source verifier against SatGate's published keys. The agent never writes its own record, so the record doesn't depend on the model's account of itself.

There are limits to this. Not every request gets a receipt. A refusal for going over a rate limit doesn't get one, and neither does a request that never goes through SatGate.

An emergency brake

Nadella:

We must assume a model is compromised and contain it from the start. Think of it like an emergency brake. An authorized person should always be able to pause or shut down a model mid-task.

Revoke an agent in the dashboard and its next request is refused, along with the requests of any helper agents it handed work to. Since this week, a revoke that SatGate can't confirm is shown as failed rather than done, so the off switch never claims to have worked when it didn't. You can also make an agent's riskiest calls wait until you approve them by email.

What SatGate doesn't do is pause and resume. A stop is a stop, and a request already running when you press it finishes.

No single model in charge

Nadella:

No one model should become the sole dependency for an important outcome or be responsible for verifying its own work.

SatGate doesn't care which model runs an agent. The same limits and receipts apply whichever model or vendor you use, so switching models doesn't mean rebuilding your controls. Picking and testing the models is still your job.

What this doesn't cover

Several of his points are about the models and the people who run them: reasoning that can be read, models testing each other, telling people when something fails. SatGate doesn't do those. It covers the actions an agent takes through it, and only those. An agent that holds its own keys to a service can go around any gateway, so give agents your services through SatGate rather than handing them the keys.

Trust the model the least

Nadella ends the essay with this:

The most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least.

That is a good test for any agent setup. Assume the agent will be wrong or tricked sooner or later, and make sure the damage stops at the limits you set.

Read his full post: https://x.com/satyanadella/status/2108931348857827686