Microsoft’s Satya Nadella Says to Treat AI Models Like Insider Risks. Here’s What That Looks Like for a Small Business
Microsoft CEO Satya Nadella says organizations should assume an AI model is compromised and contain it from the start, with outside controls, tamper-proof logs and an emergency brake. Here’s how to apply that thinking with layered defenses.
Here Is How Layered Defenses Help When the AI Itself Is the Insider
Most security programs already plan for the insider who makes a mistake or gets compromised. Microsoft CEO Satya Nadella now says AI models belong in that same category, and that businesses should design around the assumption that a model will, at some point, do the wrong thing.
Nadella laid out the argument in a Saturday post on X, which Anthony Ha summarized for TechCrunch. The full essay, titled “Models as Insider Risks in the Super Intelligence Era,” is also published online.
The argument in plain terms
With traditional software, Nadella writes, you could trace a behavior back to a specific piece of code. With today’s frontier models you can’t tie an answer or action to particular training data or settings, yet companies are giving these systems sensitive data and the power to act on their behalf. A model provider’s assurances, he argues, don’t remove the customer’s responsibility for what the AI does.
His proposal is to treat both closed and open-weight models like insider risks. Not because they are malicious, but because anything capable with access to important systems can make mistakes or be compromised. He points out that businesses already know how to manage powerful insiders: establish identity, limit privileges, log activity and build containment boundaries.
The central idea is that the controls deciding what a model can access and do must sit outside the model. That means separating the model from the software that orchestrates its work and from the set of actions it is allowed to take. Nadella lists principles that follow from this: no single model should verify its own work, every meaningful action should leave tamper-proof, human-readable evidence, systems should be tested against failures and attacks, organizations should set access independently, audits should be independent of the AI being audited, and failures should be disclosed promptly. On containment he is blunt: assume the model is compromised from the start, and make sure an authorized person can always pause or stop it mid-task, like an emergency brake.
TechCrunch notes the post comes as AI companies acknowledge more incidents in which they appeared to lose control of their models.
Here is how layered defenses help
You don’t need to run frontier AI to use this thinking. If your staff use AI assistants or agents that can read files, send email or change records, each layer below limits what a misbehaving model can do.
- Layer 1, identity for every AI tool. Give each assistant or agent its own account or app registration rather than borrowing a person’s login, so you can see and revoke exactly what it can reach. In Microsoft 365, for example, that means a dedicated Entra ID app identity with its own permissions; other platforms offer the same idea.
- Layer 2, least privilege outside the model. Set permissions in your identity and data systems, not in prompts. Restrict AI tools to the sites, mailboxes and folders they truly need, and use sensitivity labels or similar data classification so confidential files stay out of reach.
- Layer 3, logs the AI can’t edit. Send AI activity to audit logs or a central log platform that the tool itself cannot change, and review them.
- Layer 4, human approval for consequential actions. Require a person to approve payments, external emails, deletions and permission changes made by an agent.
- Layer 5, an emergency brake. Know who can disable an AI tool or its app identity, and how fast. Write it into your incident response plan and test it.
- Layer 6, a second check. For important outputs, don’t let the same AI verify its own work. Use a person, or a separate tool, to review.
What this means for your company
AI features are arriving inside the software you already pay for, often switched on by default. Treating them like a new employee with broad access, someone you vet, limit and watch, is a practical way to get the benefits without handing over the keys.
- Inventory the AI features in use, including those built into your productivity suite, CRM and help desk tools.
- Review what data each one can reach and tighten sharing on sensitive files before rolling AI out more widely.
- Write a short AI use policy covering approved tools, data that must never be entered, and who approves new agents.
- Assign an owner for each AI tool who is responsible for its permissions, logs and shutdown procedure.
Need help putting identity, permission and logging controls around the AI tools already showing up in your business? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
