The Controls Have to Sit Outside the Agent
An agent can be told what it may not do, but only a control outside the agent can stop it.
On October 10, 2026, Satya Nadella, CEO of Microsoft, argued that traditional software let us trace behavior to a specific code path, while that kind of mechanistic understanding does not carry over to agentic systems. Those agents are already being connected to sensitive data and given the ability to take mission-critical actions. He wrote: “We simply can’t outsource responsibility for what intelligence does on our behalf. A model provider’s assurances do not relieve us of that responsibility.”
His central instruction was to “separate the supply of intelligence from the authority over it.” This post takes that framing and follows it where it leads for organizations deploying agents in production: the controls, evidence, and ability to stop an agent must be independent of the intelligence being governed.
Why can’t the model be the control?
Because the model is the thing whose behavior needs to be constrained. Nadella calls for surrounding non-deterministic models with deterministic system design, human controls, and reliable operating procedures. A model can explain its reasoning, and chain-of-thought transparency matters, but neither explanation nor transparency is a reliable authorization decision. We do not yet know how to make model outputs consistently faithful. Asking one model to check another can leave an opaque model inside an opaque orchestration layer, watched by another opaque model. That is still a chain of black boxes.
Nadella’s conclusion is direct: “the controls that govern what a model can access and what actions it can take must sit outside the model.”
The reason is architectural. A control inside an agent inherits the agent’s context, reasoning, and failure modes. The agent may misunderstand an instruction, receive manipulated context, or behave in an unexpected way. A rule that depends on the agent interpreting itself correctly cannot reliably constrain those outcomes. The governed system cannot be its own independent boundary.
What makes a control independent?
Nadella points to an information-security principle dating to the 1970s: “a program must not be able to bypass or tamper with the mechanisms that enforce its permissions.” Applied to agents, the consequence is practical. An agent must not be able to skip its control, reconfigure it, or route an action around it. If the agent can bypass a hook, the hook is a suggestion, not a control.
Independence is the operative word. If the platform supplying the model also defines what the model may do, the party being governed is setting its own limits. The enterprise needs authority to set those limits separately. As Nadella puts it: “Orgs should be able to independently determine what a model can access and what actions it can take.”
That separation has to include the model, the harness that orchestrates its work, and the action space that defines what the agent can do. Connection is not authorization. A tool connection tells you that an agent can reach a system. It does not establish that the agent is permitted to perform every operation that system exposes. Safeguards have to be externalized so an agent’s reasoning cannot silently expand its own authority.
What counts as independent evidence?
Nadella states the principle this way: “Validation must be independent of the intelligence being validated. No single model should control both a system’s behavior and the evidence required to determine whether that behavior is aligned with the original intent.”
That principle leads to a basic audit requirement: you must be able to reproduce how an outcome was achieved without relying on the model to attest to it. A model’s account of its own actions is not evidence. It describes what the model believes happened, not what the system recorded. It cannot be the artifact an auditor, regulator, or incident reviewer depends on.
Evidence must come from the layer that evaluated the action, independently of the agent that requested it. For each decision, the record should identify:
- The agent and the action it attempted.
- The policy applied and the decision returned.
- Any human approver and the time of the decision.
A narrative is not a record. A record gives reviewers a chain of custody: who acted, what was requested, which policy applied, what the system decided, and who approved the action. Without that independent record, an organization cannot reliably reconstruct a decision or assign responsibility after a failure.
How can you contain an agent you cannot enumerate?
Nadella writes: “We must assume a model is compromised and contain it from the start. Think of it like an emergency brake. An authorized person should always be able to pause or shut down a model mid-task.”
Containment requires revocability, and revocability requires enumeration. An enterprise cannot pause, revoke, or shut down what it cannot list. Before you can stop an agent, you need to know its complete action surface: every tool it can call, every operation those tools expose, and every system of record it can reach.
A stop button that does not know what it is stopping is a hope, not a control. The act of stopping something presupposes that the thing has been identified, its reach has been established, and its routes have been named. That is the whole argument for containment: the emergency brake only works on a system whose boundaries you already know.
Are agents a new kind of engineering problem?
No. They are a new class of non-human identity. Nadella’s insider-risk reframe does not assume that an agent is malicious. It recognizes that a capable actor with access to important systems can make mistakes or be compromised. Organizations have refined the response over decades: establish identity, limit privileges, log activity, and create containment boundaries.
The same established controls apply to agents, with attention to what makes an agent distinct. Give it an identity separate from the user it acts for. Scope permissions to specific operations, not just connected systems. Record activity as evidence rather than produce log noise. Set containment boundaries that hold even when the agent behaves badly.
A practical readiness check is straightforward:
- Identity: Can you distinguish the agent from the user, service account, and other agents?
- Scope: Can you name the specific operations the agent is authorized to perform?
- Evidence: Can you reconstruct each consequential decision from an independent record?
- Containment: Can an authorized person stop the agent and revoke its access?
This is established practice applied to a new actor, not new engineering. The gap is often not a lack of security principles. It is the absence of a control boundary that enforces them for agent actions.
Where does the control category belong?
The principles converge on one architectural test: controls must be independent, evidence must be independent, and containment must remain possible. The degree of independence separates a feature from a control.
A control supplied by the platform that supplies the model remains part of that platform’s service. Its authority moves when the platform changes. An enterprise-owned authorization layer does not depend on the agent to interpret its limits or on a model provider to define the organization’s policies.
The significance of Nadella’s argument is that this is not a vendor conclusion. When the chief executive of one of the largest technology companies in the world independently describes the same control point, the direction is being set by the problem rather than by any participant’s product strategy. The industry is arriving at this architecture because the architecture is what the principles require, not because an interested party proposed it. That is a useful confirmation for anyone who set out to build for it, and it raises the bar for everyone still relying on instructions inside a prompt. LangGuard is one of the parties that set out on this direction early: a deterministic runtime authorization layer, Arbiter, sits outside the agent, evaluates a proposed action before execution, and returns ALLOW, BLOCK, or ESCALATE. It belongs beside the execution service and the transaction service, as foundation-layer infrastructure owned by the enterprise rather than as another instruction inside the agent.
The NIST AI Risk Management Framework (AI RMF) provides a voluntary structure for managing AI risk. It does not certify a specific architecture. Its relevance here is operational: an organization still needs to define responsibility, identify the deployed system’s risks, evaluate the controls, and manage those risks throughout use. Independent authorization, evidence, and containment give those responsibilities a concrete point of enforcement.
The companion payments post works through the same issue using a treasury mandate. This post takes the argument to the question of who owns the controls.
Nadella’s closing idea, restated for agents, is a useful production test: the most trustworthy system is not necessarily the one whose model we trust most, but the one that lets us trust the model least. The agent we can stop, audit, and constrain is the one we can put into production. The argument for that layer does not depend on who supplies the model, and it does not require anyone to accept a vendor’s assurance about it.
Satya Nadella is CEO of Microsoft. This post discusses his public remarks and does not imply endorsement. None of the named third parties endorses LangGuard. Microsoft has no relationship with LangGuard, and LangGuard is not referenced, validated, or endorsed by Microsoft or by Satya Nadella.