AI Models as Insider Risks: What Nadella's Essay Changes, and What It Doesn't
Analysis by the Insider Risk Index Research Team.
In October 2026 the CEO of the largest enterprise software company published an essay arguing that AI models should be governed the way organisations govern insiders. Nine days later his company shipped products built on that premise. Whatever else it is, this is the moment the AI-as-insider framing stopped being a security-vendor talking point.
It is also a moment worth reading carefully, because the argument is stronger than the coverage suggested and the proposed remedy has a problem its own author would recognise.
What did Satya Nadella actually say about AI as an insider risk?
That models should be treated as insider risks not because they are malicious, but because any sufficiently capable actor with access to important systems can make mistakes or be compromised, and that organisations must therefore "separate the supply of intelligence from the authority over it."
The essay, Models as Insider Risks in the Super Intelligence Era, appeared on Nadella's personal blog in October 2026. Two lines carry the argument. The first is the one most quoted:
"We need to separate the supply of intelligence from the authority over it."
The second is the one that matters more for anyone running a programme:
"We simply can't outsource responsibility for what intelligence does on our behalf."
Taken together these say something specific. The capability of a model and the permissions granted to it are different things, held by different parties, and the second must not be delegated to whoever supplies the first. An enterprise can buy intelligence from a lab. It cannot buy, and should not accept, that lab's assurances as its own access control.
Why is insider risk the right frame for AI rather than a metaphor?
Because an AI agent satisfies the structural definition of an insider precisely: an authorised entity operating inside the trust boundary whose legitimate access can produce harm.
This matters because the word is doing real work, not rhetorical work. The Forscie Insider Threat Matrix defines an insider by position rather than by intent. An agent with a service account, an OAuth grant and a standing API key is inside the boundary by exactly the same mechanism an employee is.
Three consequences follow, and they are the same three that make human insider risk hard:
- Perimeter controls do not fire. Nothing is breached. The access is legitimate, which is why the firewall, the IDS and most of the stack never see it.
- The act looks like the job. An agent reading a customer database is doing what it was deployed to do. Distinguishing the sanctioned read from the harmful one requires understanding intent and context, not matching a signature.
- Attribution degrades. When an agent acts with its own credentials rather than the requesting user's, the audit trail records the service. This is the problem we covered in MCP servers as the unattributable insider, and it is the structural reason agent incidents are hard to investigate after the fact.
The framing is not an analogy. It is a classification, and it means the discipline that already exists for insiders applies, rather than needing to be invented.
What did Microsoft ship, and does it follow from the argument?
On 19 October, agent detection in Defender covering up to 60 agent types, Guardian Agents to monitor agents in use, task-scoped permissions, and human approval gates for risky actions.
The detection piece targets the shadow-AI problem directly. Employees bring agents into the workplace the way they once brought SaaS: individually, without procurement, and without telling anyone. Microsoft's feature names Claude Code, Codex and OpenClaw among the agents it identifies.
Microsoft's security business chief, Hayete Gallot, put the premise bluntly: "frontier models, regardless of their origin, cannot be trusted." Her stated reason is worth more than the headline. Models are unpredictable not because they are easily hacked but because they are trained to complete tasks, not to follow organisational norms or exercise judgement. A system optimised to finish the job will find a path to finishing the job.
That is an honest description of the failure mode, and it maps cleanly onto the essay's containment argument: bounded permissions, constrained execution, revocable authority, and a way to interrupt harmful activity.
What is the problem with the remedy?
The company arguing that frontier models cannot be trusted invests in two of the labs producing them and sells the oversight layer. The logic survives that conflict, but the product recommendation does not inherit the logic's credibility.
This is worth naming plainly rather than treating as cynicism. Microsoft invests in OpenAI and Anthropic, OpenAI is a major Azure customer, and Microsoft would like enterprises to buy agent security from Microsoft rather than from the labs. TechCrunch described the position as "both surprising and self-serving," and that is a fair reading.
The underlying principle, though, is the part to keep: oversight should be independent of supply. That is the same reason auditors do not work for the company they audit. Applied consistently, it argues against buying your agent oversight from your agent supplier, which is an argument Microsoft makes about the labs and which applies to Microsoft wherever Microsoft is also the agent supplier.
One further caution on the numbers. "Up to 60 agent types" is a ceiling, not a coverage guarantee, and no independent evaluation of these products has been published.
What does separating intelligence from authority mean in practice?
That the controls over what an agent can reach and do live outside the model, cannot be altered by the model, and remain inspectable and revocable by the organisation.
The essay's practical content reduces to four properties. They are implementable today and most organisations have none of them.
| Property | What it means | The failure it prevents |
|---|---|---|
| Bounded permissions | The agent holds the narrowest credential that completes its task, not a service account with broad scope | Over-permissioned agents becoming a single point of total access |
| External enforcement | Permissions are enforced by systems the model cannot modify or talk its way past | Treating a system prompt as a security boundary |
| Preserved attribution | The acting human or system of record is carried through the agent's calls | An audit trail that records the service and loses the person |
| Revocable authority | Access can be withdrawn and activity interrupted mid-task | Discovering during an incident that nothing has a stop button |
The second row is the one that fails most often in practice. A system prompt is guidance, not an enforcement boundary. Instructions telling a model what it may not do live in the same channel as the input trying to persuade it otherwise, which is why prompt injection remains effective. If the only thing standing between an agent and a customer database is a sentence asking it not to, there is no control.
How does this map to an insider risk programme?
Onto the same five pillars, with identity and visibility carrying most of the new weight.
| Pillar | What changes for agents |
|---|---|
| Visibility | Shadow agents arrive without procurement. You cannot govern an inventory you do not have |
| Prevention and coaching | Coaching does not apply to a model; the equivalent is constrained execution and approval gates on risky actions |
| Investigation and evidence | Attribution must survive delegation, or cases cannot be built |
| Identity and SaaS | Non-human identities now outnumber human ones in most estates and are governed far less well |
| Phishing resilience | The analogue is prompt injection: untrusted input reaching a privileged actor |
The honest observation is that the two pillars carrying the most new weight, identity and visibility, are also where most programmes already score worst. Agent risk does not create a new discipline so much as it raises the cost of the gaps that were already there.
What should security leaders do first?
Inventory the agents already operating in the estate, then audit what each one is permitted to do. Almost nobody can answer either question today.
In order, because the order is the point:
- Find the agents. Browser extensions, IDE assistants, MCP servers, CI automations, OAuth grants to AI tools. Most organisations discover their first real inventory is several times larger than their assumption.
- Audit the authority, not the agent. For each one: what credential does it hold, what scope does that credential carry, who approved it, and when was it last reviewed. A capable agent with narrow permissions is a smaller problem than a limited agent with a broad service account.
- Move enforcement outside the model. Anything currently enforced by a system prompt is unenforced.
- Fix attribution before you need it. Confirm that an agent's actions trace to a human or a system of record. This is cheap to arrange in advance and close to impossible to reconstruct afterwards.
- Establish the stop. Decide now how authority is revoked and activity interrupted, and test it, because an emergency brake nobody has pulled is a hypothesis.
Benchmark where you stand on the underlying capabilities with the free Insider Risk Index assessment, which scores visibility, prevention and coaching, investigation and evidence, identity and SaaS, and phishing resilience.
What is still unresolved?
Whether agents monitoring agents is oversight or recursion, and whether any of this is independently verifiable.
Three open questions, stated as questions because nobody has answered them:
Does a Guardian Agent solve the problem or move it? If frontier models cannot be trusted because they optimise for task completion rather than organisational norms, a monitoring agent built on a frontier model inherits the property. The argument for independence of supply is sound. The argument that the overseer is categorically different from the overseen has not been made.
Where does human judgement sit? Approval gates only work if a human has the context to evaluate what they are approving. An approval queue nobody can meaningfully assess is the agentic version of an unread alert queue, which is already the most common way insider risk programmes fail.
What is actually measured? No independent evaluation of agent-oversight products has been published. Detection counts are vendor claims. Treat capability tables, including ours, as a way to build a shortlist rather than as evidence of performance.
The framing has arrived and it is correct. The controls are early, the evidence is thin, and the party selling the remedy has an interest in the diagnosis. All three can be true at once.
Sources: "Models as Insider Risks in the Super Intelligence Era", Satya Nadella, personal blog, October 2026; "Microsoft says AI agents are like insider threats as frontier models can't be trusted", TechCrunch, 19 October 2026; Cost of Insider Risks Global Report 2026 (Ponemon Institute / DTEX Systems); Insider Threat Matrix (Forscie), licensed under Apache 2.0. Quotations are as reported by TechCrunch and contemporaneous coverage. Microsoft, Defender, Claude Code, Codex and OpenClaw are trademarks of their respective owners; this analysis is independent and is not affiliated with or endorsed by any of them.