9For decades, when software misbehaved, we could trace the failure to a code path. Somewhere, in a known file, a documented line did a predictable thing to predictable data. That linkage — behavior to cause — is what made the old systems governable.
That linkage is gone with modern AI. A model’s behavior cannot be attributed to specific training inputs or to specific weights. And yet we are now handing these systems access to our most sensitive data and letting them take actions on our behalf. The ordinary, competent professional who pastes firm material into a public model is trusting a system we cannot trace, with data whose path we cannot follow.
The most senior voice in the industry put it plainly this week:
“We simply can’t outsource responsibility for what intelligence does on our behalf. A model provider’s assurances do not relieve us of that responsibility.”
Satya Nadella, in a post on X, October 2026
It is the sentence every firm should sit with. We cannot outsource responsibility for what an AI does on our behalf. A vendor’s assurance does not relieve us of that obligation. If the system misbehaves with client data, the firm answers — not the model, and not “the platform.”
His argument goes further, to the architecture of trust itself: “we need to separate the supply of intelligence from the authority over it.” Not treating these systems as nested black boxes to accept or reject, but building “contained systems whose behavior we can observe, limits we can test, and actions we can always contain.”
This is the position 9 Tails has taken from the start — and the reason the firm treats a capable AI the way a well-run firm treats an insider: someone with real access who could be mistaken, or compromised, or used against you. Not because it is malicious. Because a sufficiently capable actor with access to important systems can make errors, and the architecture must contain that possibility from the start.
The governing principles are not exotic. They are the same ones firms have used for decades to handle powerful people and systems:
- Limit privileges. No one — human or model — should hold more access than the task requires.
- Log activity. Every meaningful action should leave tamper-proof, human-readable evidence. If it cannot be observed, it cannot be trusted.
- Create containment boundaries. A system must not be able to bypass or tamper with the controls that enforce its own permissions.
- Keep controls outside the system. Rules about what a model can access and do must live outside the model itself — never left to the system to enforce on itself.
- Keep audit independent. The party validating behavior must not be the same intelligence whose behavior is being validated.
- Assume compromise. Build in an emergency brake. Someone authorized should always be able to pause or stop the system mid-task.
The practical meaning for a law firm, an accounting practice, a government contractor, or an insurer is more mundane — and more urgent — than the headlines suggest. It is that you are the last line of defense. Your client’s privilege, your taxpayers’ return data, your firm’s contractual secrets do not stop being yours because you pushed them through a capable system. The responsibility transfers nowhere.
“The most trustworthy [AI] system will not be the one with the model we trust most,” Nadella concluded. “It will be the one that enables us to trust the model the least.” That is the difference between using intelligence and being governed by it — and it is exactly where a firm should be headed.
Five minutes. Twenty-eight checkpoints. See exactly where your firm stands.