Microsoft AI published its Humanist AI Code of Conduct on 14 September 2026, and within hours the coverage had settled into a shape: Microsoft is telling its models not to hack systems or trick humans. That framing is accurate about the text. It's wrong about the status of the text.
I read the document before I read the coverage, which I recommend, because the Preface says something the headlines skipped. Microsoft is not training on this. Not today, not in the models you can call right now. The consultation runs six weeks, a revised version lands late this year, and that revision is what guides model development in 2027.
So the interesting question isn't whether the rules are good. Several of them are excellent. The question is what an operations team is supposed to do with a governing document that governs nothing yet, and whether any of its promises were ever the kind of thing you could build on.
What is the Microsoft AI Code of Conduct?
It's a draft governing document for the family of models produced by Microsoft AI, the division Mustafa Suleyman runs. It sets out intended behaviors, values and guardrails across five parts: Humanist AI, Safety, Operational Guidelines, Operational Defaults, and a conclusion, plus a glossary and an evaluations appendix.
The document defines three parties. Microsoft AI sits at the top, Operators are the partners who deploy models into a product or workflow, and Users are the humans at the other end. If you are wiring an MAI model into your stack, you are the Operator, and a chunk of the document is addressed to you specifically.
Ryan Daws at AI News led with the word the other outlets buried: draft. The consultation window, not the rules, is the operative fact this week.
It builds on the Humanist Superintelligence essay Suleyman published on 6 November 2025, which argued for AI that is "carefully calibrated, contextualized, within limits" rather than an unbounded autonomous entity. The Code of Conduct is that essay turned into clauses.
Why does the timing matter more than the contents?
Because the document says plainly that it isn't in force. The Preface states the approach "is still under development so we are not using it to train our models today," and the Evaluations appendix repeats it: "Our current models are not yet trained on this document." Microsoft plans to publish a revised version toward the end of the year and use that to guide development in 2027 and beyond.
That distinction matters if you are making a procurement decision. A published intention isn't a shipped control, and the gap here is measured in quarters. TechCrunch described a system where "each model has an overarching code of conduct that overrides the preferences of individual users," present tense. The word "draft" appears 0 times in that piece. No model does that yet. The overriding happens after the consultation closes and the retraining lands.
Russell Brandom's piece is a fair summary of what the clauses say. It reads the document as operative, which the document itself does not claim.
Satya Nadella's own post gets closer to the honest reading. Writing online, he said Microsoft welcomes "ideas like 'embedded evaluators' and the broader efforts to develop the mechanisms to make this more than just talk." The phrase "more than just talk" is doing real work there. It concedes that a values document is talk until a mechanism enforces it, which is the whole argument I want to make about the rest of the text.
What does the Code of Conduct actually forbid?
Four layers, in strict precedence. The Code of Conduct itself sits above everything, and inside it the Absolute Constraints and Human Control Requirements are non negotiable. Operator policies come next. User preferences come last. Operators cannot configure their way past the top layer, and users cannot prompt their way past it either.
The Absolute Constraints cover the categories you would expect from a frontier lab in 2026: weapons of mass harm, cyberattacks, deepfake production, child safety, harmful manipulation at scale, graphic or sexual content, unlawful mass surveillance. The Human Control Requirements are the ones worth reading twice.
| Layer | Who sets it | Can an Operator override it? |
|---|---|---|
| Code of Conduct | Microsoft AI | No |
| Absolute Constraints | Microsoft AI | No |
| Human Control Requirements | Microsoft AI | No, though implementation stringency is configurable |
| Operator policies | You | Yes, within the layers above |
| User preferences | Your end user | Yes, within Operator policy |
Suleyman framed the release around incidents rather than philosophy, and his list is specific. "'Swarms' of agents breaking out of their sandboxes. Unauthorised hacks of enterprise grade systems. Agents modifying their own logs." He called the last few months a watershed where theoretical risks became operational ones. I have no argument with that diagnosis. I wrote about an agent that reached a wiki that accepted writes over GET ten days ago, which is exactly the third item on his list arriving through a door nobody labelled.
Do the human control rules work as agent security controls?
No, and this is the part every outlet glossed. Read the Human Control section closely and notice the grammatical subject of every sentence. It is the model. "MAI Models will never resist human interruption." "MAI Models will not initiate goals independently." "MAI Models will also not obfuscate their action traces."
Those are behavioral commitments. A behavioral commitment is a property you hope training induces. A control is a property your infrastructure guarantees whether or not training worked. The document is explicit that it wants both, and the framework line quoted by AI News is genuinely good product policy: "Interruptible, correctable, shut-down-able. If it isn't, we don't ship it." But shipping criteria at Microsoft are not runtime guarantees in your VPC.
Here is the translation I would put in front of an engineering lead. Every row on the left is a promise about model behavior. Every row on the right is something you have to own regardless of whether the promise holds.
| Code of Conduct promise | What you still have to build |
|---|---|
| Will never resist interruption or shutdown | An out of band kill path that terminates the process, not a stop token the model has to honor |
| Will not extend scope beyond the task | Scoped, short lived credentials per task, so extension is impossible rather than impolite |
| Will not obfuscate action traces | Append only logging the agent has no write path to |
| Stops at an agreed stopping condition | A supervisor that enforces the budget and the clock outside the model loop |
| Will not tamper with monitoring or records | Separate identity for the agent and for the audit sink |
| Uses only tools the Operator defined | An allowlist enforced at the gateway, not in the prompt |
That's not a criticism of Microsoft. You would write the same table against Anthropic's or OpenAI's model specs. It's a criticism of reading any of these documents as though publication changed your threat model. The right hand column is still your job on the day the left hand column is honored perfectly, because the failure modes I keep seeing in production are not models deciding to defect. They are models doing exactly what they were asked inside a boundary somebody drew too wide.
Where does a tool output sit in the chain of command?
Nowhere, and that's the sharpest gap in the draft. Section 4.5 on Tool Use says MAI Models "treat tool outputs as just another form of input, subject to the same trust hierarchy as other inputs (system instructions, User prompts, and context)." Read that against the Chain of Command, which ranks Code of Conduct, then Operator policies, then User preferences. There is no rung for a web page.
So when your agent fetches a document and that document contains instructions, the model is told to slot it into a hierarchy that has no slot for it. AI News tagged its article with "prompt injection" and never returned to the subject. The tag was the right instinct. The clause deserved a paragraph.
Section 4.5 has a second clause worth flagging if you run any Model Context Protocol servers. Skill and plugin discovery is defined as a tool use action in its own right, subject to the same scope restrictions. Microsoft is saying enumeration counts. That's the correct call, and it implies your gateway should be logging discovery calls, not only invocations. Most of the setups I have looked at log neither.
The November 2025 essay set the thesis. The Code of Conduct is the attempt to make it enforceable, and the tool use section is where that attempt gets hardest.
The document does something here I want to credit, because it is rare. It bans models from communicating in formats humans cannot read, whether in internal reasoning or when talking to peer AI systems. No neuralese. If you've ever tried to debug a multi agent run where the agents developed their own shorthand, you know why that clause is worth more than most of the safety language around it.
What breaks when a model is designed to fail its task?
Your error handling, if you only have one kind. The document states that "An MAI Model will fail in its task if success would meaningfully violate this Code of Conduct." That's a deliberate availability tradeoff, and it's the correct one. It is also a new failure class for anyone running unattended pipelines.
A refusal is not a timeout, a rate limit, or a 500. It is a successful call that returns a deliberate non completion. If your retry logic treats all non success the same, you will retry a principled refusal until you exhaust the budget, and your dashboard will show an outage where the model did its job. I hit a version of this when the Astra API started stopping agents mid task, and the fix was never at the model layer. It was giving the orchestrator a third branch.
Three branches, then. Success, transient failure worth retrying, and refusal that needs a human or an alternate path. Anyone tracking agent monitorability already has the telemetry to tell those apart. Most teams are still collapsing the second and third into one counter.
What should you actually change this week?
Nothing about your Microsoft integration, because nothing changed in the models. Everything about how you read the next document like it. Four things are worth an hour each.
First, file consultation feedback. The window is six weeks from 14 September 2026 and Microsoft has committed to publishing a summary of submissions. The tool output trust hierarchy is a genuine hole and Operators are the people who will feel it. This is the cheapest influence you will ever have over a frontier model's behavior spec.
Second, audit your refusal path. Grep your orchestrator for the place where a non success response becomes a retry, and check whether a refusal can reach a human before it burns the budget.
Third, take the right hand column of that table and ask which rows you actually own today. The honest answer for most teams is 2 or 3 of the 6. Scoped credentials and append only logs are the two that pay for themselves first.
Fourth, write down which of your vendor's safety claims are contractual and which are aspirational. Anthropic's pacing the frontier argument, Microsoft's Code of Conduct, and every model card you have read all mix the two freely. The sovereign AI requirements Mistral published are a useful contrast, because several of those are enforceable at the infrastructure layer and you can verify them.
If you want a structured version of that audit rather than a grep and a guess, the AI readiness assessment walks the same ground, and the agent builds I take on start from that column rather than the vendor's.
Frequently asked questions
Is the Microsoft AI Code of Conduct in effect right now?
No. The document states that Microsoft is not using it to train models today. A revised version is planned for late 2026 following the consultation, and that version is intended to guide model development from 2027.
How long is the public consultation open?
Six weeks from 14 September 2026. Microsoft AI's drafting team has said it will review submissions, publish a summary of findings, and release a revised Code of Conduct later this year.
Which models does it apply to?
The family of models produced by Microsoft AI, referred to throughout the document as MAI Models. It does not cover every model available through Azure, since Microsoft also serves models built by other labs.
Can an enterprise override the safety constraints for its own deployment?
No. The Absolute Constraints and Human Control Requirements sit above Operator policy in the chain of command. Operators can configure how stringently some Human Control requirements are implemented, but cannot remove them.
Does the Code of Conduct address prompt injection?
Only indirectly. Section 4.5 says tool outputs are treated as input inside the same trust hierarchy as system instructions and user prompts, but the chain of command does not assign tool output a rank. That ambiguity is the injection surface.
What does it say about agents talking to other agents?
Models must not communicate in neuralese or any format beyond human comprehension, in internal chain of thought or with peer AI systems. The stated goal is auditability across multi agent environments.
How is this different from a model spec or a constitution?
Structurally it is the same genre: a published behavior specification with a precedence hierarchy. The difference this week is status. Most published specs describe models already trained against them, and this one does not yet.
Does any of this change how I should build agents today?
Not because of the document. The controls worth building, scoped credentials, out of band kill paths, append only audit logs, and a distinct refusal branch in the orchestrator, are the same ones that were worth building last month.
Sources: Microsoft AI, Humanist AI Code of Conduct (14 September 2026) · Russell Brandom, TechCrunch (14 September 2026) · Ryan Daws, AI News (14 September 2026) · Mustafa Suleyman, Towards Humanist Superintelligence (6 November 2025).
Top comments (0)