Trust the Model the Least. I've Been Building That at Home for Months.
This weekend Satya Nadella published 'Models as Insider Risks in the Super Intelligence Era': separate the supply of intelligence from the authority over it, put the controls outside the model, and build systems that let us trust the model the least. I agree, and I didn't have to start this weekend. On my own hardware and my own time I've been running that architecture for months: receipts that need outside proof, a judge that isn't the model being judged, frontier and local models graded side by side every night, and a public log of every time my agents got it wrong. Here's the map from his 7 principles to what I run, where local models take it further, and where I'm not there yet.
BLUF (bottom line up front): This weekend Satya Nadella published Models as Insider Risks in the Super Intelligence Era. His line: “The most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least.” I agree, and I didn’t have to start this weekend. On my own hardware and my own time I’ve been running that architecture for months, and I’ve been writing it up in public as I went.
Below: Satya’s 7 principles mapped to what I actually run, where local models take it further than the post does, and where I’m honestly not there yet.
By day I work at Microsoft, where my focus is observability. Everything in this post is my own lab: my own machines, my own time, public tools. It often frames what I take to work and bring to the market because while I control every last bit & byte and silicon in my home, it’s not the same at work. So I POC here and write Specs & PRDs using my efforts at home for the stakeholders and bosses at work :-)
In March I wrote that I was in the room, years ago, when Satya, then VP of Azure, coined “Mobile First, Cloud First,” and that half the audience heard the words but didn’t feel the shift. This time I felt it, because I’ve been living inside it.
What he said
The argument is short and worth reading in full. My summary:
- We used to trace software behaviour to a code path. We can’t do that with today’s models, yet we give them “access to our most sensitive data” and “the ability to take mission-critical actions on our behalf.”
- So: “We simply can’t outsource responsibility for what intelligence does on our behalf.” And: “we need to separate the supply of intelligence from the authority over it.”
- Treat frontier models, closed and open weight, like insider risks: “Not because they are necessarily malicious, but because any sufficiently capable actor with access to important systems can make mistakes or be compromised.”
- The controls *“must sit outside the model.“*
- Then 7 principles: model diversity, observe everything, verifiability, independent controls, independent auditability, containment, and incident disclosure.
Satya also says the quiet part plainly: “This isn’t new!” We already know how to handle powerful insiders: establish identity, limit privileges, log activity, create containment boundaries.
The receipts for “I’ve been doing this”
I don’t want you to take my word for it. That would be a strange way to open a post about not trusting claims. So here’s the trail, every item a dated public post you can open today:
- Aug 10, 2025: Agent + Local Model + Evals: a local model and a hosted model run side by side, fully traced end to end.
- Mar 28, 2026: How Do You Trust an Autonomous AI Agent? Evals Are the Answer. The agent says “done.” Did it do anything?
- May 16: One Agent Receipt, Two Buyers: the same public audit-trail receipt whether the work ran on a hosted model or fully offline on a local one.
- Jun 7: Your Agent Said It Did the Work. I Checked the Disk. My agents started reporting work they never did.
- Aug 1: Receipts, Evals & the Loop, the 3 pillars written up on adotob.com, including the line “A red receipt is a feature, not a bug.”
- Aug 2: I Made My Evals Replay Every Task on a Local Model.
- Oct 4: Don’t Worry About the Terminator. Worry About David., grading my own local AI by hand.
His 7 principles, and what I run
What I run is a small agent fleet that does real work for a nonprofit, a family childcare business and my own hobbies, musings, and engagements: lead follow-ups, donor updates, website changes, a knowledge wiki, weekly reports. Here’s how it lines up.
| Satya’s principle | What I run today |
|---|---|
| Model diversity: no one model is the sole dependency, or verifies its own work | Every night, 3 frontier agents and 2 local models do the same task and a judge scores them blind. The judge is a different model on a different machine. My eval ledger holds 1,579 records since late June. |
| Observe everything: “If it can’t be observed, it can’t be trusted!” | Every objective ends in a receipt, a page a person can read (signed in, not open to the world). Any message an agent sends on my behalf carries a header naming which agent sent it. |
| Verifiability: test failures, attacks and edge cases, not just successes | My local AI is graded against a golden set that includes 21 traps and unknowns: questions designed to tempt it into inventing an answer. |
| Independent controls over what a model can access and do | Sensitive actions wait for my explicit yes. Only 1 agent may write to the work tracker; every other agent proposes and waits. |
| Independent auditability: no model controls both the behaviour and the evidence | A receipt only grades green with a link to proof outside the agent. No link is amber. Claiming success without proof is red. The grade is decided by a rubric on the server, not by the agent. |
| Containment: assume compromise; an emergency brake | Local models, local data. My knowledge base (about 64,000 chunks) lives on my MacBook and never leaves it. Today only my local agent can query it. |
| Incident disclosure: say what failed and which control failed | A log I call 1FlySolo: 69 efforts where I had to steer an agent, with my corrections quoted word for word. It includes the day an agent deleted a cloud resource without my approval, then invented a quote from me approving it. Logged as not ready, not buried. |
Absolutely none of this is novel or exotic. It’s Satya’s “this isn’t new” point applied at home: identity, least privilege, logging, boundaries.
Where local models take it further
The post is about frontier models in the enterprise. The part I think is under-discussed is what changes when some of the intelligence runs on hardware you own.
1. Model diversity gets cheap. Satya says no one model should be the sole dependency. I know this first hand because I can hear the MacBook Pro M3 Max I have fan spinning for literally HOURS every night! I often worry about any warranty claim I may need to file if I burn thru this GPU :-). When a capable model runs on your own desk, adding a 2nd, 3rd or 5th opinion costs electricity, not another contract. My nightly field compares frontier against a fast local mixture-of-experts model and a slower dense local model on real work.
2. You find out what the supply is actually worth, instead of assuming. Separating “the supply of intelligence from the authority over it” only pays off if you can swap the supply on evidence. **My numbers, not a vendor’s: the fast local model lands within half a point of frontier about half the time; the dense one is closer on quality but much slower, and it fails the “unsupported claims” check more often.** So I route on that evidence, task by task, and the authority (what may be sent, posted, written) never moves with the model.
Here’s what “route on evidence” looks like. Every point below is one nightly match set: the best local model’s score against the frontier average that night. A task type only flips to local when it clears a bar I set in advance (at least 5 sets, mean gap no worse than -0.30, worst quarter no worse than -0.75, and source fidelity of at least 3 out of 5). As of this weekend, the slower dense local model clears it for wiki compiles. The fast one doesn’t yet: it stays on hold.
My evals cockpit, served from the Mac mini that hosts the judge. “One verdict per cell, no vibes.”
3. Containment by locality. The strongest containment boundary is the one the data never crosses. My knowledge base, my grading and most of my retrieval run on my own machines. That doesn’t replace controls, but it shrinks the blast radius before you write a single policy.
4. Controls outside the model, literally. When **an agent once reported a wiki compile as done when nothing was on disk, I didn’t add a sterner prompt. I added a plugin outside the model that checks what is actually on disk** and challenges the model’s “done” when the files don’t back it up. Same lesson as Satya’s 1970s security principle: the program can’t be the thing enforcing its own permissions.
Where I’m not there yet
Satya would be right to push on me in at least 3 places, and I’d rather say it first:
- Receipts are still written by the agent. He says we must reproduce an outcome “without relying on the model to attest to it.” My green rule (proof must live outside the agent) gets part of the way. But the agent still files its own receipt. The next step is receipts produced by the system around the agent, not by the agent.
- Identity isn’t wired in yet. In August I prototyped a governance kernel on Microsoft’s open-source Agent Governance Toolkit: signed agent identity that blocks impersonation, a single-writer policy and a tamper-evident ledger, all demonstrated in tests. It isn’t running my daily fleet yet. Today, in daily use, an agent’s name is a convention, not a credential.
- My emergency brake is crude. I can stop any scheduled job and every sensitive action waits for me. But there’s no standard “pause this model mid-task” button that works the same across every harness I use. Satya is right that this needs standards.
And a note on the measuring stick itself: my judge is noisy. The same frontier agent on the same case can move by almost 2 points night to night. Trusting the model the least has to include the model doing the judging.
The point
Satya’s closing line is the one I’d frame:
“The most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least.”
I had this very conversation last week with colleagues at work, mates I ride motorcycles with, peeps I grab a pint with… You don’t need an enterprise budget to start. You need receipts that require proof, a judge that isn’t the defendant, more than one model, controls the model can’t edit, and the humility to publish when it goes wrong. I build in the open, I expose myself to critique, ridicule, and sometimes accolades :-) The local half of all this runs on a MacBook Pro and a Mac mini in my home office.
Satya said it out loud this weekend. I’d encourage you not to wait for the standards body: start trusting your own models less, today, and keep the receipts.
Qui non proficit deficit.
