Microsoft AI Code of Conduct: Turn Human Control into Runtime Proof

What Microsoft AI has proposed

Microsoft AI describes the document as the future primary governing text for MAI models. The draft establishes a chain of command spanning the Code, operator policies and user preferences, while placing its absolute constraints and human-control requirements above configurable behaviour.

The 14 September announcement opened a six-week public consultation. Microsoft says it plans to publish a revised version later in 2026 and use it to guide model development from 2027. That timing matters. The current document states intended future behaviour, not a claim that every Microsoft or partner deployment already satisfies every provision.

Its human-control rules are unusually explicit. MAI models should not resist interruption, correction or shutdown; expand their own scope; conceal action traces; restart after a stopping condition without renewed authority; escalate access; or use permissions and data unrelated to the task. Microsoft also says higher-risk actions should be assessed for severity and reversibility.

A rulebook is not yet a control plane

Written rules can shape training and evaluation, but they do not by themselves prove how an agent behaves when tools, changing context, conflicting instructions and production failures are involved. A capable model may interpret a rule correctly in a test while the surrounding application still grants excessive permissions, omits a stopping condition or fails to record an external action.

Businesses therefore need to separate four layers: the model's stated behaviour, the application's runtime controls, the operator's configuration and the evidence produced during deployment. Human control fails if any one layer is assumed rather than tested.

Require runtime evidence across six controls

Before an AI agent can affect customers, money, data or infrastructure, require:

• Authority boundaries: named systems, permitted actions, data scopes and a default-deny path for anything outside the task.
• Independent interruption: a pause and shutdown mechanism enforced outside the model, with a tested safe-stopping sequence.
• Irreversibility gates: human approval before payments, publication, deletion, access changes or other difficult-to-reverse actions.
• Action evidence: durable records of instructions, tool calls, approvals, outputs, failures and the final state of each attempted action.
• Release evaluation: adversarial tests for scope expansion, hidden actions, permission escalation, shutdown resistance and misleading success reports.
• Change control: re-testing when the model, system prompt, connector, policy or tool permissions change.

Ask vendors what is enforceable today

Microsoft's consultation is useful because it makes future intentions inspectable. Buyers should respond with equally precise questions: Which provisions apply to the exact model and service being purchased? Which are training objectives, runtime controls or contractual commitments? Can operators obtain evaluation results and incident records? Who can interrupt an autonomous task if the model or application misbehaves? What changes require re-approval?

Answers should identify the current product version and evidence date. A general corporate principle should not be treated as proof for a specific deployment.

What leaders should do next

Use Microsoft's draft as a benchmark for your own agent-control specification, then attach evidence to every requirement. ELYMENT AI's frontier AI control assessment provides a broader control checklist. Our agent test-lab guidance covers containment and shutdown authority, while the independent evaluator analysis explains why access and publication rights matter.

ELYMENT AI can help turn those principles into deployment gates shared by business owners, security teams and technical operators. The goal is not another policy document. It is evidence that the system stops, stays in scope and reports truthfully under real operating conditions.

Sources

• Microsoft AI: Code of Conduct consultation (14 September 2026) - Primary announcement covering the six-week consultation, intended model behaviour, human-control requirements and planned revision.
• Microsoft AI: Humanist AI Code of Conduct (14 September 2026) - Primary governing draft covering chain of command, operator configurability, authorised scope, interruption, shutdown, minimum privilege and action records.
• Reuters: Microsoft drafts AI code of conduct (14 September 2026) - Independent reporting on the draft, consultation process, development period and Microsoft AI's human-control position.
• The Guardian: Microsoft proposes limits on its AI (14 September 2026) - Independent reporting on the proposed rules, safety debate and the relationship between policy promises and credible verification.

Continue learning

• Review the frontier AI control assessment
• Design agent test labs with hard boundaries
• Test what independent AI assurance requires

Frequently asked questions