Satya Nadella’s October 10 essay gets at something I care about as I keep putting AI to work: being able to do a job shouldn’t mean an agent gets to decide what it’s allowed to do.
I want these tools to do more. If an agent can work through a problem, prepare a useful answer and save someone hours, give it room to work. But deciding to send a message, release a payment or publish a change is a different responsibility from preparing it.
Nadella argues that the controls over an agent’s access and actions need to sit outside the model. He also wants records of its actions that it can’t tamper with, and a way for an authorized person to stop it while it’s working. That makes sense to me. A mistake should be something we can trace and fix, without relying entirely on the agent’s explanation of what happened.
Here’s a simple example. An agent could read an invoice, compare it with an order and prepare a payment for review. That doesn’t require giving it permission to release the money. The payment system can enforce that boundary even if the agent concludes that paying now would finish the job faster.
Microsoft’s security guidance recommends limiting access to what the task needs and requiring human approval for high-risk or irreversible actions. That’s more useful than a general instruction to be careful. The person setting up the workflow has to decide where those limits belong.
I wouldn’t want to approve every small step. Researching a question or preparing a draft should have room to move. The decisions that commit us to something deserve a different level of review. And if another AI checks the work, I’d still want a record from the system where the action actually happened. Two models agreeing isn’t the same as confirming that a payment went to the right place.
This is why the distinction interests me. Clear permissions let us hand over a useful part of the job without handing over every decision connected to it. I’d be much more comfortable giving an agent a bigger role when I know what it can change, who can stop it and how we’ll check its work.