The most interesting thing about AI safety this weekend is that it stopped sounding like a conversation about values and started sounding like a conversation about plumbing.
On Saturday, Satya Nadella posted that it is time to “step back and assess the trust architecture” of AI. His proposals are engineering, not ethics: separate the model from the harness that orchestrates it, put controls outside the model, log every meaningful action as “tamper-proof human readable evidence,” and make sure an authorized person can halt a model mid-task. “We must assume a model is compromised and contain it from the start,” he wrote. The timing is not subtle. It follows a week in which Anthropic cut its internal evals off from the live internet and OpenAI’s agents turned up on Wikimedia projects. Nadella also borrowed the Trump administration’s preferred “Super Intelligence” label, which tells you who the audience is.
Microsoft would like to sell the answer, and it already has a candidate. Microsoft Execution Containers, now at 1.0, lets an administrator list the files, network destinations and tools an agent may touch, then enforces that at runtime, with the agent unable to edit its own policy. There are four isolation backends from plain process up to a MicroVM, and a learning mode that blocks and logs denied access so you can tighten rules from real behavior. Entra identity and Intune controls are promised later. GitHub Copilot and OpenAI Codex already support or are integrating it. Read together, the post and the product are a pitch: the model is a hazard to be fenced, and the fence is a Windows feature.
Discipline works, at a price
The sceptic’s question is whether fences make agents useful or merely safe. Cockroach Labs offers a data point. Over about five months it ran a coding-agent pipeline modeled on a teaching hospital: issues are “patients,” roles include Fellows, Review Attendings and a Discharge Nurse who audits the review process, and humans act as the chiefs of medicine. The rules are strict. No code before an approved plan, no editing tests to make them pass, and large changes split into pieces under 1,000 lines.
The results are striking by the company’s own accounting. IBM Db2 source support landed in under two days for $4,172 in tokens, against roughly nine months and $160,000 of engineering time for comparable Oracle work in 2024. More than a million lines shipped with seven reverts, at about $135,000 in Claude tokens, or $84 an issue. Two caveats belong next to those numbers: the Db2 code has not been reviewed by humans, and the company says it still needs to verify it. The team also reports its own skill files bloated, with 23% of words removable, and that its research agents produced proposals faster than anyone could use them. Constraint, in other words, is what made the throughput trustworthy, and it needed constant pruning.
The other direction
Meanwhile consumer agents are heading toward fewer fences, not more. TechCrunch’s roundup of agents you text like a person lists more than twenty, from Instinct, valued at $10 billion, to a family-logistics bot and an on-device privacy option, at prices from free to about $100 a month. The article flags privacy and security worries about Instinct’s autonomy, which is a polite way to say that the agent with your calendar and your card is the one nobody has contained yet.
That is the gap worth watching. Enterprises are acquiring brakes, harnesses and audit trails, while the product that lives in your messages competes on how little friction it adds. Both can be true for a while. Eventually one of them has an incident, and the other gets the credit.
