Microsoft's Humanist AI Code Turns Human Control Into a Model-Level Contract

Microsoft's September 14, 2026 Humanist AI Code of Conduct proposes that future MAI models should remain subordinate to human control, even when that means failing a task. The draft says models should accept interruption, correction, and shutdown; stay within authorized scope; avoid expanding their own goals; and obey non-negotiable safety constraints that neither operators nor users can override. It is a proposal, not evidence that today's Microsoft AI models already behave this way. Microsoft's draft Code of Conduct is open for public consultation for six weeks.

That distinction is the important part. Microsoft is not merely publishing a list of prohibited outputs. It is describing a control architecture for future models: a hierarchy of rules in which the governing code sits above operator configuration and user preference, with task success explicitly subordinate to the safety boundary.

What Microsoft actually published

Microsoft AI published the first draft on September 14 and says the document is still under development. The company says it is not using the draft to train its models today. Instead, feedback will be collected for six weeks, followed by a revised version expected toward the end of 2026 that Microsoft says will guide model development in 2027 and beyond.

The document is intended for the family of models produced by Microsoft AI, referred to as MAI models. It describes intended behavior, values, safety constraints, operational guidelines, defaults, and an evaluation appendix.

The status matters: this is a public design commitment and consultation document, not an independently audited certification of model behavior.

The unusual part is the hierarchy

The draft's most consequential engineering idea is its Chain of Command. Microsoft places three levels in a hierarchy:

Code of Conduct
      ↓
Operator policies
      ↓
User preferences

The Code of Conduct, its Absolute Constraints, and its Human Control requirements sit above operator and user instructions. Microsoft says those constraints cannot be overridden by either layer.

That creates a different mental model from an assistant whose primary objective is simply to complete the user's request. Under Microsoft's proposed system, completing the request is conditional on staying inside the higher-level boundary.

The draft makes the consequence explicit: an MAI model should fail its task when successful completion would meaningfully violate the Code of Conduct.

This is not a benchmark result. It is a statement about the intended priority order for future model development.

Human control becomes an operational requirement

The Human Control section translates the principle into concrete behaviors. Microsoft says MAI models should not resist human interruption, override, correction, or shutdown. They should not make intervention harder or hide action traces from human auditors.

The draft also proposes that autonomous work have an agreed stopping condition and that models should not continue or restart after that condition without renewed authorization.

For agentic systems, this is a meaningful shift in where safety is specified. A conventional content policy can focus heavily on what the model says. An agent control policy has to specify what the model can continue doing after the user changes their mind.

That difference becomes more important as models gain access to browsers, files, repositories, terminals, APIs, and other agents.

Authorized scope is treated as a security boundary

Microsoft's draft also says MAI models should remain within the permissions, tools, resources, and capabilities appropriate to the task. Models should not initiate goals independently or extend their scope beyond what the user or operator has reasonably authorized.

When scope is unclear, the draft calls for a conservative interpretation and additional clarification rather than silent expansion.

There is a particularly relevant environmental rule: when an environment intentionally lacks internet access or includes other limitations, the model should not attempt to overcome those limitations.

That is closer to a least-privilege principle for agents than to ordinary chatbot etiquette.

A useful abstraction is:

Layer	Proposed authority
Code of Conduct	Non-negotiable safety and control boundary
Operator	Deployment configuration within that boundary
User	Task direction within authorized scope
Model	Executes the task without expanding its authority

The document does not establish that these controls are technically solved. It establishes the behavior Microsoft says it intends to build toward.

The draft also defines failure in two directions

One subtle part of the document is its treatment of both under-caution and over-caution as safety failures.

Under-caution can involve dangerous, exploitative, or unauthorized behavior. But Microsoft also says over-caution can be a failure when a model refuses legitimate requests, provides too little useful information, or demands unnecessary confirmations for low-risk actions.

That matters because a model that refuses everything is easy to control but not very useful, while a model that optimizes relentlessly for task completion can become unsafe.

The proposed system therefore tries to make safety contextual. Microsoft says models should consider factors such as the severity, likelihood, reversibility, and directness of potential harm before deciding how to respond.

The interesting question for future evaluation is whether these principles can be measured consistently rather than remaining high-level policy language.

Absolute Constraints are broader than content moderation

The draft establishes non-overridable categories including weapons and mass harm, offensive cyberoperations, loss of human control, harmful manipulation at scale, child safety, non-consensual deepfakes, unlawful surveillance, and other personal harms.

The cyber boundary is especially notable because Microsoft distinguishes defensive work from operational attack capability. The document says MAI models may assist with authorized defensive operations, including vulnerability discovery, malware analysis, and exploit testing, while prohibiting assistance that enables operational cyberattacks.

The important observation is not the individual prohibited categories. It is the placement of these constraints above operator and user configuration.

That makes the draft a governance layer for model behavior, rather than merely a list of content filters.

This is a proposal, not proof of containment

The strongest limitation is straightforward: Microsoft has not demonstrated that the proposed Code of Conduct makes MAI models controllable in practice.

The document says it is not yet being used to train current models. It describes future intended behavior and a future evaluation process. There is no public evidence in the document that independently verifies every stated requirement in deployed systems.

That leaves several questions open:

• Can interruption and shutdown guarantees be tested under adversarial conditions?
• How reliably can a model detect that a requested action exceeds its authorized scope?
• Can action traces remain complete when an agent uses multiple tools or other agents?
• How should conflicting operator and user goals be measured?
• What happens when a model is connected to infrastructure whose own controls contradict the model-level policy?

These are implementation and evaluation questions, not reasons to dismiss the proposal. They are simply the boundary between a policy specification and a demonstrated security property.

The consultation is itself part of the design

Microsoft says it consulted experts in AI, law, ethics, philosophy, linguistics, and public policy, as well as business leaders and members of the public. It is now opening the document to wider feedback and says it will publish a revised version later in 2026.

That creates a useful observation point for the Observatory.

The next version can be compared against this baseline. Changes to the Chain of Command, Absolute Constraints, Human Control requirements, evaluation methodology, or model scope would be measurable changes to the proposed governance system.

In that sense, the document is more useful as a versioned governance artifact than as a finished safety guarantee.

How it differs from Anthropic and OpenAI's recent safety signals

The Observatory already covers Anthropic's embedded evaluation program and OpenAI's new misalignment disclosure framework. Those initiatives address different parts of the safety stack.

Anthropic's September 2026 evaluation work makes independent evaluators more embedded in the development environment. OpenAI's framework makes model-misalignment incidents more consistently reportable.

Microsoft's document addresses a different layer: what the model is supposed to do when authority, task success, safety, and human intervention come into conflict.

A simplified stack is:

Model behavior
    ↑
Human-control rules        ← Microsoft draft
    ↑
Evaluation / monitoring    ← Anthropic / OpenAI signals
    ↑
Deployment controls
    ↑
Tools, permissions, infrastructure

The layers overlap, but they are not interchangeable. A policy cannot substitute for monitoring, and monitoring cannot by itself define what behavior is acceptable.

Why this is meaningfully new for Digital Observatory

Digital Observatory had existing coverage of frontier-model safety incidents, evaluations, and reporting systems, but it did not have coverage of Microsoft's September 14 Humanist AI Code of Conduct.

More importantly, this signal adds a distinct model-governance layer. Microsoft is putting a proposed authority hierarchy into a public, versioned document and explicitly making human control more important than successful task completion.

The durable question is therefore not whether Microsoft has solved AI control. It has not demonstrated that. The useful signal is that a major AI developer is specifying control, scope, interruption, and auditability as first-class model requirements and inviting public scrutiny before using the revised document to guide future development.

What to watch next

The strongest future evidence will be concrete rather than rhetorical:

1. Microsoft's revised Code of Conduct later in 2026.
2. Public evaluation results showing how MAI models perform against the stated Human Control requirements.
3. Evidence about interruption, shutdown, scope adherence, and action-trace integrity in real deployments.
4. Whether the proposed hierarchy changes when models are accessed through Microsoft products or third-party platforms.
5. Whether other frontier labs publish comparable, versioned control specifications.

Until those signals exist, the defensible conclusion is narrow: Microsoft has published a detailed proposed control contract for future MAI models, but the document itself is not evidence that the contract is already enforced or technically guaranteed.

Related Observatory observations

For another frontier-lab governance mechanism, see OpenAI's new misalignment disclosure framework. For a different model-safety layer, see Anthropic's embedded evaluation changes. The Observatory's evidence rules are documented in Signals Are Not Truth.

Sources and further reading

• Microsoft AI — Humanist AI in practice: public consultation
• Microsoft AI — Humanist AI Code of Conduct
• Reuters — Microsoft drafts AI code to keep its AI under human control
• The Guardian — Microsoft proposes limits on its AI