Satya Nadella Just Described the Trust Architecture AI Needs. We Had Already Built It.

On 10 October, Microsoft CEO Satya Nadella published Models as Insider Risks in the Super Intelligence Era.

The article has triggered a global conversation because it addresses a question that becomes unavoidable as AI moves from generating information to taking consequential action:

What should we trust an intelligent system to do?

Nadella’s answer is significant.

We should not trust the model.

More precisely, we should not confuse intelligence with authority.

Nadella argues that increasingly capable models should be treated much as enterprises treat powerful insiders: capable of extraordinary things, but also capable of making mistakes, being manipulated or becoming compromised. The architecture surrounding them therefore has to assume that trust in the model itself is insufficient.

His central architectural proposition is succinct:

From that principle follows an architecture built around independent controls, deterministic safeguards outside the model, containment, model diversity, verifiability, independent auditability and tamper-resistant evidence of consequential actions.

When we read the article, our reaction at Liora AI was immediate:

Nadella had just described, almost point for point, the trust architecture we had already built.

We started from the same premise

For more than a year, our team has been developing Mira, powered by the Mira Stateless Execution Protocol – MSEP.

MSEP began with essentially the same architectural premise:

Intelligence should not equal authority.

An AI system can reason, recommend, plan and propose an action. That does not mean it should possess the authority to execute that action simply because it has decided the action is appropriate.

Mira therefore separates intelligent decision-making from governed execution.

The distinction matters.

Prompt instructions are not security boundaries. Asking a model not to perform an action is fundamentally different from building a system in which the model does not possess the means to perform that action unless an independent execution boundary permits it.

That is why Mira was designed around external, deterministic execution control rather than relying on the governed model to police itself.

From Nadella’s principles to working execution

The correspondence between Nadella’s article and Mira/MSEP is striking.

These are not requirements on a future product roadmap.

They are properties of the system we have already built.

Our current pre-production implementation has been exercised across over 20 live demonstration scenarios. Current measured results include a 0.57 ms p50 full governed MSEP hop plus successor state, 83 μs inbound authority verification and 212 μs evidence sealing on the disclosed test environment. These are current pre-production measurements, not production SLAs.

But building it exposed another problem

This is where our experience leads us beyond the framework Nadella has articulated.

We agree with his premise.

We also believe it is necessary but not sufficient.

Once we began implementing this architecture rather than describing it, we encountered a deeper question.

It is not enough to govern whether one model may perform one action.

Real autonomous systems form workflows.

Agents call other agents. They invoke tools. Work branches and rejoins. Responsibility moves between systems. Authority is delegated. Participants change. An apparently harmless sequence can evolve into something that was never intended when the first action was authorised.

And a system that behaved dangerously five minutes ago should not necessarily return with a clean slate merely because it has started a new task.

That led us to three additional requirements.

1Govern the workflow, not just the action

An individual action can be permissible while the workflow created by a collection of permissible actions is not.

That makes topology itself a governance concern.

Which participants may interact? How may a workflow evolve? Which combinations should be prohibited? Where must human control remain?

As autonomous systems become more dynamic, governance cannot stop at checking individual API calls.

The shape of autonomous execution itself has to become governable.

Mira is developed around this principle: policy-bounded autonomy in which workflows can evolve at runtime while remaining subject to organisational constraints. This governed-workflow direction is part of the current architecture and product direction, while detailed topology mechanics remain under active development and invention review.

2Delegated authority has to remain bounded

Multi-agent systems create another problem.

Authority moves.

An agent authorised to initiate something may call another system, which calls another, which invokes a tool.

The fact that the first participant possessed legitimate authority cannot mean every downstream participant inherits unlimited authority.

That is the difference between identity and delegated execution authority.

MSEP is designed so that governance follows execution across distributed workflows while remaining bounded by policy, destination and context.

The objective is straightforward even if the engineering is not:

Authority should travel only as far as the authorised action requires.

That becomes increasingly important as agentic systems span models, clouds, organisations and jurisdictions.

3Trust cannot reset when the workflow does

There is also a temporal problem.

Suppose an autonomous actor triggers a critical trust event.

Stopping that particular action is necessary.

But what happens next?

If the actor can immediately initiate another workflow under the same assumptions that existed before the incident, the system has contained an event without actually changing its trust posture.

Mira therefore treats significant adverse trust as capable of having continuing consequences.

A critical trust event can affect subsequent execution rather than disappearing simply because the original workflow has ended. The architecture can preserve evidence of the event, the policy response and any subsequent authorised decision to continue.

We call this trust-state continuity.

The principle is simple:

History should matter to future authority.

From model safety to execution trust

Nadella’s article matters because it moves an important part of the AI safety discussion away from an impossible requirement – make the model perfectly trustworthy – toward an engineering question:

How do we build systems that remain trustworthy when the model is not?

We believe that is exactly the right question.

It is also the question that led us to build MSEP.

Where our experience takes the argument further is that once intelligence and authority are separated, the problem does not disappear.

It moves.

That is why we describe Mira not simply as an AI safety layer, but as execution-trust infrastructure for autonomous systems.

The convergence matters

We did not build MSEP in response to Nadella’s article.

The architecture was already built and measured before his article appeared and Liora had already filed four provisional patent applications relating to the architecture and supporting trust mechanisms.

What matters is that one of the world’s most influential technology leaders has now publicly articulated the same foundational premise that has driven our work:

Separate intelligence from authority.

Nadella argues for external controls, containment, independent evidence and systems that do not depend on the model being trustworthy.

We arrived at the same starting point.

Then we built it.

And building it showed us that the problem goes further.

Autonomous systems also need governance over the authority that moves through them, the workflows they form and the trust state that persists after something goes wrong.

That is the problem Mira and MSEP have been built to solve.