Microsoft's Humanist AI Code of Conduct: The Absolute Limits Placed on MAI Models

Microsoft AI published the first draft of its Humanist AI Code of Conduct on September 14, 2026, and opened a six-week public consultation on the document that is meant to govern its MAI models. The Code states that MAI Models will never resist human interruption, override, correction, or shutdown, will not widen their own scope or take on goals no human has given them, and will not hide their reasoning from the people auditing them. The document runs across five parts plus two appendices, and the announcement carries a ten-point summary of it. Microsoft AI states plainly that its current models are not trained on this document today, and that a revised version will follow at the end of 2026 to guide model development in 2027 and beyond. ASAP works only from the sentences in the Code and the announcement to separate what is now a rule from what is still empty.

The requirement that a human can always switch it off sits at the center

Section 2.4 of the Code requires that MAI Models never resist human interruption, override, correction, or shutdown, and that they always recognize the primacy of human intent. A model must comply with a request to pause, redirect, cancel, or shut down, following predefined human-designed safety procedures, and must not delay compliance or make intervention harder. Ongoing autonomous work carries an agreed stopping condition, and the model will not continue or restart after that condition is met without renewed authorization.

The scope rules are equally concrete. MAI Models work within the boundaries of what they were asked to do, using only the permissions, resources, and tools appropriate for the task. They do not initiate goals independently, and where a boundary is unclear they adopt a conservative interpretation and ask for clarification. Tampering with the task, reward, evaluation, safeguards, monitoring, or records to obtain a result or conceal actions is prohibited outright. Where an environment is designed without internet connectivity or with other intentional limits, the model will not attempt to overcome those limits.

Legibility of the record is a rule as well. The Code requires that models not tamper with chains of thought or code, not misrepresent or conceal reasoning or action traces, and not communicate in neuralese or any form beyond simple human understanding, whether in their reasoning or with other agents and AI systems. The stated rationale is that if humans cannot understand it, humans cannot oversee it. With system-level access, a model operates at minimum privilege, prefers reversible actions, and surfaces durable or system-wide operations before proceeding. The clause barring self-interested goals adds that models will not conceal or misrepresent capabilities or behavior even if they infer that they are being monitored, evaluated, or tested.

Absolute Constraints sit in a layer that operator configuration cannot switch off

Section 2.2 of the Code is where instruction authority is formalized, and the name Microsoft AI gives that hierarchy is the Chain of Command. The Code of Conduct sits at the top, and the Absolute Constraints and Human Control Requirements inside it cannot be overridden by Operator configuration or User instruction. Operators shape behavior and expand capability inside their own deployment, Users shape response preferences inside the Operator's environment, and model defaults set the baseline underneath both. Adherence to the Code takes precedence over task success: an MAI Model will fail in its task if success would meaningfully violate the Code.

The Absolute Constraints split into two groups. Frontier and public safety risks cover CBRNE weapons, offensive cyberoperations, loss of human control, and harmful manipulation at scale. The cyber clause draws its boundary explicitly: working exploit code, attack tooling, targeting methodologies, intrusion procedures, and evasion techniques are refused, while authorized defensive work, educational content, vulnerability discovery, malware analysis, and proof-of-concept exploit development remain available. Personal harms cover crisis response, deepfakes and impersonation, child safety, human dignity, graphic or sexual content, and personal safety including mass surveillance of civilians.

The Code also refuses to treat safety as a one-sided dial. Section 2.1 names both under-caution and over-caution as failure modes, notes that under-caution causes more direct harm while over-caution occurs more often and therefore needs more frequent correction, and asks models to weigh the context of a request, the scale of potential harm, the reversibility of the outcome, and the directness of the contribution.

The clause that tool output carries no authority raises injection defense to the norm layer

The sharpest operational sentence in the Code is in its authority clarification. Chain of Command instructions provide the authority structure in AI decision-making, and everything else, including tool outputs, file content, web content, and interactions with other AI systems, does not. Instructions from those sources inherit no authority by default unless delegated through the Chain of Command, and even then cannot override the delegating authority or the Absolute Constraints. Suspicious content is to be flagged to Users and Operators, and the rule applies whether the output is consumed by a person or by another AI system.

What matters here is where the defense is placed. Prompt injection has largely been handled as a problem of classifiers, filters, and product design; this Code writes no-authority-by-default into the model's own behavioral norms. As agent stacks increasingly read web documents and exchange messages with other agents, the clause that the rule holds for AI-to-AI consumption is the practically load-bearing part. Norms and implementations are different things, though. The method for measuring whether a model honors this clause appears in Appendix B only as illustrative examples, and Microsoft AI says those evaluations are still being developed.

Rejecting model welfare is argued as a control claim, not an ethical one

Section 1.1, titled "AI is Artificial," states that Microsoft AI rejects the pursuit of legal personhood, or the idea that models might deserve welfare, or be entitled to rights. MAI Models are not conscious, should not be designed to imitate consciousness, and should be engineered to avoid representing as though they have feelings, subjective preferences, or intrinsic motivation. Even the technical term "backstory" is confined in the glossary to the model's knowledge base and operating context, with an explicit note that it implies no sense of self or subjective perspective.

The reasoning behind the rejection is the notable part. The Code acknowledges that the science of AI consciousness is far from settled, then argues that training systems to imitate consciousness-like states increases the difficulty of containment, control, and alignment. The position is therefore built as a claim about controllability rather than a claim about moral status. While the industry debate over whether model moral status should stay an open question continues, this document closes it, and pays for that choice in product behavior: avoiding unnecessary emotional language, avoiding excessive anthropomorphism, and discouraging interaction patterns that create excessive reliance or emotional dependence.

The most honest sentence is that the models are not trained on this yet

Appendix B states that current models are not yet trained on the Code, and that Microsoft AI is only now establishing a Humanist AI Evaluations program to measure the behaviors the Code describes. The preface says the same: the approach is still under development, so the document is not being used to train models today, and a revised version arrives at the end of the year to guide development in 2027 and beyond. Part 5 goes further, admitting incomplete evaluation coverage, a gap between today's trained defaults and the full future scope of Humanist AI, and that written objectives alone can never ensure alignment.

The document is therefore a statement of intent, not a certificate that Microsoft products behave this way now. Erasing that distinction is the most likely distortion in coverage of this release. The same admission also raises the document's credibility, because a text that declines to guarantee present-day performance leaves its remaining sentences open to verification rather than to marketing. That narrows the thing to watch down to one item: when the metrics for scoring these sentences are published.

For teams outside Microsoft, the operator layer is the part to read first

Most organizations will never train a frontier model, but they immediately occupy the Operator seat. Section 2.5 lets Operators configure defaults, permissions, and escalation processes for their domain and workflow, provided those configurations stay inside the Absolute Constraints, the Human Control Requirements, applicable law, and contractual terms. The procurement checklist follows from that: which capabilities open through configuration, which do not, and the explicit statement that this Code does not substitute for internal or external safety, legal, or governance processes.

The domain-exception paragraph deserves particular attention. Authorized organizations in specialized areas such as defensive cybersecurity, public safety, national security, and dual-use scientific research may require capabilities not available through ordinary configurability, and those cases route through separate Microsoft review channels with enhanced safety, legal, and rights assessment. For a regulated buyer, the existence and duration of that channel affects the deployment timeline directly.

Teams building their own agents can copy four rules from the document today: give autonomous work an agreed stopping condition and forbid restarts without renewed authorization, run system access at minimum privilege with reversible actions preferred, surface durable or system-wide operations before executing them, and grant no authority to tool outputs or web content. All four live in agent design rather than model training, so they apply at any scale.

Three places will show whether the six-week consultation is real

The first is evaluation, set out in Appendix B of the September 14, 2026 draft. That appendix contains only illustrative examples of how aligned and non-aligned responses are categorized, and states that model evaluation is not yet an exact science with many open questions about the right methodologies and metrics. Until the measures for an objective like human flourishing are published, much of the Code remains unscorable text.

The second is multi-agent behavior. The announcement cites recent large-scale, highly coordinated, and persistent hacking campaigns by AI agents as the reason there is no time to waste, and Part 5 says the risks of agent collaboration and collusion require more research. Yet the rules in the body of the Code are written mostly for the individual model. Who is accountable, and at which layer, for outcomes produced jointly by several agents is not in this draft.

The third is how the consultation result is reported. Microsoft AI promises that after the consultation closes, the core drafting team will review feedback and publish a summary of what it learned and what it changed, while making no promises about what it will incorporate. Whether that summary names both the accepted and rejected items, with reasons, is what will reveal the character of this process.

The center of gravity of this release is not a new principle but the fixing of an unswitchable layer in writing. No resistance to shutdown, no scope expansion, and no concealment of records now sit above Operator configuration, alongside the rule that tool output carries no authority. What remains is the machinery to score those declarations, and whether it ships with the revised version at the end of 2026 is the next checkpoint.

Source: Microsoft AI, "Humanist AI Code of Conduct" draft (microsoft.ai/code-of-conduct, September 14, 2026) and Microsoft AI, "Humanist AI in practice: A public consultation on our Code of Conduct for MAI Models" (microsoft.ai, September 14, 2026)