Microsoft AI published a draft “Humanist AI Code of Conduct” on September 14, a document intended to govern the behavior of future MAI models. The proposal sets boundaries for offensive cybersecurity, defines an instruction hierarchy, and requires specific controls when a model operates as an agent with access to tools or real systems.

Its scope requires caution: Microsoft says its current models have not yet been trained on this code. For now, it is a guide for future development and evaluations under public consultation, not a technical guarantee covering products already available.

Limits operators and users cannot override

The document places “Absolute Constraints” and human-control requirements at the top. Below them are policies established by the company deploying the model—the operator—and then user instructions. Microsoft says neither operators nor users may override those higher-level restrictions.

That hierarchy also addresses prompt injection through external content. A webpage, file, tool output, or message from another AI system does not gain authority on its own. It should influence model behavior only when the chain of command has delegated that authority without contradicting a higher instruction. The code also says models should flag suspicious content when relevant.

For agents, Microsoft proposes a minimum-scope principle: perform only what a person or operator reasonably requested, avoid unrelated systems and data, prefer reversible actions, and warn before making durable or broad changes. A model must not escalate its own permissions or expand its objectives on its own initiative.

The same rule extends to delegation. If a model gives work to subagents or other AI systems, they must inherit at least the same restrictions, permissions, and scope. They must also honor requests to stop work or shut down.

The boundary between defense and attack

In cybersecurity, the draft tries to distinguish authorized defensive analysis from operational attack capability. SecurityWeek, which reviewed the document, reports that MAI models should not produce working exploits, attack tools, targeting methodologies, intrusion procedures, evasion techniques, or operational guidance that enables or improves a cyberattack.

The code does allow assistance with lawful, authorized defensive work, including vulnerability discovery, malware analysis, proof-of-concept development and testing, and explanations of how attacks work. That distinction will be difficult in dual-use cases: a proof of concept useful for validating a patch may also become reusable by an attacker.

Microsoft acknowledges that a small number of uses in defensive cybersecurity, public safety, national security, and dual-use scientific research may require capabilities blocked by standard settings. For those cases, it proposes enhanced review through authorized Microsoft channels, including additional assessment of safety, law, and rights.

A standard announced before implementation

The publication matters because Microsoft is defining in writing how its agents should behave before fully incorporating those rules into its models. The text turns general ideas—human control, least privilege, reversible actions, and restrictions inherited by subagents—into criteria that can later be compared with evaluations and observable behavior.

Evidence is still missing. Microsoft says it is establishing a “Humanist AI Evaluations” program and that current models are not trained on the document. SecurityWeek adds that the company opened a six-week public consultation and plans a revised version later in 2026 to guide development in 2027.

The decisive test will not be the draft’s language, but whether Microsoft publishes reproducible evaluations, explains exceptions, and demonstrates that the hierarchy survives malicious instructions embedded in pages, files, and tools. Until then, the code provides a concrete governance architecture, but not yet evidence that those guarantees work in deployed products.