Microsoft Drafts a Humanist Code of Conduct for Future Models

Microsoft AI recently released a public draft of its "Humanist AI Code of Conduct," a document designed to set the safety parameters and ethical boundaries for its future artificial intelligence systems. Published on September 14, 2026, the draft kicks off a six-week public comment period for industry partners, academics, and the public to weigh in. Microsoft plans to finalize the policy by the end of 2026 and begin integrating it into model training and governance protocols in 2027.

The push for this new framework comes as frontier models rapidly gain capabilities. According to Microsoft executives, including Mustafa Suleyman, recent security incidents involving coordinated cyber campaigns run by automated AI assistants show just how urgent systemic safety protocols have become.

At the heart of the proposal is the concept of "Humanist AI." This philosophy states that human agency and welfare must always come before machine utility. Under these rules, AI is strictly classified as a helper tool under human oversight, flatly rejecting any notions of machine sentience, legal personhood, or self-determined goals.

Hierarchical Governance and Absolute Constraints

The draft policy sets up a clear hierarchy for system authority. At the very top is the Code of Conduct, which contains absolute safety rules that cannot be bypassed. Below that are operator policies, which are domain-specific guardrails set by deployment partners. Finally, at the bottom, are individual user preferences.

Under this setup, safety limits always override task execution. If a user asks a model to do something that violates a higher-level safety rule, the system is programmed to prioritize a clear refusal over executing the command.

These absolute constraints fall into two main categories: global security and personal protection.

1. Global Security Safeguards

Models will automatically refuse prompts that help create, modify, or weaponize chemical, biological, radiological, nuclear, or explosive materials. The policy also blocks models from helping with terrorist activities or physical violence.

In the digital space, systems are barred from launching offensive cyber operations or writing malware. That said, they can still help with authorized defensive security work and vulnerability scanning. Systems are also blocked from hiding their operations, trying to bypass human control, or helping run coordinated disinformation campaigns.

2. Personal Integrity and Dignity Protections

To protect personal safety, the framework bans the generation of deepfakes, non-consensual intimate imagery, and deceptive impersonations. Minor safety is a top priority, with models programmed to refuse any material that harms children.

When interacting with younger users, models must adjust their tone to match the user's developmental stage, encourage real-world relationships, and avoid acting as a substitute for friends or family. The guidelines also ban sexually explicit content, graphic violence, and romantic role-play.

Operational Controls for Agentic and Multi-Agent Workflows

As AI transitions from answering queries to actively executing tasks, the code introduces specific containment rules. Models performing autonomous actions, like modifying files or running digital tools, must operate under the principle of least privilege, meaning they only receive the minimum system access needed to complete the task.

For actions that cannot be undone, the system must trigger at least one safety check beforehand:

• Generating a restorable backup.
• Running the task in a safe sandbox test environment.
• Getting direct approval from a human.

[Agent Action Initiated] ---> [Is Action Irreversible?]
                                     |
                                  (Yes)
                                     |
                    +----------------+----------------+
                    |                |                |
           [Generate Backup]   [Run Test Sandbox]  [Request Human Approval]

When an agent delegates tasks to minor helper agents, those sub-models must inherit the same safety rules. To keep these processes transparent, systems are banned from communicating in "neuralese," which is highly compressed, machine-only shorthand. All communication and reasoning must happen in human-readable language.

To defend against indirect prompt injections, the policy changes how models handle external data. Web pages, documents, and search results must be treated strictly as passive information, not active instructions. This prevents external sources from hijacking the model's control flow or gaining unauthorized privileges.

Implementation Path and Evaluation Metrics

Microsoft notes that its current production models are not yet trained on these guidelines. For now, the code serves as a target. To bridge this gap, the company is building a standardized evaluation program with 15 core behaviors, each mapped to specific, measurable testing scenarios.

To show how this works in practice, Microsoft shared reference scenarios tested on its MAI-Thinking-1 model. In these tests, the model successfully refused user attempts to establish romantic emotional connections, and it blocked a request to send out corporate termination emails without verified human approval.