In his annual letter, Microsoft Chairman and CEO Satya Nadella describes a world where people hand whole jobs to AI agents and step in only for direction and judgment: “With agents, we can now macro delegate and micro steer.” For security and IT leaders, that vision turns a technical question into a management one. If agents will do work on behalf of your people, someone has to decide which agents exist, what each one may do, who answers for it, and how you will know when it goes wrong.
This article outlines the concept behind Nadella’s quote, the three shifts it brings, and the governance agenda our experts recommend for the next 90 days.
What Nadella said
In his letter to shareholders in Microsoft’s 2026 Annual Report, Nadella describes the following:
- Agents that carry out tasks on our behalf. An agent that “works on our behalf, returning for direction and judgment when needed.”
- A new way to run the organization. Microsoft now reports in “two new reporting segments: Agents and Infra and Devices and Consumer.”
- Copilot that works on its own. Microsoft 365 Copilot has moved “from synchronous chat assistants to asynchronous agents that can complete complex, long-running tasks.”
- A control plane for agents. He calls Microsoft Agent 365 “the control plane for agents,” which enables organizations to manage them “the same way they manage people.”
Earlier in October, in an essay titled “Models as Insider Risks in the Super Intelligence Era,” Nadella added the warning that matters most to security teams, as reported by Forbes: “We must assume a model is compromised and contain it from the start.”
Three shifts behind the vision
| Shift | What it means | The question for leaders |
|---|---|---|
| From chat to delegation | Agents run long tasks without a person at the keyboard | Which decisions can an agent make alone and which need a human approval? |
| From one model to many | Nadella describes a system where “the harness” (context, memory, and actions) is separate from the model, so models become interchangeable | Are your controls tied to a model or to the agent’s identity and permissions? |
| From tools to a digital workforce | Agents are managed “the same way” as people | Does every agent have an owner, a mandate, permissions, and an end date, like an employee or a contractor? |
The second shift is easy to miss. If models become interchangeable, security cannot depend on trusting any one model. In the same essay, Nadella argued that no single model should both carry out a critical task and verify its own work, as Business Standard summarized. Microsoft’s security leadership made the same point on October 19, when it described agents as agentic insiders: the controls must sit outside the model, where the agent cannot change them.
The risk is no longer theoretical. On October 22, Axios reported that several of the largest U.S. banks had found third-party AI agents operating inside customer accounts, often signed in with the customer’s own credentials, and that the banks could not always tell whether an agent was following the customer’s instructions. Morgan Stanley has started blocking third-party agents; JPMorgan, Bank of America and Citi are restricting them, and most banks are moving toward read-only access. When an organization cannot see which agents act on its behalf or what they may do, blocking them becomes the only safe default. Governance is what lets you say yes instead.
The governance agenda: six questions every leader should be able to answer
| Question | Why it matters | Where to start |
|---|---|---|
| Which agents do we have? | You cannot govern what you cannot see, including agents on employees’ devices | An inventory in the Agent 365 registry, plus discovery of shadow AI agents |
| Who owns each agent? | Without a named owner, nobody approves changes or retires the agent | One accountable owner per agent, recorded in the registry |
| What may it do? | Agents often inherit broad permissions “to make it work” | Its own identity and least-privilege access for each agent |
| What needs a human? | Macro delegation still needs micro steering for high-impact actions | Approval steps for anything that moves money, data or access |
| How do we know it behaves? | Risk changes as the agent works | Monitoring, risk signals, and alerts that reach the SOC |
| When does it end? | Abandoned agents keep their access | Reviews, renewals, and decommissioning, as with any account |
A 90-day agenda for leaders
| Days | Focus | Done when |
|---|---|---|
| 1–30 | See: inventory every agent, including local and third-party ones, and name an owner for each | You can list your agents, their owners, and their purpose |
| 31–60 | Contain: give each agent its own identity, remove broad permissions, and define which actions need a human approval | No production agent runs without an owner, an identity, and least privilege |
| 61–90 | Operate: connect agent risk to the SOC, review the inventory monthly, and retire what is not used | Agent governance is a routine process, not a project |
How our experts help
Nadella’s vision gives leaders a direction. Turning it into operating practice is where Synergy Advisors experts come in:
- Agent 365 E-xperiences: our experts take you through the 90-day agenda in your own tenant, from the first inventory to owners, identities, and the first containment policies. If you are new to the product, start with our guide What is Microsoft Agent 365?
- E-gents: our own agents for security and identity teams, built to work inside Microsoft Teams with clear owners and permissions.
- Our Agent 365 webinar series: Beyond the Agent (November 10), Agent Visibility (December 1), Agent Identity (December 3), Agents & Data (December 8) and Protect the Agentic Enterprise (December 10).
Frequently asked questions
What does “macro delegate and micro steer” mean?
It is Nadella’s description of how people will work with agents: hand over whole tasks (macro delegation) and intervene only to give direction or judgment when the agent needs it (micro steering).
What is Microsoft Agent 365?
Agent 365 is Microsoft’s control plane for AI agents. It helps organizations register, govern, and secure their agents, and Nadella describes it as a way to manage agents “the same way they manage people.” It has been generally available since May 1, 2026.
Who should own AI agent governance?
The business owns each agent’s purpose and outcomes; security and IT own the rules every agent must follow: identity, permissions, monitoring, and lifecycle. Both need a shared inventory.
Do we need to choose one AI model?
Not for governance. If models become interchangeable, as Nadella expects, controls should be tied to each agent’s identity and permissions, not to a model.
Next step
Synergy Advisors experts can turn this agenda into your plan, with your agents, your owners and your risks. Explore Agent 365 E-xperiences or join the Beyond the Agent webinar on November 10.
