AI Containment Starts with the Information Your Agents Can Access

As AI agents become more capable, the conversation about enterprise AI is shifting.

The question is no longer: Can we trust the model?

It is also: What should the model be allowed to access and do?

Satya Nadella, Chairman and CEO of Microsoft, recently addressed that question in Models as Insider Risks in the Super Intelligence Era. His argument is clear: organizations deploying advanced AI cannot outsource responsibility for how those systems behave. Instead, enterprises should treat powerful models like potential insider risks: limit privileges, monitor activity, establish containment boundaries, and maintain independent control over what models can access and what actions they can take.

As Nadella puts it, organizations need to “separate the supply of intelligence from the authority over it.”

That principle has important consequences for enterprise information management.

Because controlling what AI can do starts with controlling what AI can access.

AI containment is an information governance challenge, too

Enterprise AI increasingly works across the information employees use every day, including documents, emails, collaboration environments, business applications, and other systems.

As organizations give AI agents greater access to that information, traditional assumptions about trust need to change.

Nadella argues that organizations should operate under the assumption that a sufficiently capable model can make mistakes or be compromised. His proposed principles include limiting privileges, monitoring meaningful model actions, independently determining what a model can access and do, independently auditing the system, and maintaining the ability for an authorized person to stop it.

That creates an important parallel at the information layer.

An organization can put sophisticated controls around an AI model, but it must also understand the information the model can access.

Is the information still current?
Who should have access to it?
Is it sensitive?
What business process does it belong to?
What retention or governance requirements apply?
Should the AI be able to discover it at all?

These are not questions a model should decide for itself. They are governance decisions the organization must make.

Control the information, not just the intelligence

This is where information governance becomes an important part of the AI trust architecture.

Giving an AI agent broad access to poorly governed information can create risk, no matter how sophisticated the underlying model is. Instead, organizations need an information environment where access and governance policies are applied independently of the intelligence consuming the content.

The same principles organizations already use to manage enterprise information become even more important in an agentic world:

Understand what information you have. Organizations need visibility into business-critical information and the context around it.
Control who and what can access it. AI should respect established access rights rather than creating a separate path around existing controls.
Apply governance consistently. Retention, classification, records management, and other information policies should continue to govern content as AI becomes another way people and systems interact with it.
Keep information in context. AI needs more than document access. Business context can help. Identify what information relates to a customer, contract, project, case, process, or other business object.
Manage information throughout its lifecycle. AI should not turn forgotten, duplicated, outdated, or unmanaged content into newly discoverable business information simply because an agent can find it.

This is the shift from thinking only about AI governance to thinking about AI and information governance together.

Where M-Files fits

M-Files helps organizations govern the business information that AI and agents use. It applies existing permissions, information governance, and lifecycle controls to business-critical content, while adding context that connects information to customers, contracts, projects, cases, and processes.

This creates a more controlled information foundation for people, Microsoft 365 Copilot, and AI agents. As organizations introduce new AI experiences, those controls help determine what information is appropriately available without requiring a separate governance model for each one.

This is not about creating an alternative governance layer to Microsoft. It is about extending the value of the Microsoft environment to business information managed with M-Files.

Within a Microsoft-centered environment, organizations can bring together Microsoft 365, Microsoft Purview, Microsoft Defender, Copilot, and M-Files to address different parts of the AI trust challenge. Microsoft provides the broader identity, security, compliance, AI, and agent ecosystem. M-Files adds the business context and information governance needed to organize, manage, and appropriately make business-critical content available.

The result is a stronger foundation for AI because access to intelligence does not automatically mean unrestricted access to information.

Governance becomes more important as agents gain autonomy

This distinction matters even more as organizations move from AI assistants that primarily answer questions to agents capable of taking actions.

Nadella argues that the controls determining what a model can access and what actions it can take should sit outside the model itself. He also calls for independent controls and auditability rather than having a model govern or validate its own behavior.

The same principle should influence how enterprises think about information.

The agent should not decide which confidential documents it is entitled to see.
The model should not determine whether a record should still exist.
AI should not create its own definition of who is authorized to access sensitive information.

Those decisions should stem from deterministic policies, permissions, governance rules, and human oversight established outside the model.

The more autonomous AI becomes, the more important those boundaries become.

From AI readiness to AI containment

For the last few years, organizations have concentrated heavily on AI readiness: preparing data, deploying Copilot, experimenting with agents, and identifying business use cases.

Those priorities still matter. But the next phase of enterprise AI will require organizations to think just as seriously about containment.

That does not mean preventing AI from accessing useful business information. The goal is the opposite: make the right information available to the right people and AI experiences, under the right controls.

Organizations that establish those boundaries can give AI useful business context without simply opening the door to everything.

And that may become one of the defining principles of trusted enterprise AI.

Do not ask the model to decide what it should be trusted with.

Decide what the model can access before it ever asks.

"AI containment is not only about controlling what a model can do. It is also about controlling the information the model is allowed to use."

Build a governed foundation for AI.

Learn how M-Files helps organizations make business information secure, governed, and ready for Microsoft 365 Copilot and AI agents.

Explore M-Files + Microsoft

Sources and related reading

M-Files: Microsoft 365 Copilot integration with context
M-Files: Microsoft Copilot + M-Files, your questions answered

Editorial note

This article intentionally does not claim that M-Files contains AI or provides model-level containment controls. The M-Files role is complementary: Microsoft defines the broader model, identity, security, compliance, and agent environment, while M-Files helps organizations apply business context and governance to the information those AI systems consume.