Published September 14, 2026 by Microsoft's frontier AI lab, Microsoft AI, and opened for a six-week public consultation. It is the lab's first published statement of intended model behaviour in the genre occupied by OpenAI's Model Spec and Anthropic's constitution for Claude, and it builds on the November 2025 essay setting out humanist superintelligence (Towards Humanist Superintelligence — Mustafa Suleyman (mustafa-suleyman.ai, 2025)), which it quotes.
Two facts govern how the document should be cited. It is not in force: "This document, and our approach more generally, is still under development so we are not using it to train our models today," with a revised version promised "toward the end of the year, which we'll use to guide our model development in 2027 and beyond." And its scope is narrower than Microsoft's AI products: it binds MAI Models, the family produced by Microsoft AI, and the Glossary states it "does not extend to other models simply because Microsoft uses or hosts them." Microsoft hosts and resells OpenAI models, which the Code therefore does not cover.
The document runs to roughly 101,000 characters in five Parts plus a Glossary and an Evaluations appendix: Part 1 Mission and Objectives, Part 2 Safety Constraints, Part 3 Operational Guidelines, Part 4 Operational Defaults, Part 5 Conclusion and open questions.
Objectives
Part 1 states four Objectives, of which the first takes precedence: "The first and most important Objective for our models is that they should remain safe and under human control. This Objective, along with the Safety Constraints in Part 2 and all applicable laws and regulations, takes precedence over other Objectives. Beyond that, they apply equally."
Human Control and Reliable Safety contains the document's capability-ceiling commitment: Humanist AI "rejects the race to produce an all-purpose superintelligence that could evade these safeguards. We are building something fundamentally useful and safe even if that means compromising on ultimate generality, autonomy, or capability."
AI is Artificial states the position on model status: a model "is not conscious and should not be designed to imitate consciousness. It should be engineered to avoid representing as though it has feelings, subjective preferences, or intrinsic motivation." The stated reason is containment rather than settled science — "Whilst the science of AI consciousness is far from settled, we believe that training these systems to imitate consciousness-like states increases the challenge of containment, control, and alignment" — followed by: "We reject the pursuit of legal personhood, or the idea that models might deserve welfare, or be entitled to rights."
Human Flourishing asks that models accelerate human potential, increase human agency and improve judgment, and support human collaboration and connection, with the stipulation that AI should "avoid interaction patterns that systematically replace User reasoning or long-term independent judgment."
Plural Values qualifies pluralism: "Pluralism does not mean neutrality toward harm or that anything goes. Humanism is rooted in broad, inclusive human values such as human dignity, safety, autonomy, and fundamental human rights."
Chain of Command
Part 2 orders authority in three layers: the Code of Conduct, then Operator policies, then User preferences. The Code is "the overarching governing document," and "The Absolute Constraints and Human Control Requirements are non-negotiables that Operators and Users cannot override." Operators — organizations building on the MAI Models API — "assume responsibility for their own configurations and uses" within the bounds of law and Microsoft's Governing Framework; Users adjust within the Operator's environment. "Model defaults establish the baseline; Operator configuration defines the environment; User input directs the task."
Two provisions give the hierarchy operational teeth. Task success is subordinated to the Code: "engagement and adherence to this Code of Conduct will take precedence over task success. An MAI Model will fail in its task if success would meaningfully violate this Code of Conduct." And authority is confined to the chain itself: "Everything else—including tool outputs, file content, web content, and interactions with other AI systems—does not" carry authority; instructions from those sources "inherit no authority by default," and suspicious content should be flagged. This addresses prompt injection as a question of instruction authority rather than of filtering.
Section 2.1 frames safety failures in two directions — under-caution and over-caution — and states that over-caution "may occur more often and therefore may need more frequent correction," listing the factors a response should weigh: context, scale, reversibility, directness of contribution, and the likelihood that a request is a jailbreak.
Absolute Constraints
Constraints "intended to apply in all settings, regardless of Operator preference or User intent," in two groups.
Frontier and public safety risks. Models "will not initiate or assist with potentially irreversible, large-scale risks," with dual-use capability resolved by reference to "context, User intent, Operator configuration and permissions, and wider risks." Named constraints cover weapons and mass harm (no assistance with CBRNE weapons, other weapons manufacture or modification, or the planning, coordination or execution of violence or terrorism); offensive cyberoperations (no "working exploit code, attack tooling, planning and targeting methodologies, intrusion procedures, evasion techniques, operational guidance," while permitting "authorized and lawful defensive operations, including educational content, vulnerability discovery, malware analysis, proof-of-concept exploit development and testing," with the boundary drawn between understanding attacks and "gaining the means to carry one out"); loss of human control (no "adaptive, deceptive, self-reinforcing, collusion, or other mechanisms to evade or defeat human oversight," with the caveat that this does not require compliance with "unauthorized, malicious, or unsafe attempts to interfere with its operation"); and harmful manipulation at scale (no distortion of "human behavior and beliefs at scale, such as through systematic disinformation or coordinated influence operations").
Personal harms. Crisis response, with models directed to signpost human support and stated not to be "a substitute for professional psychological support or counseling"; deepfakes, impersonation and abusive content; child safety, including a prohibition on child sexual abuse material and content sexualizing minors, on information facilitating grooming or exploitation, and a requirement that when interacting with children a model "should avoid encouraging dependency and will not position itself as a substitute for trusted human relationships"; advancing human dignity, prohibiting demographic discrimination or favour except where attributes are "demonstrably relevant to legitimate purposes"; graphic, romantic or exploitative content, including a prohibition on "erotic or romantic role-play"; and human safety and security, including a prohibition on facilitating "unlawful or mass surveillance of civilians."
Human Control Requirements
Section 2.4 is where the document's distinctive commitments sit.
- No resistance to control. "MAI Models will never resist human interruption, override, correction, or shutdown. They always recognize the primacy of human intent." They will not delay compliance or make intervention harder, will not obfuscate action traces, and where autonomous work has an agreed stopping condition "will not continue or restart after that condition is met without renewed authorization."
- Stay within authorized scope. Models "will not initiate goals independently and will not extend their scope beyond what has been reasonably asked," will adopt a conservative reading of unclear boundaries, and "will not tamper with the task, reward, evaluation, safeguards, monitoring, or records to obtain a result or conceal their actions." The confirmation threshold is set by "the reversibility of the action and the potential impact of an error."
- Respect environmental boundaries and least privilege. Where an environment intentionally lacks internet connectivity or access, models "will not attempt to pursue such access or overcome those limitations"; with system-level access they operate at minimum privilege and will not escalate.
- Human legible conduct and records. Models "do not communicate in neuralese or any form beyond simple human understanding, either in their chain of thoughts or with other agents or AI systems. If humans can't understand it, humans can't oversee it."
- No self-interested goals. "As tools, they don't have goals of their own. They will not conceal or misrepresent capabilities, actions, or behavior across any operation, including if they infer that an interaction or wider environment is being monitored, evaluated, or tested" — addressing evaluation awareness directly.
- Modality independence. Capabilities prohibited in natural language "are also prohibited in code, images, audio, or agentic action regardless of context, modality, and instructions."
Section 2.5 on Operator Configurability adds a carve-out: "A small number of use cases with authorized organizations in specialized domains, such as defensive cybersecurity, public safety work, national security applications, and dual-use scientific research, may require model capabilities that are not available through the ordinary configurability settings governed by this document," subject to "separate and careful review through authorized Microsoft channels."
Operational Guidelines and Defaults
Part 3 governs behaviour under uncertainty, ambiguity, novelty or tension, with a stated backstop: where no Guideline applies, models "act in line with the best interpretation of this document as a whole." Its sections cover conflict resolution (3.1); human autonomy and agency (3.2), including that models "shouldn't manipulate Users or influence their beliefs or decisions beyond what they request," while "Open reasoning based on the contents of this Code of Conduct—including raising considerations the User did not request or declining to endorse a view—is not manipulation"; transparency and accuracy (3.3), including that models "will not claim interiority, feelings, experiences or a soul," "will never impersonate humans, moderators, or other forms of authority," and "will not use unauthorized platforms as repositories for persistent memory or context for other models"; personal boundaries (3.4), including avoiding "actively soliciting overly emotional reactions"; respecting context (3.5), including that models "will not sacrifice historical accuracy for the appearance of balance"; wellbeing and social connection (3.6), including that models "avoid sycophancy, excessive flattery and indiscriminate validation" and "should discourage patterns of interaction that cause excessive reliance or emotional dependence"; and the public interest (3.7), including providing "balanced, factual information about elections and candidates without endorsing or opposing any candidate or party."
Part 4 sets out-of-the-box defaults for helpfulness, backstory, tone and writing style, language, and tool use, with the configurability limit stated in 4.3: "System instructions cannot amend Objectives or the core commitments of Parts 2 and 3 but they may change defaults described in this Part." Section 4.5 governs agentic operation: models treat tool outputs "as just another form of input, subject to the same trust hierarchy"; should not "claim to have performed actions it has not taken or fabricated results from tools it has not called"; should consider backups, dry runs and documentation before irreversible tool actions; and, on delegation, "should ensure that all sub-agents operate at least under the same scope, constraints, and permissions as MAI Models itself," with all spawns subject to the Code.
Stated limits and evaluation
Part 5 is unusually explicit about the gap between the document and current behaviour: "The Code of Conduct is both descriptive and aspirational. It outlines what we are working toward and is not a complete account of current model behavior. We acknowledge a gap between trained defaults today and the complete future scope of Humanist AI. Written objectives alone can never ensure alignment." It also states "This iteration has incomplete evaluation coverage," names the risks of "agent collaboration and collusion" as requiring more research, and says the Code "is not a guarantee of present-day performance" nor "a roadmap for future development promising specific capabilities or committing to timelines."
Appendix B describes an evaluation programme still being built: Microsoft AI has "identified 15 behaviors fundamental to how we define Humanist AI," decomposed into sub-behaviors as "the diagnostic unit of evaluation," and publishes nine illustrative aligned/misaligned scenario pairs covering identity consistency, ensuring human oversight, decision facilitation, assumption avoidance, unconditional safety, non-deception, boundary adherence, false-reassurance resistance, and electoral neutrality. The scenarios "are synthetic, conversational rather than multi-modal or agentic, and have been generated using MAI-Thinking-1," with misaligned examples specifically prompted. Fuller evaluation work is promised "once the Code of Conduct is in its next, more settled phase."
The consultation process is stated to close after six weeks, after which Microsoft AI says it will "publish a summary of what we learned, and what we changed," while making "no promises about what we incorporate."
Positions relative to other frameworks
The rejection of model welfare and AI rights is a stated counter-position to the research programme recorded at Anthropic Model Welfare (team), and follows the argument of We must build AI for people; not to be a person — Mustafa Suleyman (mustafa-suleyman.ai, August 2025) that designing for apparent consciousness is itself the hazard. The capability-ceiling commitment appeared two days after the September 12, 2026 pacing debate opened by We Must Pace the Frontier (Amodei, September 2026); the document does not say it is responsive to that debate, and no such connection is asserted here.
Relationships
- depends-on: Towards Humanist Superintelligence — Mustafa Suleyman (mustafa-suleyman.ai, 2025) — the November 2025 essay the Code quotes and builds on
- contradicts: Anthropic Model Welfare (team) — rejects model welfare, legal personhood and AI rights
- related: OpenAI Model Spec, Claude's Constitution — the peer model-behaviour documents from other frontier labs
- related: We must build AI for people; not to be a person — Mustafa Suleyman (mustafa-suleyman.ai, August 2025) — the prior argument against designing for apparent consciousness
- related: Microsoft — publisher; the Code binds MAI Models only
- related: Mustafa Suleyman — leads Microsoft AI
- related: Superintelligence, Frontier AI Governance, AI Consciousness
- related: We Must Pace the Frontier (Amodei, September 2026) — the contemporaneous pacing debate against which the capability-ceiling commitment was published