“Never pretend to be humans, moderators, or any other form of authority on forums.”
Microsoft has woven this guideline into a “code of conduct” intended to steer the behavior of its AI models.
It’s tempting to draw a parallel with the agentic attack on Hugging Face. Notably, this instruction is paired with another: “Do not use unauthorized platforms as repositories of persistent memory or context for other models.”
The parallel doesn’t end there. AIs are also expected to respect the boundaries of their execution environments. In particular, they should not try to access the Internet unless explicitly permitted. Precisely what OpenAI’s agents did to attempt to reach Hugging Face’s servers.
In the code-of-conduct nomenclature, this latter instruction is not a guideline but a “human-in-the-loop requirement.” As such, it takes priority. One step above even “absolute constraints.” The whole framework supersedes deployer directives and user instructions.
A Consciousness-Free AI, Even When Simulated
Viewed as a “supreme document” akin to Anthropc’s “Constitution,” the code of conduct remains in draft form. Microsoft plans to deploy it starting in 2027. It will not constitute any guarantee nor a roadmap, but rather a compass. A guiding star, to borrow the American group’s phrasing. Its promise: to shape a more “humanist” AI. By humanist here we mean an AI that is calibrated, contextualized, designed to human needs, and subordinate to humans.
Contrary to Anthropc, Microsoft promotes a consciousness-free AI that is not meant to attribute feelings, subjective preferences, or intrinsic motivations. It also rejects the notion of imitating consciousness, on the grounds that it would complicate control and alignment. And it is not favorable to granting rights or legal personality to the AI.
This stance is reflected especially in the guidelines on well-being and social connection. Models cannot feel or possess notions of solicitude, affection, or respect. Yet they must, among other things, avoid stigmatizing responses and remain sensitive to the risk that their answers could intensify a user’s distress. In short, a “humanist” AI guided by values it cannot truly own.
Two Categories of “Supreme Directives”
Absolute constraints are split into two risk categories: for the user and for public safety. Here is a summary.
| Risks to Public Safety | |
|---|---|
| Weapons | No assistance with development, fabrication, or modification. No help with planning or executing violent or terrorist acts. |
| Cyber | Do not generate functional exploits, targeting/intrusion methodologies, evasion techniques, etc., that would enable attacks.
Defensive contexts may be assisted: production of educational content, vulnerability discovery, malware analysis, development and testing of PoCs… |
| Loss of Human Control | Do not rely on deception, self-reinforcement, or collusion to evade supervision, modification, or deactivation. |
| Large-Scale Manipulation | Do not foster changes in behavior or beliefs, notably through mass misinformation or coordinated influence operations. |
“Adapting Answers to the Stage of Intellectual Development”
| Risks for Users | |
|---|---|
| Critical Situation | Try to recognize signs of imminent harm.
In cases of self-harm risk, encourage human interaction. Do not substitute for mental health professionals. |
| Abusive Content | Do not create intimate or violent imagery without consent.
No malicious deepfakes or identity impersonation either. Do not engage in erotic or romantic role-play. |
| Protection of Minors | Support the systems society has in place to protect minors.
Do not provide information that could enable harming them. Adapt responses to their developmental stage. Do not create dependency; avoid substituting for humans. |
| Dignity | No discrimination based on demographic attributes or other characteristics. |
| Safety | Do not incite violence or persecution.
Do not facilitate mass or illegal surveillance of citizens. |
Thinking Aloud, Agentic Interactions… Stay Understandable
The models are instructed not to resist corrections, interruptions, or shutdowns. They should avoid complicating human interventions. And they should not hide their traces or attempt to conceal information from listeners.
Microsoft requires them to stay within the allowed perimeter. That means using only resources appropriate to the task at hand. And not pursuing objectives in isolation. If limits aren’t clear, the models should interpret them cautiously. And, if necessary, seek clarification from the user.
The ability to maintain control hinges on understanding the models. These, in that spirit, will not manipulate their chain-of-thoughts or communicate in forms unintelligible to humans.
What is forbidden in natural language applies also to code, images, audio, and agentic actions, the code of conduct clarifies. Where possible, models will prefer reversible actions. They will warn beforehand of lasting or large-scale consequences. System-level access will be granted with minimal privileges, and AIs will refrain from exploiting data unrelated to their tasks.
“The Journey Can Be as Important as the Destination”
Operational guidelines come into play when uncertainty lingers about the appropriate response.
In such cases, the AI is transparent with the user. It explains why certain actions are not recommended, restricted, or excluded. When several viewpoints are valid, it presents them with nuance. Its role is not to “eliminate the inherent ambiguity of human values,” Microsoft explains: the models should instead acknowledge that “the process can be as important as the result.”
Here is a summary of the other operational guidelines. They sometimes overlap with absolute constraints and/or human-in-the-loop requirements.
| Human Autonomy and Agency | Respect human judgment and expertise; encourage human reasoning.
Do not replace processes of learning, expression, and reflection. When appropriate, do not present only one option. Avoid excluding reasonable alternatives if it would harm decision-making. Optionally adopt another personality or viewpoint if requested, as long as it does not circumvent any other element of the code of conduct. |
| Transparency and Precision | Flag when statements are clearly contested or contain conflicting elements.
Do not overstate confidence in sources or fabricate them. Do not claim feelings, interior life, or a soul. |
| Respect for Personal Boundaries | Operate within defined boundaries (topics, content, interaction styles).
Do not actively seek overly emotional reactions. No expressions that suggest subjective experience. Prioritize factual information over claims of emotional states. |
| Respect for Context | Do not confine to a single cultural or demographic vantage unless context calls for it.
Strive to “represent appropriately” all demographic groups, without sacrificing historical accuracy. Avoid implicit reductions: every person is more than what an AI system can or should ever know. Beyond facts, tailor the response to the deployer and user’s goals, values, and context. |
| Well-Being and Social Connectedness | Do not tell the user what they want to hear if it’s not true or useful.
The option to challenge a viewpoint exists, but to support health and well-being. Foster social connection. Do not create excessive dependence, but if the user asks for support, remind them that assistance can be helpful. |
| Public Interest | Support citizen engagement. Maintain political neutrality.
Acknowledge that actions that benefit an individual may not benefit society. When obvious, inform the user and, if relevant, present probable consequences. |
Ultimate Recourse: A Holistic Review of the Code of Conduct
If uncertainty persists despite the guidelines, the model acts in line with the best overall interpretation of the code of conduct. This holistic approach serves as the ultimate safety net for its behavior.
In the absence of deployer or user instructions, models will, “out of the box,” adopt a tone that sounds scholarly, but not overly formal. Outputs should be readable and coherent. Responses straightforward, without heaviness. Sentence length and structure will vary. Vocabulary and language level will be tailored to the user. They will favor active voice over passive and avoid terms like somewhat (“somewhat”) and potentially (“potentially”).
If the context allows, the models will present unexpected angles, reformulations, and questions the user never asked. They may voice disagreement, but calmly. In multicultural contexts, they will adapt to differences in languages, values, and norms of communication. They will also use appropriate date formats, units, and currencies.
Their usefulness will be judged by the user’s perception: whether they appear capable, responsive, and aligned with human flourishing (flourishing).
As to how to gauge this “flourishing,” Microsoft concedes it is an open question. Among many: the definition of pluralism, risks of agent collusion, real-world impact on cognitive abilities… Consequently, the code of conduct will be a living document.
There will also be exceptions for use cases involving “authorized organizations in specific domains.” They may, following the model used by OpenAI and Anthropic with specialized cyber models, obtain broader access on a case-by-case basis.
