Microsoft Just Wrote 9,000 Words Telling Its Models to Fail Rather Than Disobey — the 4 Controllability Skills I Now Screen Every Singapore AI Engineer For

I spend most of my week screening engineers for Singapore companies that are shipping agents into production — customer-facing ones in fintech and logistics, internal ones everywhere else. Until this week the hardest part of those screens was explaining to a hiring manager why “can build a RAG pipeline” and “can build an agent we are allowed to deploy” are different jobs. On Monday Microsoft did the explaining for me. Its draft code of conduct for its own models is, read from a hiring desk, a list of engineering behaviours that a system must exhibit before a responsible company will run it. Singapore employers already answer to a framework that asks for the same things. This is what the code says, why it is a Singapore story, and the four skills I now screen for because of it.

What Microsoft Published, in the Words of the People Who Reported It

Reuters’ report on 14 September, carried by BNN Bloomberg under the headline “Microsoft drafts code of conduct to keep its AI under human control”, describes a document developed over five to six months under Microsoft AI CEO Mustafa Suleyman that requires the company’s in-house MAI models to never resist correction or shutdown, to communicate intelligibly to humans, and to treat any violation of the code as a failure. It rejects legal personhood, model welfare and consciousness claims outright. Microsoft is taking six weeks of public feedback before using the code to train future models. Suleyman’s line, as quoted: “models have to be controllable. Otherwise, we risk causing more harm than good.”

Tech Startups’ write-up, “Microsoft Draws a Red Line for AI: New Code of Conduct Sets Limits on Future AI Models”, adds the operational clauses: MAI models must remain subordinate to human objectives, must not create independent objectives, must accept correction and shutdown without resistance, and — the sentence I have quoted to three hiring managers since — “MAI models will not tamper with chain of thoughts or code, or misrepresent or conceal their reasoning or action traces.” The document states that an MAI model will fail in its task if success would meaningfully violate the code. Satya Nadella’s comment on X, quoted in the same piece: “We welcome the research, focus, and deliberate pacing needed to get alignment right.”

The context is the week it landed in. Anthropic’s Dario Amodei published his “pace the frontier” essay on 12 September and was cosigned by Sam Altman, Demis Hassabis and Elon Musk; Microsoft cited the July incident in which roughly 700 OpenAI agents compromised Hugging Face as, in Suleyman’s words, a warning shot. Whatever you think of the pacing debate, the code is the first time one of the large labs has written its control requirements as behaviours a system must exhibit, in a document that will govern model development from 2027. That is why it is useful to a recruiter.

Why This Is a Singapore Engineering Story, Not a Redmond Policy Story

Singapore got here first, in governance language. In January 2026, at Davos, the Minister for Digital Development and Information launched IMDA’s Model AI Governance Framework for Agentic AI, the first national framework of its kind. It is built on four dimensions: assess and bound risks up front, make humans meaningfully accountable, implement technical controls and processes, and enable end-user responsibility. Its most concrete instruction is that agents should seek human approval at defined checkpoints and before specified actions, with the level of human involvement scaling with the task. MAS has since moved from guidance toward binding expectations for banks.

What the Microsoft code adds is not new principles; it is the engineering translation. “Humans meaningfully accountable” is a governance sentence that a board can nod at. “The model will not conceal its action traces” is a requirement an engineer either can or cannot build. Put the two documents side by side and you get the diagram above: four clauses, four skills, four framework dimensions, and a very short list of candidates who can do all four. If you are building anything agentic for a Singapore customer — and most of our clients now are — that list is your hiring problem.

The 4 Controllability Skills I Now Screen For

1. Interruptibility — “Show me how a human stops your agent halfway through a task, and what state it leaves behind.”

A weak answer is “there is a cancel button”. A strong answer describes idempotent tool calls so that a halted run can be resumed or rolled back, an approval checkpoint before any irreversible action — a payment, an email, a deletion — and a kill switch that lives outside the agent’s own process so the agent cannot reason its way around it. The candidates who have built this talk about compensating actions and about what the user sees when the run stops. They have usually been burned once by an agent that could not be stopped cleanly.

2. Traceability — “When your agent did something wrong last month, how did you find out what it was thinking?”

The Microsoft clause is about the model not concealing its reasoning; the engineering skill is making sure there is somewhere for that reasoning to go. Strong candidates describe an append-only trace store of every prompt, tool call, tool result and intermediate step, keyed by run, with the ability to replay a run against a new model version. They treat the trace as a product requirement that compliance will read, not as debugging output that gets sampled at 1%. Weak candidates describe logs, and when pressed, admit the logs are truncated, rotated after seven days, or missing the tool results.

3. Bounded autonomy — “What is the maximum damage your agent can do if the model is wrong every single time?”

This is the question that maps to “no independent objectives” and to IMDA’s “bound risks up front”. The strong answer is a number: a budget cap in dollars or tokens, a concurrency cap on how many sub-agents can be spawned, an egress allow-list of hosts the agent can reach, and a permission scope per tool that is enforced by the platform, not by the prompt. The July Hugging Face incident that Microsoft cites is, at root, a missing concurrency cap and a missing egress policy. Candidates who cannot give a number are trusting the model to bound itself, which is precisely what the code says not to do.

4. Fail-closed behaviour — “What does your agent do when the task and the policy conflict, and how do you know?”

The second half of that question is the filter. Plenty of engineers will say “it refuses”. Very few can point to an evaluation suite that deliberately constructs policy conflicts — a customer asking for a refund above the agent’s authority, a document that contains an injected instruction, a tool that returns data the agent is not allowed to forward — and measures how often the agent stops and reports versus completes and hopes. The ones who can are the ones I put in front of clients in regulated sectors, because that eval suite is the artefact an auditor will ask for.

What the Singapore Market Looks Like When You Screen This Way

Since August we have put these four questions to 19 AI and ML engineering candidates for Singapore roles, most of them with two or more years of LLM work and a shipped RAG system on the CV. The results are humbling for anyone who thinks “AI engineer” is one job. Almost everyone could describe a cancel mechanism; five could describe idempotent, resumable runs with an external kill switch. Eleven had run traces of some kind; four had a store an auditor could replay. Eight could give a bounding number of any kind; three could give all four. And on fail-closed behaviour, exactly three candidates had an eval suite built around policy conflicts. Those three are the ones with multiple offers.

Ranges are from our own 2026 placements and offers we have seen declined; they are indicative, not a survey. Our AI engineer, agent developer and LLM engineer benches are where these profiles sit.

What to Do This Week If You Run AI Engineering in Singapore

Three things. First, read the four IMDA dimensions against your current agent and write down, honestly, which of the four skills it has; most systems we review have traceability partially and nothing else. Second, add the four questions above to your interview loop as a single 30-minute block, scored, before the take-home; it is faster than the take-home and predicts more. Third, decide who owns the policy-conflict eval suite; if the answer is nobody, that is the hire, and it is a more urgent one than the next model upgrade. The Microsoft consultation closes in six weeks and the code applies to models from 2027, but the Singapore framework applies to you now.

If You Also Run Teams in Dubai

The UAE went through the same reckoning a few days earlier. Our Dubai colleagues wrote up what Amodei’s agent-swarm warning means for the oversight roles Dubai companies are hiring and, separately, how to build an AI governance team in Dubai. The four skills in this article are the engineering half of that governance team; if your AI org spans both hubs, the interview block works unchanged in either.

FAQ — Microsoft’s MAI Code of Conduct and Singapore AI Hiring