Nadella named the trap. To make a model useful you feed it the knowledge that makes you unique, and it leaks back one correction at a time. His fix is a trust boundary you own. Here is where that boundary lives in your stack, and what governs the meaning inside it.
"You essentially pay for intelligence twice, once with money, and again with something even more valuable: the proprietary knowledge you must reveal to make that intelligence useful."Satya Nadella, CEO of Microsoft. July 2026
The classic problem exposed the seller. AI moves the exposure to the buyer, and it compounds every time you use what you bought.
In 1962 Kenneth Arrow described a problem at the heart of any market for information. Its value to the buyer is not known until the seller reveals it, but once revealed the buyer has it for free. The seller is the one at risk. Patents and NDAs exist to let an inventor show an idea without giving it away.
Nadella’s argument is that AI flips the vulnerability. Now the buyer is exposed. To make a model useful on your work you have to feed it the proprietary knowledge that makes your work valuable, and the better you want it to perform, the more of that knowledge you hand over. You pay once in cash and again in the context you reveal. Over time the asymmetry widens: the provider learns more about you with every session, while you learn almost nothing about what it takes in return.
The leak is not a single document walking out the door. It is diffuse. Models learn from what Nadella calls exhaust: the prompts your people write, the tools your agents call, and especially the corrections your experts make when the answer is wrong. Each correction is a small piece of institutional judgment, the kind a competitor could never buy, distilled into a rented system trace by trace and eval by eval.
"In consuming intelligence, you are creating intelligence. And what you create should belong to you."
Satya Nadella, CEO of MicrosoftHis prescription is not more data protection. It is a trust boundary: a hard line inside the enterprise across which nothing crosses without consent, not prompts, not traces, not evals, not adapted weights, not memory. Inside that boundary an organization’s data and learning are supposed to accumulate and compound as an owned asset. That is the right idea.
The practical question he leaves open is where the boundary sits in a real stack, and what governs the meaning of the data inside it so an agent gives the same answer your business would. That is an architectural requirement, not a policy. The sections below take his five tests, Control, Capability, Choice, Cost, and Compound, and show what each demands in practice.
Every prompt, tool call, and correction is training data. In consuming intelligence, you create it, and by default someone else keeps it.
Think about what a good AI answer requires from you. Not just a question, but the context that makes the question answerable: how your business defines its terms, which system is authoritative for which number, the historical exceptions that only live in your team’s heads. Nadella’s point is that this context is the asset, and the model needs it to be useful. You cannot get the value without revealing the thing that creates the value.
The corrections are the sharpest example. When a senior analyst tells the model "no, revenue here means net of returns for the fiscal quarter ending March 31," that is not a prompt. It is a piece of your operating knowledge, the product of years of judgment, handed to a system in a form it can absorb. Multiply that across six thousand employees and a year of usage, and you have transferred a meaningful part of how your company thinks, without a line item ever appearing on an invoice.
This is why the problem is easy to miss. A single confidential file leaving the building triggers alarms. Ten thousand small corrections, each individually trivial, do not. They leave as ordinary usage, and the aggregate is a map of your judgment. If your knowledge is only ever expressed as corrections to a model you do not control, then your most valuable context has no home you own. It exists as weights and history on someone else’s infrastructure, and the moment terms change, it does not come with you.
If your corrections train a model you rent, the knowledge ends up on someone else’s infrastructure. If they govern a layer you own, the model is just a processor, swappable on day one.
Nadella’s fifth test is the point of the other four: bring them together and the learning loop hill-climbs inside a boundary the firm owns.
Nadella describes the goal as a "hill climbing machine", a system where every workflow that runs deepens the organization’s knowledge, making the next one better, cheaper, and more accurate. The question is not whether that loop exists. With any real AI usage, it does. The question is who it compounds for.
Most enterprise AI deployments compound in the wrong place. Each query goes to the model, and what it reveals about your data, terminology, and edge cases is retained by the provider, not by you. Your side of the ledger is as naive on day 500 as it was on day one, because nothing durable was kept inside your boundary.
Compounding for the firm requires that each interaction leaves something behind on your side: an output that refines your own understanding of what your data means. That refinement has to live somewhere persistent, versioned, and queryable, in code you control. It has to be structural, not just conversational, or it evaporates into a rented model the moment the session ends.
Each system connected, definition governed, and cross-system conflict resolved makes the semantic layer richer, and every subsequent request cheaper and more accurate, without growing model costs.
Fair use lets providers train on public data. The status quo then restricts what you can do with your own usage. That imbalance decides who compounds.
Nadella flags an irony worth sitting with. The industry won broad rights to train on public data as fair use, which enabled the current generation of models. The same regime then turns around and imposes restrictive terms on distillation while reserving the right to learn from customer usage and interaction data. Learning is permitted in one direction and constrained in the other, and direction is what determines where value accrues.
This is not abstract. In 2026 OpenAI began closing self-serve fine-tuning: no new organizations, and an end to new fine-tuning job creation for existing customers by January 2027. Whatever the business reasons, the practical effect for a buyer is that the ability to shape a model on your own data can be narrowed on a timeline you do not set. If your institutional knowledge only exists as adaptations inside that provider, your leverage erodes exactly as your dependence grows.
This is the test every enterprise should run, and it is the one your own teams already worry about. If any single model you rely on were taken away tomorrow, could you still operate and still hit your evals using another? Does the capability your organization built, the veteran, stay with you, or does it leave with the generalist? If the honest answer is that it leaves, you do not own your learning loop. You are renting it.
Every re-query with raw organizational context is a training signal you donate. LazyFox abstracts your data at indexing, so your actual business data never reaches a model, at setup or after.
Nadella’s defense is to keep the definitions of "good" on your side: private evals that run against your real internal outcomes, plus ownership of your memory, traces, and the right to use model outputs from your own tasks. But leakage is not the only failure that ownership has to catch. There is a quieter one.
Semantic drift. The model’s understanding of a term diverges from what the term really means, and no one notices until the outputs are wrong in ways that are hard to trace. "Revenue" in the CRM is not "revenue" in the ERP is not "revenue" in the board deck. Without a governance layer, the model reconciles the three implicitly, picking the most statistically frequent interpretation and running with it. The board deck, the CRM, and the warehouse all cite "the AI." None looks wrong. All of them conflict.
"What the technical customers want is control over their compute, their models, their data stack, and their alpha. They want to know they own the means of production, and it’s not being transferred to someone else."
Alex Karp, Palantir, quoted in Nadella’s essayThis is where LazyFox’s architecture earns its place. Definitions versioned and governed outside the model make drift measurable: which term is diverging, and in which system. When a schema change in SAP alters the data feeding a metric, LazyFox detects the divergence and re-enriches only the affected slice. The evals, the definitions, and the corrections stay yours, which is the whole point of a boundary.
Nadella’s Choice test: if any one model were taken away, could you still operate and optimize for your evals using another? That requires decoupling meaning from the model.
The way to keep the model interchangeable is to move the layer that holds your meaning out of the model entirely. Definitions, evals, and context become governed artifacts you own, and models become engines that run against them. When that layer also reconciles across systems, the same query returns one governed answer regardless of which model is cheapest and best that week. That is Choice and Cost in Nadella’s terms: no single provider can hold your operations hostage.
Most RAG implementations retrieve from one system at a time. A user gets context from the CRM, or from the data warehouse, or from the documentation repo, but not a semantically reconciled view across all three at once. When the same concept exists in multiple systems with different definitions, the model sees the inconsistency and resolves it in-context, usually incorrectly, always expensively, and always in a way you cannot audit later.
The problem is not retrieval. The same term ("revenue," "customer," "open," "qualified") means something different in each system, and each of those differences is load-bearing. Finance recognizes revenue when the deal closes. Sales books it when the contract is signed. Both are correct for their purposes. The conflict is real and structural, and resolving it once, in a layer you own, is what lets you swap the model underneath without re-litigating what your numbers mean.
LazyFox reconciles meaning across all connected systems simultaneously at runtime, sitting above the data stack without requiring migration, and resolving definitional conflicts inside the boundary before any query reaches a model.
This is the "queryable institutional memory" Nadella describes. Not retrieval from a single system, and not retrieval from several with conflicts left in the output. The contextual layer resolves the definitional conflict inside the boundary, so what runs against any model is a governed, consistent, abstracted query: one answer, by context, versioned, auditable, and independent of which model produced it.
Separate what you already own from what you are quietly renting. Five questions do most of the work.
Score these separately from model quality. A better model does not answer any of them. The layer that does is the one that decides whether you are using a model, or paying it in the knowledge that makes you unique.
In the cloud era enterprises accumulated data. In the AI era they accumulate learning. The boundary has to evolve from protecting information to protecting the mechanism that learns.
Nadella is right that in the AI era enterprises accumulate learning, not just data, and that the trust boundary has to protect the mechanism through which a company learns, adapts, and compounds intelligence. If learning flows in only one direction, value converges toward the owners of the learning infrastructure rather than the creators of the knowledge. That is the trajectory the current regime is on, and it is already visible.
The part left to you is implementation. A trust boundary is only real when it is a layer you own: one that governs meaning, indexes context once, and keeps your definitions and evals as company assets while the models underneath stay interchangeable. A clause in a contract does not do this. A layer does.
"In the cloud era, enterprises accumulated data. In the AI era, they accumulate learning. The trust boundary must evolve accordingly."
Satya Nadella, CEO of MicrosoftLazyFox is built to be exactly this layer: a semantic governance layer that sits above a company’s existing data stack, encodes institutional knowledge in a form the organization owns and controls, and makes it compound with each use without ever requiring it to leave their infrastructure. Your data is indexed once and abstracted with probabilistic methods, so your actual business data never reaches a model. Every request runs from governed code. Cross-system conflicts are resolved inside the boundary before any query goes out. Semantic drift is detected before it propagates into outputs. The model executes. Your data and the meaning stay inside.
That is the difference between using a model and giving up the knowledge that makes you unique. It is also the reverse information paradox, answered: you can consume intelligence without handing over the intelligence you create.
"A company should be able to use a model without giving up the knowledge that makes it unique. That is the reverse information paradox we need to confront."Satya Nadella, CEO of Microsoft. July 2026
This post takes Nadella's claim that the learning loop is the IP and turns it around: if the loop that learns from proprietary knowledge is where the value accrues, an enterprise that lets AI train on its data without governed context is handing that value to the vendor, not keeping it.
A governed semantic layer is what lets an enterprise keep the benefit of that learning loop — deterministic, audited, and portable across models — instead of ceding it.
LazyFox holds your definitions, evals, and context inside a boundary you control, indexed once from your existing stack, while the model underneath stays interchangeable. It connects read-only. Nothing migrates.