Every correction you make to an AI system contains a lesson. The question Satya Nadella raised this week is who captures it, who can reuse it, and who gets to keep it.
In a long post on X, Nadella reached back to Kenneth Arrow's information paradox. Arrow observed that a buyer cannot value information without seeing it, and once they have seen it, they may no longer need to buy it. The seller carries the risk. Patent protection is one conventional response to that tension, letting an inventor disclose an idea without immediately surrendering its commercial value.
Nadella argues that AI flips the paradox. Now the buyer carries the risk. To get value from a model, you have to feed it your context: your prompts, your workflows, your standards, and your corrections. The better you want it to perform, the more you reveal. You pay once with money and again with proprietary knowledge, and the second payment may be the larger one. As he puts it, "In consuming intelligence, you are creating intelligence." His conclusion is that what you create should belong to you.
He is naming something real from a very particular seat. My practitioner's edit is simple: own the learning loop, not necessarily the model. Keep your judgment in portable artifacts that can survive any vendor, runtime, or set of weights.
The learning exhaust is the asset
The sharpest part of Nadella's post is not the Arrow framing. It is the observation about the less visible asset created around the work. That asset is not only the document or database you upload. It is the learning exhaust: the prompts people write, the tools agents call, the eval results they produce, and especially the corrections humans make when a system misses.
Those interactions do not automatically retrain a governed enterprise model. But when someone captures and reuses them, they become a compact record of institutional judgment, the kind of knowledge a competitor could never buy and an employee handbook could never fully capture.
Generated code can be disposable exhaust. Learning exhaust is different. It records what the organization discovered about what good looks like.
The learning exhaust is not a byproduct of the work. It is the work, compressed.
I have been circling this from the builder's side for months without using Nadella's vocabulary. The Context Spine, the idea that a versioned spec should travel through the pipeline as the durable artifact, is a learning-loop ownership argument. So is the claim that the spec is the product. When my reviewer agent rejects a pull request against my coding standards document, that rejection encodes a judgment I spent years earning. That standards document is sixteen major versions deep, and every version is a correction I made and kept.
The uncomfortable question Nadella poses is what happens when those lessons remain trapped in someone else's system, whether or not they train the underlying model. If your accumulated context, evals, traces, and corrections can improve only a vendor-hosted experience, while you cannot export or replay them elsewhere, the asymmetry still compounds in one direction.
His phrase for the fix is a trust boundary: a hard perimeter inside which your data, evals, adapted weights, and organizational memory accumulate together. Nothing crosses it without consent. That boundary matters. But the durable asset inside it is not primarily the weight. It is the set of artifacts that encode how your organization judges.
The five C's, read from the engine room
Nadella closes with a framework: Control, Capability, Choice, Cost, and Compound. Frameworks from CEOs usually dissolve on contact with an actual engineering organization. This one mostly survives, so it is worth walking through with a practitioner's eye.
Control means owning your evals and your organizational memory, because evals define what good looks like inside your walls. This is the strongest of the five, and it costs the least. An eval is encoded judgment. If you run a platform organization and cannot state, in executable form, what a good deployment, a good pull request, or a good incident response looks like, that gap existed before AI. AI just made it expensive.
Capability means building learning environments inside your tenant boundary where models can adapt against real workflows. More on this one in the skeptic's section, because it is where the framework and the median enterprise part ways.
Choice is the question I would put on every AI vendor review from now on. If the model you depend on vanished tomorrow, would your capability survive, or was it living in the vendor's weights? I do not have to imagine this test. A government directive forced Anthropic's newest models offline in June. The shutdown was temporary, but temporary was enough to make the dependency visible. The organizations best positioned to adapt were the ones that kept their judgment in specs, standards, and gates rather than in a particular model's behavior. Portability got them out. Verification got them out safely.
Cost follows from Choice. A decoupled orchestration layer lets you route work to the cheapest model that clears your quality bar. That only works if the bar exists independently of any model. I spent June itemizing exactly this: the subsidy math works in your favor only when you can measure verified outcomes rather than tokens.
Compound is the payoff claim. Wire the first four together and you get a continuous learning loop that appreciates. This is the right ambition, and it is also where I want to slow the sales pitch down.
The skeptic's section
Consider the incentive. Nadella leads one of the world's largest AI infrastructure vendors, and his prescription naturally expands the role of enterprise learning infrastructure. The post also takes a clean shot at frontier labs that train on public data under fair use, then restrict distillation of their outputs. That critique is fair, and it is convenient for Microsoft's competitive position. Neither point makes the argument wrong. They do mean we should separate the durable principle from the product architecture that happens to benefit Microsoft.
Three edits from the engine room.
First, the leakage claim overstates the mechanics of governed enterprise use. OpenAI, Anthropic, Google Cloud, and Microsoft all state that business customer inputs and outputs are not used to train shared or foundation models by default, or without permission. Consumer products and unmanaged accounts are a different story. Retention, logging, abuse monitoring, feedback settings, and product-specific exceptions still matter.
For most governed enterprises, the larger strategic risk is that accumulated context, prompts, evals, and workflow adaptations cannot leave with them. That is more often a dependency problem than a theft problem, and the remedies differ. You do not solve dependency only with a bigger wall. You solve it with portable artifacts. No-training terms keep customer data out of shared-model training; portable artifacts protect choice; evals and standards let the learning compound.
Second, the Capability pillar assumes an organization that should operate a proprietary tuning loop. Some should. Most should not. Building one means owning eval infrastructure, data pipelines, model operations, and the specialists who keep all three honest. For most enterprises, owning the evals, prompts, traces, specs, and correction history captures most of the durable value without turning model training into a new platform business. The learning exhaust matters more than the engine.
Third, the framework quietly assumes the hard part is infrastructure. It is not. The hard part is having judgment worth compounding. An organization that cannot articulate its standards gains nothing from a private learning loop, because the loop has nothing useful to learn from. Gates beat actors only when someone has done the unglamorous work of encoding what the gate should check. Nadella quotes Alex Karp saying technical customers want "control over their compute, their models, their data stack, and their alpha." True. But most organizations have not yet written their alpha down. That is the bottleneck, and it is not the stack.
What I would do Monday morning
Three moves, none of which require a platform purchase.
Inventory your learning exhaust. Find out where your prompts, agent traces, corrections, and eval results actually live today. In most organizations, the honest answer is scattered across individual laptops, chat histories, source repositories, and vendor dashboards they do not control. You cannot own what you cannot locate.
Write your first private eval this week. Skip the framework and the program. Write one executable definition of what good looks like for one workflow that matters. My reviewer gate started as exactly this: a single checklist that hardened into an agent. Evals compound the same way standards documents do, one earned correction at a time.
Put a portability test in every AI vendor review. Ask one question: if we walked away in ninety days, what walks with us? Score the answer in artifacts, not assurances. Specs, evals, prompts, traces, and correction histories in formats you can export are stronger than assurances alone. Contracts still matter, but portable artifacts make the promise operational.
Keep your own lessons
Nadella is right that, in the AI era, enterprises accumulate learning the way they once accumulated data, and that the boundary protecting it has to evolve. Where I would sharpen his conclusion is on what sits inside that boundary. The answer is not primarily weights or infrastructure. It is judgment, written down in forms that survive any vendor: specs, standards, evals, and the corrections that improve them.
A company should be able to use a model without giving up what makes it unique. It turns out the way to do that is the same discipline that was always required. The bottleneck was never the stack, and it is not the model either. It is the ability to turn judgment into portable, executable artifacts. The learning loop compounds for whoever writes the lesson down in a form the next model can use.
