Satya Nadella just named something every architect should pin to the wall. Kenneth Arrow’s old information paradox said a seller can’t prove information’s worth without revealing it — disclose, and you’ve given it away. AI inverts it: now the buyer leaks. To get real value from a model you feed it your proprietary context, and the vendor learns more about you than you learn from it.
You pay for AI twice. Once with money. The second time, the expensive one, with your company’s knowledge.
— Satya Nadella, The Reverse Information Paradox
He structures the defense as five C’s — Control, Capability, Choice, Cost, Compound — and the fifth is the whole point: fold the other four into a learning loop the firm owns, not the vendor. The leak he’s worried about isn’t a data breach. It’s intelligence exhaust — the prompts you write, the tools your agents call, and above all the corrections your experts make when the model is wrong, distilled trace by trace into institutional know-how that quietly walks out the door.
Only two of the five are things you can engineer#
He’s right, and I’d push it one step further: this isn’t a strategy-slide problem, it’s an architecture problem — and most enterprises are already built to leak. Of the five C’s, Control and Choice are the ones you actually build, and they live at two concrete places in your stack.
Choice lives at the gateway#
If your primary model vanished tomorrow, could you still operate and hit your quality bar on another one? That’s a design question, not a procurement one. It’s why I put a gateway in front of every model — APIM as an AI gateway or a LiteLLM proxy — so orchestration is decoupled from any single provider.
Honest caveat, though: swapping models is never free. Prompts, tool schemas, and eval sets are model-coupled; a gateway buys you the option to switch, but you still re-tune. The real version of Choice is “portable evals plus a gateway,” not swap-models-like-light-bulbs.
Control lives at the eval and trace store#
The corrections and evaluation sets that encode what “good” means for your domain are the asset — so they belong inside your tenant boundary, not uploaded to someone else’s cloud. I made this exact argument last week about Foundry: adopt the portable, ownable pieces (identity, an open control spec, your own eval loop) and keep the rest at arm’s length. Back it with a keyless, managed-identity footprint so the boundary is enforced, not merely contractual.
The catch worth naming#
The soundest advice about not leaking your knowledge comes from the vendor that benefits most from you feeding it. That doesn’t make it wrong — it makes it non-negotiable no matter who’s selling. In the cloud era enterprises accumulated data. In the AI era they accumulate learning, and Nadella’s sharpest line is that if that learning flows in only one direction, the economic value converges on whoever owns the learning infrastructure.
A company should be able to use a model without giving up the knowledge that makes it unique.
— Satya Nadella
The load-bearing word there is should. By default you don’t get that — you give the knowledge up just by using the model, one correction at a time. Ownership is something you have to architect back in.
The takeaway#
Treat Control and Choice as build decisions you make before the first agent ships:
- A gateway you route every model call through — so Choice is real, not aspirational.
- An eval and trace store you own inside your tenant — so every correction compounds for you, not the vendor.
Compound isn’t a slide. It’s what those two turn into when you wire them in early.
Original post: Satya Nadella, The Reverse Information Paradox — X, July 12, 2026.