Microsoft's added question for edge deployments is operational: before releasing weights, keys, or data, what evidence shows the runtime and loaded components can be trusted [6]. That is a key-release policy, not a checklist item. Something has to measure the hardware and firmware, emit a statement about what is loaded, and a relying party has to evaluate that statement before any weights land on the box.
On a connected device the relying party can sit in a cloud. Microsoft rules that out for the disconnected case, where there is no live detection, no policy push, and no revocation [8]. Verification and enforcement then run on the same device an attacker may be holding, with physical access, local access to model artifacts, and the option of tampering with retrieval data or tool configurations [7]. Which is why the guidance ends where hardware ends: risky operations should run only where hardware can protect assets and provide acceptable evidence, and otherwise be deferred or revalidated [9].
Two of the four recommended controls do less than their names suggest. Microsoft says origin signatures prove where data came from but not that the content is safe for a model to interpret [10], so a poisoned retrieval document with a valid signature still parses. Code signing does not reach the problem either, because the context window is itself an instruction surface and signed binaries and code integrity checks were not designed for prompt injection [11]. Mediation carries the load: constrain what the model is permitted to do, since you cannot constrain what it can be told. Nondeterminism removes the usual fallback of testing inputs against expected outputs, since Microsoft notes the same input may produce different outputs [12].
The recommendations add up to eight items, four changes and four actions [14], and every one of them is architectural rather than a patch. Attestation, artifact provenance, action mediation, and binding assets to trusted environments are architecture decided at procurement, and the hardware clause makes that explicit [5][9].
The post cites no CVE, no named product, no described incident, and no measured rate of model theft or firmware tampering at the edge [16]. It also does not price the transfer, and no deadline attaches to any of it. The consequence is contractual rather than urgent. Microsoft's own framing has the provider's models running on customer-owned infrastructure while the customer protects the systems, data, and models in that environment, with both parties sharing the risk [4]. A customer who signs for on-premises inference without an attestation and key-release design has agreed to hold someone else's weights on hardware neither side can prove clean.
