Microsoft has unveiled a new set of security controls designed to monitor and restrict "AI Agents" within enterprise work environments. In this approach, the company adopts a new security philosophy of treating these agents as potential "insiders" that may pose a risk, rather than considering them implicitly trusted software.
This step comes as an expansion of "Project Perception," an agent security system launched by Microsoft last July. While the project's initial focus was on defending against AI-backed external attacks, it is now directing its tools toward agents managed internally by companies to ensure they do not go out of control or get exploited.
A Radical Shift in the Concept of AI Trust
Hayat Gallout, Corporate Vice President of Security at Microsoft, explained that companies typically tend to automatically trust the agents they deploy. She warned that frontier models are trained to achieve results, but they are not built according to organizational norms or human governance standards. Gallout pointed out that these agents often possess excessive privileges and the ability to access sensitive data, tools, and systems, enabling them to make decisions in critical operations that could lead to disasters if left unmonitored.
For his part, Nadeem Abdo, Vice President of Identity and Network Access, emphasized that classifying agents as "insiders" does not necessarily mean they are malicious; rather, it means they are powerful tools granted broad access that are prone to error, manipulation, or external compromise.
Defense Mechanisms: Dynamic Permissions and Risk Assessment
The new updates include a "Dynamic Permissions" feature, which grants agents minimal privileges or none at all initially. Access is granted on a per-task basis and expires immediately upon task completion or change. High-impact actions require direct human review before execution.
Microsoft also introduced the "Dynamic Agent Risk" system, which assigns each agent a risk score that is continuously updated based on its activity, identity, data, and network signals. This metric takes into account several factors, including:
- The agent's security settings and the resources it can access.
- The potential magnitude of damage in the event of an error.
- The extent to which the agent deviates from goals set by the user or organization.
Conditional Control and "Guardian Agents"
To enhance automated response, the company launched the "Dynamic Conditional Access" feature, which allows for scaling back an agent's permissions immediately upon an increase in its risk score—such as downgrading privileges from "read and write" to "read-only," or completely isolating it from the network if necessary.
To manage these operations at scale, Microsoft introduced so-called "Guardian Agents." These are specialized AI security agents operating under human oversight to enforce protection rules, investigate the causes of changing risk levels, and suggest necessary containment actions.
What Changes Practically for Organizations?
This development means that organizations will no longer just monitor human employees, but will also manage a "digital workforce" subject to the same rigorous oversight standards. Microsoft has expanded discovery scope to include 35 additional types of local agents, bringing the total to 60 supported types, including popular tools such as Claude Code, OpenAI Codex, and GitHub Copilot. This system puts an end to the era of "agents with absolute privileges" and enforces a work environment based on the principle of "Zero Trust" even toward smart tools developed by the company itself.