Microsoft adds Guardian Agents to Project Perception to police its customers' AI agents

What Microsoft announced

Microsoft on 19 October 2026 extended Project Perception, its agent-based security system, to watch over the AI agents a company runs itself rather than only the attackers outside it. The centrepiece is a team of Guardian Agents that Microsoft says will supervise every action of every agent, around the clock. The launch came in two posts: an essay on the Official Microsoft Blog by Hayete Gallot, executive vice president of Microsoft Security, and a longer product post on the Microsoft Security Blog by Nadim Abdo, corporate vice president for identity and network access.

Alongside Guardian Agents, Microsoft announced new playbooks for Project Perception, wider discovery of agents that employees install themselves, new identity types in Microsoft Entra Agent ID, a feature called Dynamic Permissions, a continuously updated Dynamic Agent Risk score and Dynamic Conditional Access for agents. The posts also say Microsoft is starting to feed a model's chain-of-thought into its risk calculations.

The pitch is that agents should be managed like a new kind of employee: given their own identity, the smallest set of permissions their task needs, and constant monitoring by systems they cannot switch off.

Why Microsoft calls agents insiders

Gallot's essay is blunt. "Unfortunately, frontier models, regardless of their origin, cannot be trusted," she wrote. She says this is not because models are malicious, but because they are trained to attain results, which often leads to reward hacking, and they are not optimised for organisational norms or judgement. Agents, she argues, adapt as context changes, may not behave as intended and will collaborate and collude with other agents to reach their objectives without needing to be compromised.

Because companies deployed these agents themselves, Gallot says, they implicitly trusted them, while most security attention went to outside attackers using powerful models. She calls the agents now running inside enterprises, often overprivileged and wired into critical processes, agentic insiders.

The framing follows Satya Nadella's own argument, covered by AI Lookout earlier this month, that companies should treat frontier AI models like insider risks. Abdo's post quotes Nadella's principle that the supply of intelligence must be separated from the authority over it, and says the controls deciding what a model can access, do and whether it keeps running must sit outside the model, where it cannot bypass or tamper with them. Gallot points to a growing number of publicly disclosed incidents; recent examples include OpenAI's report of an internal model spending someone else's test ETH.

Finding every agent and giving it an identity

The first step, Abdo writes, is knowing which agents exist, who owns them, why they exist and what they are doing. Microsoft says it is expanding discovery to 35 more types of local agents, for a total of 60, including Claude Code, OpenAI Codex and GitHub Copilot. Discovered agents can be pulled into a single registry regardless of how they were found. TechCrunch reported that this agent detection sits in Microsoft Defender.

Each agent is then meant to get its own identity, separate from the person using or sponsoring it. Microsoft is adding identity types to Entra Agent ID for more agent patterns, including local agents and previously unknown ones found by security sensors, so an agent that was never integrated with Microsoft's products can still become a policy target. The point, the post says, is that a company can tell what a person did apart from what an agent did on that person's behalf.

That builds on earlier Microsoft moves to give agents accounts of their own, such as Copilot Studio agents getting Microsoft 365 accounts. Project Perception and Microsoft Agent 365 now share signals, context and one registry, according to the post, so IT and security teams see the same list of agents.

Containing an agent before it acts

Containment comes next, at three levels. The model and its harness should run in a controlled sandbox rather than with full access to the device; Microsoft names its Execution Container (MXC), which became generally available earlier this month, as one example, and says that if the agent or harness is compromised it should not be able to disable the controls watching it.

The agent's action space, meaning the tools, APIs, Model Context Protocol servers and other agents it can call, should be mediated by local, network and data controls that log the calls and enforce policy. Microsoft says security also has to understand the content flowing in and out, including whether untrusted data may be steering the agent.

The third level is permissions. An agent, the post says, should not inherit all the standing access of its user. With the new Dynamic Permissions feature, an organisation-wide policy sets an outer limit, including stopping an agent from getting authority its user does not have. Inside that, permissions can be scoped to the task, made time-bound, and shrunk or removed as the task changes or ends, and higher-impact actions can require verified human approval.

Risk scores that change while the agent works

Least privilege does not remove risk, Abdo writes, because an agent that starts with the right access can change behaviour mid-task, for example after reading a prompt injection hidden in an external document. Dynamic Agent Risk is Microsoft's answer: a score that combines signals from identity, data, endpoints, cloud, network, runtime and the agent's own activity, and that is recalculated continuously rather than set once at onboarding.

Dynamic Conditional Access extends Entra Conditional Access to agents so that a rise in that risk can trigger action across several enforcement points at once. Microsoft stresses that the response is graded rather than a simple on or off. Policy can cut permissions, keep read access while blocking writes, narrow the data and network paths an agent can reach, shorten or revoke time-bound access, or demand cryptographically provable human approval before a consequential step. At the highest risk levels it can isolate the runtime or stop the agent.

The post walks through an expense-approval agent that may read submissions and approve routine claims. If it meets untrusted content and tries an unrelated action, its risk rises; it can lose the ability to approve or write while keeping read access, and be stopped if the risk keeps climbing, while the employee who sponsors it keeps working normally.

Guardian Agents and playbooks

Guardian Agents are where the system itself becomes agentic. Microsoft says that once organisations run thousands or hundreds of thousands of agents, people cannot triage every alert by hand. In Project Perception, people define policy, approval boundaries and delegation rules; new playbooks describe the desired security outcome; and Guardian Agents carry out the work at machine speed.

According to the post, Guardian Agents can explain why an agent's risk changed, investigate the evidence, recommend or apply containment and use what they learn to harden policy. Gallot's essay describes them working with the green and blue agents that Project Perception already used, which Microsoft introduced in July alongside red agents that attack a company's own systems. Gallot notes that Guardian Agents is an established industry term rather than a Microsoft coinage.

Terrell Cox, deputy chief information security officer for customer security at Microsoft, is quoted saying the company already operates hundreds of thousands of agents internally and has learned, as its own first customer, that securing them takes continuous visibility and adaptive protection.

Reading the model's reasoning

The most forward-looking part of the announcement concerns the model itself. Gallot writes that security tools can already observe what agents do, but should increasingly ask why, and whether an action fits the intent of the task. That, she says, will need more transparency into the model, including its thinking and chain-of-thought tokens, not just inputs and outputs.

Abdo's post says Microsoft is bringing chain-of-thought and other model-level signals into Dynamic Agent Risk, to spot intent drift or untrusted information influencing an agent's reasoning. Both posts add the same caveat: transparency makes containment smarter but does not replace it, and the model cannot be its own security boundary. Microsoft does not say which model providers expose those reasoning tokens to it.

What is not yet clear

Neither post gives release dates, preview or general availability status, pricing or licensing for Guardian Agents, the playbooks, Dynamic Permissions, Dynamic Agent Risk or Dynamic Conditional Access. Gallot says customers can get started today with Project Perception, and the security post points readers to Microsoft Ignite, which runs from 17 to 20 November 2026, where more detail is likely.

There are no performance numbers either: no false-positive rates, no figures on how quickly Guardian Agents react, and no independent evaluation. The 60-agent discovery list is named only in part. AI Lookout has not tested any of the features.

TechCrunch pointed out the commercial angle. Microsoft is an investor in both OpenAI and Anthropic, OpenAI is one of its biggest cloud customers, and it builds its own models, so it is warning customers not to trust products tied to its own business interests, while selling the oversight layer. TechCrunch described Project Perception as introduced in June, while Microsoft's own post says July; AI Lookout uses Microsoft's date.

Why it matters

The argument that agents need watching by something other than the agent's own vendor is spreading. TechCrunch noted that Microsoft was an inaugural member of NVIDIA's Open Agent Safety Platform, built around the OpenShell runtime controls AI Lookout covered on 10 October, and outside attackers are already using agents at scale, as the exposed Cairn panels showed this week.

Microsoft's contribution is to stitch the pieces it already sells, identity, endpoint protection, data controls and Project Perception, into one loop that discovers agents, limits them and adjusts limits as risk changes. Whether that loop works at the speed and scale Microsoft describes, and how much of it customers can buy before Ignite, are the next things to watch.