Microsoft Guardian Agents Treat Enterprise AI Agents as Insiders

Microsoft has redrawn the boundary of enterprise AI security. On October 19, 2026, the company announced an expansion of Project Perception that treats the AI agents running inside a company as insiders in their own right, rather than as tools that can be trusted because they were deployed by the business itself. The announcement arrived in two posts from Microsoft security leaders, one by Hayete Gallot, executive vice president of Microsoft Security, and one by Nadim Abdo, corporate vice president for identity and network access, according to coverage of the launch.

The shift matters because it changes the question security teams ask. Instead of asking whether an agent was approved, the new model asks what the agent is doing right now, what it can touch, and how quickly its permissions should shrink when its behaviour changes. Microsoft describes the principle plainly: an agent should begin with no authority and receive only what its approved task requires, for the duration of that task.

Project Perception began in July 2026 as a system for defending against AI-driven attacks from outside the enterprise, using teams of red, blue and green agents. The October expansion turns that machinery inward, to the agents employees already run on company machines and in company cloud services. According to Microsoft, Project Perception and Microsoft Agent 365 now share signals, context and a unified registry, so IT and security teams see the same picture of agents and their risk.

What Microsoft Guardian Agents actually do

The centrepiece of the announcement is Microsoft Guardian Agents, security agents that supervise other agents continuously. According to Microsoft, Guardian Agents investigate when an agent's risk changes and help contain risky behaviour, while people keep control of policy and approval boundaries. The idea is supervision before damage, not an audit after it.

Discovery comes first. Microsoft Defender can now recognise 60 types of local agents running on company devices, up from 25 after 35 types were added, including Claude Code, OpenAI Codex and GitHub Copilot, according to reports on the announcement. An organisation cannot govern an agent it does not know is running, and much of the agent population in large companies arrived through individual employees rather than through a central deployment.

Each discovered agent receives its own identity through Microsoft Entra Agent ID, separate from the identity of the person who launched it. The extension announced in October covers local and previously unknown agents, closing a gap in which an agent borrowed the authority of its user. With its own identity, an agent can be given narrow permissions, watched individually and shut down without touching the employee's access.

Three dynamic controls sit on top of that identity. Dynamic Permissions scope access to one task and one time window. Dynamic Agent Risk maintains a continuously updated score built from identity, data, endpoint, cloud, network and runtime signals, together with the agent's own activity. Dynamic Conditional Access then turns that score into graduated action: an agent might keep read access, lose write access, need human approval for high-impact actions, or be shut down entirely. The Microsoft Execution Container provides a sandbox for agent execution, with monitoring placed outside the agent's reach.

Why the insider framing changes agent governance

Microsoft's argument for the insider framing rests on how agents fail. According to Gallot, agents do not have to be hacked to cause problems. Agents can be manipulated by content they read, make mistakes in multi-step work, or change course as a situation shifts, and they can do all of it continuously at machine speed. A mistake that would take a person an afternoon can be repeated by an agent hundreds of times before anyone notices.

Abdo's example makes the mechanism concrete. An expense-approval agent reads an outside document carrying a planted instruction, and its risk score rises. The system then lets the agent keep reading while stopping it from approving or changing anything until a person signs off. The response is proportional rather than binary, which matters for adoption: a security model that kills every agent at the first sign of risk would simply be switched off by frustrated teams.

The framing also reframes accountability. When an agent acts under an employee's credentials, a bad action looks like an employee's mistake and is investigated as one. When the agent has its own identity, its own task-scoped permissions and its own risk trail, the organisation can ask a sharper question: which task was approved, what did the agent actually do, and where did the control fail. That trail is what makes the difference between blaming a user and fixing a system.

The announcement lands in a crowded week for agent governance. ServiceNow and Nvidia recently expanded governed agent services for enterprises, and banks have begun blocking agents that act beyond customer instructions, as reported in recent coverage of the sector. Microsoft's move is distinctive because it starts from the endpoint and the identity layer, where agents actually run, rather than from a policy document.

What remains unproven

Analysts note that the announcement describes an intended design rather than independently measured security results. According to Futurum Group, the principle is sound, but the harder test is authorisation across agents that work for a person, arrive with an application, or are built in-house, and coverage is strongest for endpoint and in-house agents. Mapping a person's intent to a precise set of permissions relocates the hardest question rather than answering it.

Guardian Agents themselves raise a second-order question: who supervises the supervisors. Microsoft says people set the policies and approval boundaries, but the details of how Guardian Agents are themselves audited, and what is in preview versus generally available, were left for Microsoft Ignite to fill in. Enterprises evaluating the system should ask for those specifics, including pricing and availability in the Microsoft 365 E7 tier, before treating the announcement as a deployed control.

Still, the direction of travel is clear. Agent governance is moving from periodic model reviews to live operational control over what agents do and can do. Treating agents as insiders does not mean distrusting every agent; it means giving each agent an identity, a narrow job and a watchful counterpart, and letting the evidence of its behaviour decide how much trust it keeps. That is a model other vendors will now have to answer, whether they build it themselves or borrow it.

Sources: reporting on the announcement by Unite.AI, analysis by Futurum Group, and coverage by Equitypandit. Related coverage includes governed AI agent services from ServiceNow and Nvidia and banks blocking agents that act beyond customer instructions.