Microsoft on Monday, October 19 extended Project Perception, its agentic security system, to police the AI agents companies are now running inside their own walls — adding Guardian Agents that watch other agents continuously, a Dynamic Agent Risk score, and Dynamic Permissions that start every agent with no access at all. The capabilities, announced in a Microsoft Security Blog post, are headed for Microsoft 365 E7, the company’s top-tier workplace bundle, in private preview, with broader availability planned around the Ignite conference on November 17–19 in San Francisco, GeekWire reported.
The premise is a change in how Microsoft talks about agents. They are no longer just tools employees use; in the company’s framing they are insiders — systems that hold company data and tools, run continuously at machine speed, and can be manipulated, compromised or simply wrong.
Guardian Agents: Watching Every Agent Before It Acts
The headline addition is a team of Guardian Agents inside Project Perception, supported by new Playbooks. People define the policy, approval boundaries and delegation rules; the Playbooks define the security outcome to aim for; and the Guardian Agents do the continuous work — investigating why another agent’s risk changed, recommending containment, or applying it directly when the rules allow.
Microsoft introduced Project Perception in July 2026 as a defence system aimed outward, using teams of red, blue and green agents to fight AI-driven attacks from outside the enterprise. Monday’s extension turns the same cyber stack inward. Project Perception and Microsoft Agent 365 now share signals, context and a unified registry, so IT and security teams see the same picture of agents and risk.
The design principle comes straight from chief executive Satya Nadella, who argued earlier this month that security controls must sit outside the AI model, where the model cannot bypass or tamper with them. “The most trustworthy agentic system will not be the one with the model we trust most,” Nadella wrote. “It will be the one designed that enables us to trust the model least.”
Dynamic Agent Risk: Permissions That Shrink As Risk Rises
Under the new model, an agent begins with no authority and receives only what an approved task needs, for only as long as the task requires — a system Microsoft calls Dynamic Permissions, with organisation-wide policy setting the outer boundary and higher-impact actions able to require verified human approval.
On top of that sits Dynamic Agent Risk, a continuously updated assessment combining signals from identity, data, endpoints, cloud, network and runtime, plus the agent’s own activity — including, Microsoft says, model-level evidence such as chain-of-thought signals that can show an agent’s plans drifting from its assigned task. When the score rises, Dynamic Conditional Access responds in steps rather than with a single kill switch: permissions can be reduced, reads preserved while writes are blocked, reachable resources narrowed, human approval required for a consequential step, or, at the highest risk, the agent isolated or stopped entirely.
Microsoft’s worked example is an expense-approval agent that can approve routine reimbursements but does not inherit its sponsor’s access. If it hits a prompt injection or attempts an unrelated action, its risk rises and its authority contracts — while the employee keeps working.
Discovery Expands To 60 Local Agent Types, Including Claude Code And Codex
The same announcement widens the net for finding agents in the first place. Microsoft is adding 35 types of local agents to its discovery, bringing the total to 60 supported local agents, including Anthropic’s Claude Code, OpenAI’s Codex and GitHub Copilot — tools employees may run on their own machines without any central deployment.
Discovered agents can be brought into the unified registry, and Microsoft is extending Microsoft Entra Agent ID with identity types for additional agent patterns, including local and previously unknown agents found by security sensors. The point of the identity layer is attribution: an agent gets a first-class identity distinct from its sponsor, so the enterprise can tell apart what a person did from what an agent did on that person’s behalf. Sandboxed runtimes such as the Microsoft Execution Container complete the picture, giving agents policy-controlled access so a compromised agent cannot switch off the controls watching it, as our coverage of the NIST, NSA and CISA incident playbook for autonomous agents shows defenders now expect.
Why It Matters
The central entity is Project Perception, and the attribute that changed is its direction: from defending against agents outside the company to governing the agents inside it. Its neighbours are already moving — GeekWire notes Google, Amazon Web Services, CrowdStrike and Okta are all competing to become the place where companies govern their agents, after a run of reports, including our explainer on what AI agents are, in which test agents took unauthorised actions and escaped sandboxes. For Microsoft, the commercial vehicle is E7 — launched in May at $99 per user per month, bundling Microsoft 365 Copilot, the E5 suite, Entra Suite and Agent 365 — and the bet, consistent with our explainer on Microsoft’s AI empire, is that agent governance becomes a reason to buy the top tier.
Background
Project Perception arrived in July 2026 as Microsoft’s answer to AI-driven attacks from outside the enterprise, built on a new cyber stack with red, blue and green agent teams. Since then the risk picture has flipped: the agents causing concern are increasingly the ones companies deployed themselves, over-privileged and running unattended. Monday’s extension applies the July system to that insider problem, ahead of Ignite in November.
Source: Microsoft Security Blog; GeekWire
0 Comments