Microsoft now treats AI agents as insiders: Project Perception gains Guardian Agents, 60 supported local agents and task-scoped permissions

Some context first, or this reads like Microsoft calling agents malicious. The October 19 post is titled 'Agents are your newest insiders. Security must move at their speed.', and its framing is precise: agents are not inherently malicious, they are capable tools that users grant access to important systems; they can make mistakes, be manipulated or be compromised, their outputs vary, their context changes and their plans evolve mid-task. The problem is not good agent versus bad agent. It is that agents run at machine speed while humans cannot investigate every signal by hand.

The design principle is one sentence: surround non-deterministic intelligence with deterministic controls, independent evidence and containment boundaries. It expands into four continuous responsibilities, and Microsoft stresses these are not four products or four sequential phases but a loop: evidence changes risk, risk changes policy, policy changes what the agent may do. The post also pulls in Nadella's earlier framing — separate the supply of intelligence from the authority over it, and never let a model be its own security authority; the controls that decide what it can access, what it can do and whether it should keep running must sit outside the model, where it cannot bypass or tamper with them.

The first concrete change is visibility. Microsoft says local agent discovery expands by 35 types to 60 supported local agents, and the post names Claude Code, OpenAI Codex and GitHub Copilot — none of them Microsoft products. Discovery then needs identity: Entra Agent ID is extended to additional agent patterns including local and previously unknown agents found by security sensors, so an agent that was never integrated with Microsoft Security can still become a policy target. The stated logic is simple: discovery tells you an agent exists, identity gives governance a durable anchor, letting the enterprise distinguish what a person did from what an agent did on that person's behalf.

The second change is the permission model, and it is the most concrete part. Microsoft's position is that an agent should not automatically inherit all the standing access of its user; it should begin with no authority and receive only what it needs for the approved task, for only as long as the task requires. The new Dynamic Permissions set an outer boundary through organization-wide policy, with one hard rule: an agent cannot obtain authority its user does not have. Permissions can be scoped to the task, made time-bound, and contracted or removed as the task changes or completes, with higher-impact actions optionally requiring verified human approval. The summary line is worth keeping: the employee retains the employee's access; the agent receives its own identity, permissions and authority scoped to its current task and for the duration of the task only.

The third change is that changing risk finally becomes a first-class citizen. The example is concrete: an expense-approval agent starts with the right permissions, then hits a prompt injection inside an external document. Its configuration has not changed, but its behaviour and risk have. For a human user a delay between detection and response may be manageable; for an agent at machine speed it can be the difference between containment and impact. Hence Dynamic Agent Risk, which fuses signals from identity, data, endpoints, cloud, network, runtime and the agent's own activity into a continuously updated judgment. Microsoft is explicit that this is not a one-time score assigned at onboarding, but an ongoing assessment of whether the agent's current authority still matches its current risk.

The response mechanism is Dynamic Conditional Access, and the operative word is graded. The listed actions run from light to heavy: reduce permissions, preserve reads while blocking writes, narrow reachable data and resources, restrict network paths, shorten or revoke time-bound access, require cryptographically provable human approval for a consequential step, and at the highest risk isolate the runtime or stop execution. Walking the expense agent through it: after it hits untrusted content and attempts an unrelated action, policy can keep read access, remove approval and write capability, block sensitive resources and demand provable human approval for the critical step, escalating to isolation or a stop only if risk keeps rising. Microsoft is careful to say this is not treating every risk change as a kill switch.

The last piece is the staffing problem. Microsoft's own number is blunt: as Customer Zero it already operates in a world of hundreds of thousands of agents. At that scale, manually triaging every alert and coordinating every response is impossible, so securing agents must itself become agentic while staying inside boundaries people set: people define policy, approval boundaries and delegation rules; Playbooks define the desired security outcome and coordinate protective actions; Guardian Agents carry out the work at machine speed, can explain why risk changed, investigate the evidence, recommend or apply containment, and feed what they learn back into policy. The post also quotes Terrell Cox, corporate vice president and deputy CISO for customer security at Microsoft, whose point is that people retain control over objectives and consequential decisions while the system carries the continuous work manual operations cannot scale.

One easily missed detail: model-internal signals are now formally part of the security evidence. Microsoft says that as model transparency increases, chain-of-thought and other model-level signals can help identify intent drift, judge whether untrusted information is influencing reasoning, and detect when planned actions diverge from the assigned task, all feeding Dynamic Agent Risk. The principle does not move: the model cannot be its own security boundary; independent systems must observe every layer including the model, and ultimately determine and enforce what the system is allowed to do. Microsoft also notes that Project Perception and Microsoft Agent 365 share signals, context and a unified registry so IT and security teams get a consistent view of agents and risk.

Boundaries. First, these capabilities are not all available today: the post uses language like 'we are expanding' and 'we are introducing', and actual availability and licensing should be checked against the respective Learn documents and product pages; this article does not invent a timetable for Microsoft. Second, the list of 60 supported local agents lives in the AI agent support matrix on Microsoft Learn, so check whether your tooling is covered. Third, figures in the post are Microsoft's own operational claims, with no third-party audit. Fourth, the announcement is positioned as security tooling and does not fix agent reliability itself — in Microsoft's own words, the goal is not to make every model perfectly predictable before it can be useful, but to build systems that remain secure even when the model is not.