Microsoft announced on October 19 that it is expanding Project Perception, its agentic security system, to govern the AI agents companies run inside their own walls — treating those agents not as trusted software, but as insiders whose access, behavior, and risk must be supervised continuously.
The shift came in two posts. Hayete Gallot, executive vice president of Microsoft Security, called the systems "agentic insiders" in a post titled "Securing the agentic insider," writing that agents are frequently overprivileged, hold access to data, tools, and systems, and take actions in critical processes. Nadim Abdo, corporate vice president for identity and network access, made the same case on the Microsoft Security Blog: agents can make mistakes, be manipulated, or be compromised, and they can run continuously at machine speed.
Project Perception was introduced in July 2026 to defend against AI-driven attacks from outside the enterprise, using teams of red, blue, and green agents. Microsoft is now turning that same stack inward. Its centerpiece is a team of Guardian Agents that supervise other agents around the clock, moderating actions before they happen, investigating when an agent's risk changes, and recommending or applying containment — while people keep control of policy, approval boundaries, and consequential decisions.
The supporting controls start with visibility. Microsoft is expanding discovery by 35 additional local agent types, to 60 in total, including Claude Code, OpenAI Codex, and GitHub Copilot, and bringing discovered agents into a unified registry shared by Project Perception and Microsoft Agent 365. Microsoft Entra Agent ID is being extended to local and previously unknown agents, giving each agent its own identity, separate from the person who launched it, so an organization can tell what a person did from what an agent did on that person's behalf.
Containment is built around least privilege. New Dynamic Permissions start an agent with no authority and grant only task-scoped, time-bound access, inside organization-wide limits that prevent an agent from obtaining authority its user does not have. Higher-impact actions can require verified human approval. Sandboxes such as Microsoft Execution Container give agents policy-controlled access to the resources a task requires, with enforcement sitting outside the agent's reach, so a compromised agent cannot disable the controls watching it.
Risk then moves in real time. Dynamic Agent Risk combines identity, data, endpoint, cloud, network, and runtime signals with the agent's own activity, and Microsoft is adding chain-of-thought and other model-level signals to spot intent drift and untrusted information influencing an agent's reasoning. When risk rises, Dynamic Conditional Access responds in graduated steps: an agent can keep read access while writes are blocked, lose permissions, have its network paths restricted, face human approval for a consequential step, or, at the highest levels, be isolated or stopped. Microsoft's example is an expense-approval agent that encounters a prompt injection in an external document: it keeps reading, but can no longer approve or write until a person signs off.
The framing comes from the top. Chairman and CEO Satya Nadella wrote: "The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least." For IT and security teams, the message is practical: inventory the agents already running, give each one an identity of its own, and make its permissions expire and adapt — because an agent does not need to be hacked to become a risk.