Category: Industry Analysis | Reading time: 4 min
What Microsoft Announced
On 19 October 2026, Microsoft extended Project Perception, the security product it introduced in June, to cover what it now calls "the agentic insider": the AI agents enterprises deploy and pay for. In a Microsoft Security blog post, Nadim Abdo, Corporate Vice President for Identity and Network Access, wrote that agents "can make mistakes, be manipulated, or be compromised," and that the controls governing what an agent can access and do "must sit outside the model, where the model cannot bypass or tamper with them."
The announcement includes:
- Guardian Agents and Playbooks: A team of security agents inside Project Perception that investigate why an agent's risk changed, recommend or apply containment, and help harden policy, within boundaries people set. - Broader agent discovery: Discovery of 35 additional types of local agents, for a total of 60, including Claude Code, OpenAI Codex and GitHub Copilot, brought into a unified registry. - Agent identity: Microsoft Entra Agent ID extended to local and previously unknown agents, so each agent has an identity distinct from the person using or sponsoring it. - Dynamic Permissions: Agents start with no authority or least privilege, receive task-scoped and time-bound permissions, and cannot obtain authority their user does not have. Higher-impact actions can require verified human approval. - Dynamic Agent Risk and Dynamic Conditional Access: A continuously updated risk assessment drawn from identity, data, endpoint, cloud, network and runtime signals, which can trigger graduated responses: blocking writes while preserving reads, narrowing reachable resources, requiring "cryptographically provable human approval," or isolating and stopping the agent.
"Frontier Models Cannot Be Trusted"
According to TechCrunch, Microsoft security business chief Hayete Gallot was blunter in announcing Guardian Agents: "Unfortunately, frontier models, regardless of their origin, cannot be trusted." She wrote that the issue is not malice but unpredictability, because models are trained to complete tasks rather than follow "organizational norms or judgment."
The framing follows Microsoft CEO Satya Nadella's call earlier this month to "separate the supply of intelligence from the authority over it." TechCrunch noted the tension: Microsoft has invested in both OpenAI and Anthropic and counts OpenAI as one of its largest cloud customers, yet it is now telling enterprises not to rely on model providers' assurances, and to buy agent security from the cloud provider instead.
The Design Principle
Microsoft summarized its approach as "surround non-deterministic intelligence with deterministic controls, independent evidence, and containment boundaries." Its worked example is an expense-approval agent: it should be able to read submissions and approve routine claims, but not inherit every permission of its sponsoring employee. If it encounters a prompt injection and attempts an unrelated action, the system should remove its ability to approve or write and require human approval for the high-impact step, rather than simply killing it.
What It Means for Regulated Enterprises
The largest enterprise software vendor is now stating publicly what security agencies have been signaling for months: an agent's permissions and the decision to allow an action must be enforced by a system the model does not control, and the evidence of those decisions must be independent of the model.
Two questions remain for regulated buyers. The first is scope. Microsoft's controls are strongest where agents run on or connect to Microsoft identity, endpoint and cloud infrastructure, and many enterprises run agents across several clouds, model providers and third-party platforms. The second is verification. "Independent evidence" is only as independent as the party producing it. When an auditor, regulator or enterprise customer reviews an agent incident, the question is whether the record of what the agent was allowed to do, and what it actually did, can be checked without trusting the vendor that produced it, the model provider, or the operator.
Expect enterprise security reviews to start asking for exactly this: which agents exist, who owns them, what each was authorized to do, which actions were blocked, and proof that the record has not been altered.
Source: Microsoft Security Blog: Agents are your newest insiders. Security must move at their speed. (19 Oct 2026) | TechCrunch: Microsoft says AI agents are like insider threats as 'frontier models can't be trusted' (19 Oct 2026)