As businesses hand AI agents an expanding set of real responsibilities — writing and reviewing code, processing expense reports, drafting documents — Microsoft is making the case that organizations need to fundamentally rethink how much they trust those agents by default. In guidance published October 19, 2026, the company argues that AI agents should be treated the same way security teams treat human insiders: not as presumed threats, but as actors capable of causing real damage if given more access or trust than their job actually requires.

Not Malice — Speed and Access

Microsoft’s framing is deliberately careful: the concern isn’t that agents are inherently malicious. It’s that an agent’s behavior can shift as its instructions, input data, or working context change, and those shifts can happen at a pace no human reviewer can realistically keep up with. An agent might simply make a mistake. It might follow harmful instructions buried inside a document it was asked to process. Or its session could be compromised outright by an attacker. Because agents can act across multiple connected systems simultaneously, any one of those failure modes could expose sensitive data or alter business records before a person even notices something went wrong.

The Core Problem: Inherited Permissions

Microsoft identifies a specific structural risk that it says organizations repeatedly get wrong: an agent set up by an employee often inherits that employee’s full permission set by default, rather than being scoped to only what its specific task requires. The company’s example is illustrative — an agent built to review expense claims genuinely needs to read submissions and check them against company policy. It has no legitimate reason to also hold every other permission its human creator happens to have. If that same agent encounters hidden instructions embedded in a submitted file, or attempts to take an action unrelated to its intended purpose, properly scoped security controls should be able to stop it cold rather than letting broad inherited access carry the action through.

Keeping Control Outside the Model

The central architectural principle Microsoft is pushing is that governance and enforcement should live outside the AI model itself, not inside it. The model can generate answers, draft plans, or suggest actions — but a separate security layer, not the model’s own reasoning, should be what actually decides what data it is permitted to touch and what actions it is allowed to execute. Microsoft CEO Satya Nadella has publicly described this as separating “the supply of intelligence from the authority to act,” a framing meant to prevent a compromised or simply mistaken model from being able to talk its way around the safeguards meant to constrain it.

The Product Push: Perception, Agent 365, and Guardian Agents

Microsoft is backing the policy argument with concrete product expansion. The company says it’s broadening agent discovery and control capabilities through Project Perception and Microsoft Agent 365, adding support for 35 additional types of local agents — bringing its total coverage to 60 — and expanding Microsoft Entra Agent ID so that agents can carry identities distinct from the human employees who created or sponsor them. That separation matters operationally: it lets security teams clearly attribute specific actions to a specific agent rather than lumping them together with everything a human employee did that day.

Layered on top of that identity framework, Microsoft describes three new capabilities:

• Dynamic Permissions — granting an agent only the access its current task actually requires, rather than a static, broad grant set once and forgotten.
• Dynamic Agent Risk — continuously reassessing how risky an agent’s behavior looks and adjusting its standing accordingly.
• Dynamic Conditional Access — automatically tightening or loosening what an agent can do as its assessed risk level changes, for instance restricting an agent to read-only access, requiring human sign-off before a sensitive action, or isolating it entirely if risk spikes.

Microsoft is also introducing what it calls Guardian Agents — AI systems specifically tasked with monitoring the activity of other agents and responding to anomalies at machine speed, under rules still set and ultimately controlled by human security teams. Microsoft frames this as helping human analysts investigate alerts and apply pre-approved safeguards faster, rather than replacing their judgment.

A Call to Build Oversight In From Day One

Microsoft’s underlying message to security teams is straightforward even if the technology is complex: agent oversight needs to be designed in from the start of a deployment, not bolted on afterward. That means maintaining a real-time inventory of which agents exist across the organization, assigning each a clear and distinct identity, scoping permissions tightly to actual task needs, monitoring behavior continuously, and — critically — preserving an independent mechanism to halt an agent’s actions that doesn’t rely on the agent’s own cooperation. As AI agents take on more operational responsibility inside enterprises, that last point in particular is likely to become one of the defining security requirements of the next few years.