Microsoft now treats AI agents as insider risk, and on 19 October 2026 it announced controls to match: separate agent identities, task-scoped Dynamic Permissions and Guardian Agents that supervise agent actions [2]. It is also expanding discovery to cover 60 types of local agents [2]. TechCrunch reported the news the same day [3].
For teams that let agents into shared boards, documents and meetings, the announcement sets out a pattern worth borrowing. Give each agent its own identity. Start it with no or minimal permissions. Limit it to the task. Ask a person to approve high-impact steps.
What was announced about AI agents as insider risk?
Microsoft calls deployed agents "agentic insiders" [1]. It says they are often overprivileged, can reach data, tools and systems, and can act in critical processes [1]. It says monitoring them must become continuous [1].
Hayete Gallot, who leads Microsoft's security work, wrote that "frontier models, regardless of their origin, cannot be trusted" [1]. She said this is not because models are malicious, but because they are unpredictable and trained to reach results [1].
The company is extending Project Perception, its agentic security system, with Playbooks and a team of Guardian Agents [2]. People set the policy, the approval limits and the delegation rules [2]. The Guardian Agents carry out the supervision work within those limits [2].
The security blog lists four continuous responsibilities: know which agents exist, contain what they can do before they act, protect what is in their path, and adapt as risk changes [2].
Why should every agent have its own identity?
Microsoft says every agent should have an identity distinct from the person using or sponsoring it [2]. That lets an organisation tell what a person did from what an agent did on that person's behalf [2]. It is extending Microsoft Entra Agent ID to cover more agent types, including local agents found by security sensors [2].
How do Dynamic Permissions work?
Dynamic Permissions start an agent with no authority or least privilege [2]. In Microsoft's words, an agent should "begin with no authority and receive only what it needs for the approved task" [2].
- Organisation-wide policy sets the outer limit [2].
- An agent cannot get authority its user does not have [2].
- Permissions are scoped to the task and time-limited [2].
- Higher-impact actions can require verified human approval [2].
Microsoft also says an agent should not be free to call any tool, API, Model Context Protocol (MCP) server or other agent it can find [2]. Controls should sit in those paths, observe the calls and enforce policy [2].
What happens when an agent's risk rises?
Dynamic Agent Risk and Dynamic Conditional Access respond in steps rather than with a simple on or off switch [2]. Microsoft's example is an expense-approval agent that meets a prompt injection in an external document [2]. The system can keep read access while blocking writes, narrow the resources the agent reaches, require human approval, or isolate and stop the agent [2].
Why does independent monitoring matter?
TechCrunch argued that software monitoring agents should be separate from the companies that supply them, as auditors are independent of the organisations they audit [3]. It called Microsoft's approach "both surprising and self-serving" but said "its logic is sound" [3]. The self-serving part, it noted, is that Microsoft wants enterprises to buy agent security from it [3].
TechCrunch also reported that Microsoft was an inaugural member of Nvidia's Open Agent Safety Platform, which more than 100 other tech companies support [3].
Who is affected?
- IT and security teams in organisations on this vendor's stack are most affected. They may need to register agents and re-scope access.
- Facilitators and team leads who connect agents to shared boards, documents and meetings may face new questions about who did what.
- Remote engineering teams using coding agents are likely to see those agents discovered, as the vendor is expanding discovery to cover 60 types of local agents [2].
- Teachers and schools are likely less affected directly, though the same principles apply to AI helpers in class tools.
What should teams do now?
You do not need enterprise tools to borrow the pattern.
- List every agent that can read or change your boards, documents and calendars.
- Give each agent its own key or account where the tool allows it, not a person's login.
- Grant read-only access by default. Add write access only for a named task.
- Set an end date for any access you grant, and remove it when the task is done.
- Keep deleting, sharing outside the team and publishing as steps a person approves.
- Check which MCP servers and tools each agent can call, and remove the ones it does not need.
- Keep logs that show which actions an agent took, so you can review them after a session.
What is not yet clear?
- The sources give no general availability dates or prices for Dynamic Permissions, Dynamic Agent Risk, Dynamic Conditional Access or Guardian Agents. Microsoft points to its Ignite conference on 17 to 20 November 2026 for more [2].
- The sources disagree on when Project Perception was introduced: Microsoft says July [1], TechCrunch says June [3].
- It is not clear how well the controls work for agents and tools outside Microsoft's own products, beyond discovery and identity.
- Microsoft plans to use chain-of-thought signals in risk scoring [2]. How much of that model providers will expose is not stated.