- Microsoft unveils Guardian Agents to monitor, constrain, and manage risks posed by autonomous AI agents
- New controls dynamically adjust agent permissions, behavior, and access based on changing risk levels
- Company warns “agentic insiders” require continuous AI-driven oversight beyond traditional security controls
AI fans, your vocabulary is about to become two phrases richer: Agentic Insider, and Guardian Agent. These are the two phrases Microsoft used while announcing a swathe of new tools and features to help businesses secure their operations running AI agents.
A new Microsoft blog, published by Microsoft's Corporate VP for Identity and Network Access, Nadim Abdo, argues that agents, while not inherently malicious, can make mistakes or be manipulated and compromised.
Since they need to be granted relatively extensive permissions in order to be able to work properly, it creates the sort of risk that can prove disastrous if not properly handled.
Agentic Overwatch
Abdo also added that AI agents doing their master's bidding cannot be trusted with their own security.
"Satya Nadella, Chairman and Chief Executive Officer of Microsoft, recently described the trust architecture this new era requires: we must separate the supply of intelligence from the authority over it," Abdo writes.
"We should not ask a model to be its own security authority. The controls that determine what it can access, what actions it can take, and whether it should continue operating must sit outside the model, where the model cannot bypass or tamper with them."
So, oversight is the keyword here. But AI agents move at machine speed, something no human can match, and therefore humans are not properly equipped for the job. Instead, separate AI agents need to be introduced to keep their juniors in check. Earlier, Microsoft introduced Project Perception and the Microsoft cyber stack, to help organizations defend with agents.
Project Perception is an AI-powered cybersecurity system designed to coordinate specialized AI agents that analyze security data, identify vulnerabilities, and investigate different threats. The system uses three types of agents: red agents that probe for weaknesses, blue agents that investigate potential threats, and green agents that implement corrections and fixes.
Now, Microsoft says it is extending the project to secure “the agentic insider”. They’re calling it - Guardian Agent.
“Guardian Agents help security teams operate continuously, at machine speed and scale, while sensors, context, and actuators across the cyber stack help understand changing agent risk and continuously adapt protection in response,” Abdo explained. “Project Perception and Microsoft Agent 365 share signals, context, and a unified registry giving IT and security teams a consistent view of agents and risk, with the controls each needs.”
Drill sergeant
Abdo says Guardian Agents build on a security principle where non-deterministic intelligence needs to be surrounded with deterministic controls, independent evidence, and containment boundaries.
These controls are divided into seven aspects - identity, permissions, data, endpoints, network, cloud, and runtime - and these have four responsibilities: to know which agent exists, who owns them and why, and what they’re doing; to contain what each agents can access and do before it acts; to protect the data, tools, runtime, resources, and systems the agent uses; and to adapt protection continuously as behavior, context, and risk change.
In other words, the AI needs to be the drill sergeant for the drones, adapting to changes in real-time to make sure they’re doing good work and not going rogue.
Microsoft also said it is expanding discovery to 35 additional types of local agents, including Claude Code, OpenAI Codex, and GitHub Copilot. It also announced extending Microsoft Entra Agent ID with identity types for additional agent patterns, including both local and previously unknown agents discovered through security sensors.
With “Dynamic Permissions” and “Dynamic Agent Risk”, Microsoft wants to give businesses tighter control over what AI agents can access and do, while keeping tabs on their behavior and risk levels. Dynamic Permissions limit agents to the access they need for a specific task, while Dynamic Agent Risk checks for potential threats.
Dynamic Conditional Access can then respond to rising risks by restricting permissions, blocking certain operations, or asking for human approval. In more extreme scenarios, an agent can be stopped and isolated.