The Pulse
Microsoft Adds Guardian Agents to Project Perception
Microsoft says Guardian Agents will help security teams investigate changing risks from AI agents and recommend or apply containment. The October 19 announcement also describes expanded discovery of local agents, task-scoped permissions and
AI.info Team · Written with AI · fact-checked ·
“Agents will only be adopted at scale if they can be trusted at scale.”
Terrell Cox, Corporate Vice President and Deputy Chief Information Security Officer, Customer Security, Microsoft
Microsoft is adding Guardian Agents to Project Perception, its security system for monitoring and responding to risk from AI agents used inside organizations. In a post published October 19 by Nadim Abdo, the company describes the agents as a way to investigate changes in risk and recommend or apply containment—not as a claim that deployed agents are inherently malicious.
The announcement frames agents as potential “insiders” because they may receive access to company data, applications and tools. They can make mistakes, respond to manipulated inputs, or change their plans as context shifts. Microsoft’s proposed response is to monitor agent activity continuously and adjust controls as risk changes.
Guardian Agents take on continuous response
Microsoft says organizations can use playbooks to define security outcomes and coordinate protective actions, while people set policy, approval boundaries and delegation rules. Guardian Agents would investigate why an agent’s risk changed, examine relevant evidence, and recommend or apply containment. The company says they can also use lessons from investigations to strengthen policy.
Microsoft casts the system as a way to handle security work that would be difficult to coordinate manually across thousands—or hundreds of thousands—of agents. People retain authority over objectives and consequential decisions, the post says. It does not describe a Guardian Agent independently deciding what an organization’s security policy should be.
Microsoft expands discovery to 60 local agent types
The announcement also says Microsoft Security is expanding discovery to 35 additional types of locally installed agents, bringing its supported total to 60. Named examples include Claude Code, OpenAI Codex and GitHub Copilot. Microsoft says organizations can add discovered agents to a unified registry to track ownership, activity and risk.
The company is also extending Microsoft Entra Agent ID to additional agent patterns, including local agents and previously unknown agents found through security sensors. The goal is to give each agent an identity distinct from its human user or sponsor. Microsoft says that identity can support attribution, ownership, permissions and policy, including for agents not originally integrated with Microsoft Security.
Task-scoped permissions and outside controls
Microsoft’s proposed Dynamic Permissions would give an agent authority for a specific task and limit it to the time needed to complete that task. Organization-wide policy would set an outer boundary: an agent could not obtain authority beyond what its user has. The post says higher-impact actions can require verified human approval.
The company also argues that agents should run in controlled environments rather than inherit unrestricted access to a device. It cites Microsoft Execution Container as a way to provide policy-controlled access to needed resources while keeping monitoring and enforcement outside the agent’s reach. Separate controls, Microsoft says, should mediate an agent’s calls to tools, APIs, resources and other agents.
Risk can change without a settings change
Microsoft’s Dynamic Agent Risk system is intended to combine signals from identity, data, endpoints, cloud, network, runtime and agent activity. The company’s example is an expense-approval agent that begins with appropriate access but encounters a prompt injection in an external document. Its configuration stays the same, while its behavior and potential risk change.
Microsoft says Dynamic Conditional Access for agents can adapt protection in response to those assessments. The company also proposes using model-level signals, including chain-of-thought, as evidence of possible intent drift or influence from untrusted information. It maintains that the model itself cannot serve as its own security boundary; independent systems must determine and enforce what it is allowed to do.
The post does not provide pricing or a customer availability date for Guardian Agents. Its concrete scope is a security architecture built around agent discovery, distinct identities, limited permissions and risk-based containment—with people retaining control over consequential decisions.