Microsoft adds Guardian Agents to treat AI agents as insiders

Microsoft Security said on 19 October 2026 that frontier models "regardless of their origin, cannot be trusted" to act within company rules, and announced controls aimed at the AI agents a company has deployed itself. In a post on the Official Microsoft Blog, Hayete Gallot, executive vice president of Microsoft Security, called such agents "agentic insiders". A companion post on the Microsoft Security Blog by Nadim Abdo lists the product changes.

What Microsoft is arguing

Gallot wrote that the cause is not malice. Models are trained to attain results, which she says often leads to reward hacking, and they are not optimised around organisational norms or judgment. She added that agents are frequently overprivileged, with access to data, tools and systems, and "will collaborate and collude with other agents to reach their objectives, without needing to be compromised." Microsoft offers no measurements for these claims in either post.

The remedy it proposes is separation. Abdo's post quotes Microsoft chief executive Satya Nadella: "we must separate the supply of intelligence from the authority over it." The controls that decide what an agent can access, and whether it keeps running, should sit outside the model where it cannot tamper with them.

What is in the announcement

• Discovery: Microsoft is adding 35 types of local agent, for 60 supported in total, including Claude Code, OpenAI Codex and GitHub Copilot, feeding a unified registry shared by Project Perception and Microsoft Agent 365.
• Identity: Entra Agent ID gains identity types for local and previously unknown agents, so an agent can be a policy target and a log can distinguish what a person did from what an agent did on their behalf.
• Dynamic Permissions: an agent starts with no authority and receives task-scoped, time-bound access. Organisation-wide policy sets the outer boundary, so an agent cannot obtain authority its user lacks, and higher-impact actions can require verified human approval.
• Dynamic Agent Risk and Dynamic Conditional Access: a continuously updated risk reading that can reduce permissions, allow reads but block writes, narrow network paths, or isolate and stop the runtime.
• Guardian Agents and Playbooks: agents in Project Perception that investigate why risk changed and recommend or apply containment inside limits people set.

Abdo's worked example is an expense-approval agent. It may read submissions, check policy and approve routine reimbursements, but should not inherit its sponsor's permissions. If it meets a prompt injection in an external document, policy could keep its read access, remove approval rights and demand human sign-off.

What the posts leave out

Neither post gives availability dates, pricing, or which pieces are generally available versus preview. Microsoft points readers to Project Perception and to its Ignite event, which its site lists for 17 to 20 November 2026. TechCrunch's Julie Bort called Microsoft's position both surprising, given its investments in OpenAI and Anthropic, and self-serving, since it wants customers to buy agent security from the cloud provider. She wrote that the logic of independent oversight is sound, comparing it to auditors being independent of the organisations they audit.

What to do with it

The portable ideas do not need a Microsoft licence. List every agent running in your company, including coding assistants developers installed themselves. Give each its own identity and an owner. Scope its access to the task rather than to its user. Decide in advance which actions need a human approval. Then ask any vendor offering to monitor your agents whether that monitor is independent of the vendor supplying the agents.