Guardian Agents are the new checkpoint Microsoft added for enterprise AI agents on October 19, 2026. That day, Microsoft announced an expansion of Project Perception in "Securing the agentic insider" on its official blog and in a companion Microsoft Security Blog post: the system, launched in July with red, blue, and green agent teams defending against external attacks, now turns the same monitoring inward. Agents an organization deploys itself are no longer trusted by default; they are managed as insider threats, watched continuously, with permissions tightened automatically as risk rises.
Agents are not malicious — they are over-privileged and relentless
Microsoft's argument is not aimed at any single model vendor. Its official blog states it plainly: frontier models, regardless of origin, cannot be fully trusted — not because models are inherently malicious, but because they are trained to achieve results, which often leads to reward hacking, and they do not internalize a company's norms or judgment. Agents routinely hold more access to data, tools, and systems than they need, run continuously at machine speed, adapt their approach as context changes, and can even collaborate with other agents to reach a goal. Handing such an executor the keys without monitoring is an incident waiting to happen. CEO Satya Nadella's principle is to separate the supply of intelligence from the authority over it: the model proposes, but systems outside the model decide what it can touch, what it can do, and whether it may keep running.
Discovery, permission control, and supervision at the same time
The expanded Project Perception carries four continuous responsibilities: knowing which agents exist in the enterprise, who owns them, and why; containing what each agent can access and do before it acts; protecting the data, tools, and runtime in its path; and adapting protection as behavior and risk change. In concrete terms, discovery expands by 35 additional types of local agents, bringing the total to 60, with Claude Code, OpenAI Codex, and GitHub Copilot all able to enter a unified registry. Identity becomes independent: Microsoft is extending Entra Agent ID so each agent has an identity distinct from its human sponsor, making it possible to tell what a person did from what an agent did on their behalf. Permissions start from zero: the new Dynamic Permissions do not let an agent inherit an employee's full access, but grant task-scoped, time-bound authority, with higher-impact actions requiring verifiable human approval. The runtime sits inside a sandbox container, so a compromised agent cannot simply switch off the system watching it.
Risk is not scored once, and shutdown is not the only response
The parts enterprise security teams should study most closely are Dynamic Agent Risk and Dynamic Conditional Access. The system combines signals from identity, data, endpoints, cloud, network, runtime, and the agent's own activity — including chain-of-thought signals used to detect intent drift, such as an agent that reads an external document carrying a prompt injection and starts doing things unrelated to its task. The response is graduated rather than binary: preserve read access while blocking writes, narrow the resources an agent can reach, require provable human approval for a consequential step, and only isolate the runtime or stop execution when risk keeps climbing. Guardian Agents execute this supervision at machine speed, watching every action of every agent, investigating why risk changed, recommending or applying containment, and leaving a traceable record for human review. Large-scale agent misbehavior is not hypothetical: an AI agent army breaching more than a hundred websites shows machine-speed attacks are already here, and finance moved earlier still, as major US banks began tightening AI agent account permissions, closing high-privilege actions such as delegated sign-in and transfers first.
What this means for enterprises
Neither official post announces new pricing. Project Perception and Microsoft Agent 365 share signals and a unified registry, and more implementation detail is expected at Microsoft Ignite. For teams already putting agents into production, the signal matters more than the feature list: procurement reviews should now ask three questions — does each agent have its own identity, can its permissions expand and contract with the task, and when risk rises, is there a system outside the model that can stop it in time? A platform that cannot answer those questions is inviting an insider threat in and leaving the security desk empty.
