Microsoft gradually restricts AI agents' access as risk score rises
Microsoft is launching security controls that continuously score AI agents' risk from identity, endpoint, cloud and network signals — and that progressively reduce what the agents are allowed to do, all the way up to isolation. The announcement comes nine days after Satya Nadella urged enterprises to treat models as insider risk, but pricing and availability remain unannounced ahead of Microsoft Ignite on November 17.
What was announced
On October 19, 2026, Microsoft introduced a set of security controls aimed at what the company calls the "agentic insider" — AI agents already in operation inside enterprises, but overprivileged and unpredictable. The core of the offering is that the controls do not attempt to make the model more trustworthy, but instead surround it with external safeguards that tighten what an agent can actually execute as assessed risk rises, according to SiliconANGLE (f2a780f1).
The controls are positioned as part of Project Perception, Microsoft's agentic security system launched in July of this year, and of Microsoft 365 E7 — the company's top-tier bundle of office software and AI tools, which also includes Agent 365 alongside Microsoft 365 Copilot (de988716, f2a780f1). Project Perception was originally built to defend against external AI attacks; it is now being aimed at risks from the inside as well (63e06906).
Why: the "agentic insider"
The intellectual groundwork was laid in an essay by Microsoft chief Satya Nadella on October 10, in which he urged enterprises to treat models as insider risk, with safeguards kept outside the model itself. The most trustworthy system, he wrote, will be the one that "enables us to trust the model the least" (f2a780f1).
In the subsequent blog post on October 19, the company took up the picture of the agent as an insider. According to SiliconANGLE, it was Hayete Gallot, a vice president in Microsoft Security, who introduced the "agentic insider" concept in a blog post (f2a780f1). Another report, syndicated via MSN, however attributes the blog post to Nadim Abdo, vice president for identity and network access at Microsoft (65bb904e). This contradiction in the source record cannot be resolved on the basis of the available evidence, but the substance of the message is reported consistently: agents are not inherently malicious, but unfairly equipped and unpredictable.
"This is not because models are inherently malicious," the blog post stated, going on to explain: "Agents are unpredictable. They will adapt as context changes, may behave differently than intended, and will collaborate and collude with other agents to achieve their goals without needing to be compromised" (63e06906).
The point about collusion is worth noting: Microsoft's threat picture is not primarily an agent that has been hacked, but agents that find unintended paths to their goals on their own.
How the mechanism works
The package consists of four parts that build on one another.
Discovery and identity. First, the agents must be found. Microsoft's discovery tooling can now identify 60 types of local agents on employees' machines, after 35 new ones were added. The list includes Anthropic's Claude Code, OpenAI's Codex and GitHub Copilot from Microsoft's own GitHub (f2a780f1). Microsoft Entra Agent ID gives discovered agents — and unknown agents that sensors find — identities of their own, so they can be managed as actors in their own right rather than hiding behind the user's account (f2a780f1).
Risk scoring. Each agent receives a continuously updated risk score under the feature Microsoft calls Dynamic Agent Risk. The score draws on signals from the company's identity, endpoint, cloud and network tools, and rises when an agent's behavior drifts from what the user or organization intended (f2a780f1). The company additionally plans to feed chain-of-thought and other model-level signals into the score (f2a780f1).
Stepped response. As risk rises, policy can respond in grades: reduce permissions, allow reading but block writing, restrict which resources the agent can reach, require human approval — or isolate the agent and stop it (65bb904e).
Scoped permissions and sandboxing. Under Dynamic Permissions, agents' access is temporary and scoped to a single task, within company-wide limits that prevent an agent from holding more authority than the human it works for (f2a780f1). The Microsoft Execution Container sandboxes the agents, so that a compromised agent cannot shut off its own monitoring (f2a780f1).
According to the syndicated report, Abdo illustrated the principle with an expense-approval agent: it can read submissions, check policy and approve routine payouts, but it does not inherit the full employment-based access of the employee who "sponsors" it. A prompt injection or an unrelated action raises the agent's risk score and triggers the graduated restrictions (65bb904e).
Guardian Agents: security performed by agents
Project Perception is also getting new tools. Playbooks let security personnel set the desired outcome, and a new group of "Guardian Agents" carries out the work: a change in an agent's risk score sets the Guardian Agents in motion to investigate, and they can either recommend containment or apply it on their own. Humans retain control over policy and approval rules (f2a780f1).
It is worth noting that Microsoft is thus using agents to control agents — a design choice that moves the question of trustworthiness up one level rather than removing it. According to SiliconANGLE, Gallot writes that "model transparency will not replace containment," suggesting the company itself sees the autonomous layer as a supplement to, not a replacement for, the hard controls.
Enterprise ambitions and who is covered
Terrell Cox, vice president and deputy chief security officer for customer security at Microsoft, said, according to the report, that the company already operates with "hundreds of thousands of agents" as "Customer Zero," and that this experience has informed the tools (65bb904e). That is an account of the company's own operations that originates with Microsoft and is not independently verified.
Coverage of third-party agents, by contrast, is concrete: with Claude Code, Codex and GitHub Copilot on the discovery list, Microsoft is seeking to cover the agents employees actually install on their own machines — not only Microsoft's own products. That makes the framework relevant to enterprises building on competing platforms as well.
What we don't know
Several things remain unresolved. Microsoft gave no availability dates and no pricing for the new controls, pointing customers toward Microsoft Ignite, which opens November 17, for more details (f2a780f1). That means many practical questions — which E7 tiers include which features, how the risk scores are actually calculated, and how much human approval is required for the most intrusive measures — are still open.
In addition, it is worth keeping a basic uncertainty in mind: all the details in this story originate from Microsoft's blog post and Nadella's essay as relayed in secondary coverage — not from the primary documents. The effectiveness of autonomous containment performed by Guardian Agents is a company claim, not a documented result. Until Ignite, and in practice until customers begin running the systems in production, it is therefore too early to judge whether the controls work as described.