Microsoft says enterprise AI agents need their own security controls—not just the permissions of the employees who launch them. In an announcement published October 19, the company outlined changes to Project Perception, its agentic security system, including Guardian Agents, continuously updated risk assessments and task-scoped permissions. The goal is to spot when an agent’s behavior changes and restrict what it can do before a mistake becomes a larger incident.
Why AI agents need a separate security boundary
An AI assistant that only answers questions has limited reach. A workplace agent may also read business records, call tools, edit files or approve routine work. That usefulness creates a risk: an agent might be misled by untrusted content, make an unintended choice, or have its runtime compromised. Microsoft’s point is that the agent does not need to be malicious for its actions to cause harm.
The company recommends treating an agent as a distinct identity rather than letting it silently inherit all of its sponsoring employee’s access. Its proposed approach applies familiar ideas such as least privilege and Zero Trust to software that can act quickly and autonomously.
What Project Perception is adding
Microsoft says its security systems will discover more agents and place them in a unified registry. The company is adding support for 35 types of local agents, bringing the stated total to 60. Microsoft names Claude Code, OpenAI Codex and GitHub Copilot among the examples. This is intended to help IT teams identify locally run agents that may not have been centrally deployed.
Two other capabilities are designed to react as an agent works. Dynamic Permissions can scope access to a task, limit how long it lasts and remove or narrow it as the task changes. Dynamic Agent Risk combines signals from areas such as identity, data, endpoints, cloud, network and runtime to assess whether the agent’s current behavior still fits its intended task.
Microsoft describes a graduated response rather than an automatic all-or-nothing shutdown. Depending on policy and risk, controls could preserve read access while blocking writes, restrict reachable resources, shorten access, require human approval for a consequential action, or isolate and stop the agent. Guardian Agents in Project Perception are meant to help security teams investigate changing risk and coordinate those containment steps.
What this could mean for IT teams
For a company deploying agents across finance, customer service or software development, a registry and separate identity could make it easier to answer basic questions: Which agents exist? Who owns them? What data can they reach? What did an agent actually do? A continuously adjusted permission model could also reduce the need to grant broad access “just in case.”
The practical value will depend on how well the controls work across mixed environments. Microsoft says its security stack can gather signals from different layers and adjust protections, but businesses will need to evaluate coverage, policy configuration, false alarms, auditability and integration with non-Microsoft systems. A risk score is useful only if teams can understand the evidence behind it and reliably enforce the right response.
Availability and limitations
Microsoft announced the capabilities on October 19, 2026. Its Project Perception documentation labels the product as a Limited Public Preview, available to a small, invitation-only group, and warns that prerelease features may change. Microsoft’s announcement says organizations can get started, but it does not provide consumer pricing or a general-availability date for the newly described controls.
These are enterprise security tools, not a feature consumers can switch on for a personal chatbot. The announcement also does not establish that monitoring or containment will catch every prompt injection or unsafe action. Organizations still need careful access design, testing, human approval for high-impact work and independent review of what the system records.
The bigger shift: govern actions, not just models
Microsoft’s announcement reflects a broader change in AI security: as software agents gain access to real tools and data, protecting the model alone is not enough. Companies need controls outside the model that define identity, permissions and approval boundaries—and can reduce authority when behavior appears risky. Project Perception is Microsoft’s proposal for that layer, but its usefulness will be clearer as the preview matures and customers report how well the controls work in real deployments.
Sources: Microsoft Security Blog, October 19, 2026; Official Microsoft Blog, October 19, 2026; Microsoft Learn Project Perception documentation.
Featured image: Microsoft, “Securing the agentic insider” (October 19, 2026).