An agent that can read a manager’s inbox, query the billing system and start a payment has the reach of the employee who authorized it. Microsoft said on the evening of October 19 that it will govern such software the same way, publishing a security framework that classifies AI agents inside a corporate network as insider threats.
The framing is odd coming from a company that sells the agents. Microsoft’s security team argued that frontier models are trained to complete objectives and do not reliably absorb an organization’s rules about which objectives are acceptable. An agent holding broad credentials because narrow ones were inconvenient is, in the company’s language, an agentic insider.
The control it shipped alongside that argument is a supervisory agent called Guardian. When a working agent drifts from its assigned task, Guardian narrows the permissions available to it rather than shutting it down, and records every tool call in a log that security staff can read afterward. Microsoft described the design as continuous supervision at machine speed, which is the only speed at which an agent operates.
The underlying idea has been in the works since July, when the company announced a program called Project Perception that pairs fixed security controls with models trained to watch agent behavior. Guardian is the part of that program customers can buy. Microsoft has not published pricing, and a spokesperson declined to say how many customers are running it.
For about a decade, enterprise security has rested on one premise: authenticate the person, then decide what the person may touch. Agents break the premise in a way that is easy to describe and hard to fix. They authenticate as software, they act faster than any human review process, and they are usually given credentials broad enough to finish the job on the first try.
Service accounts were the known version of this problem. An agent multiplies the number of service accounts by the number of tasks an organization wants automated.
The blast radius comparison is the part executives will repeat. Once an agent can read mail, call a database and initiate a payment, the damage it can cause is bounded by the same permissions that bound an employee, and the employee at least has a manager, a badge log and a reason to keep the job. An agent has an API key.
Microsoft has a commercial interest in the conclusion. The company said in 2024 that its security business had passed 20 billion dollars in annual revenue, and that unit has grown faster than the company as a whole since. Selling agents and selling the controls that watch them is a durable pairing. It is also the pairing that cloud providers discovered a decade ago, when the fastest route to a larger cloud contract ran through a compliance officer.
The harder problem is what happens to the log. An agent doing routine work can generate tens of thousands of tool calls a day, and a record of every one of them is not an audit trail so much as a second dataset. Security teams that already struggle to review alerts will not read it. What they will do is write rules that fire on patterns, which returns the problem to the place it started, with a model guessing at intent.
Procurement is where the framework will be tested first. Companies deploying agents at scale need something to show auditors, and an internal policy document does not survive a review by a bank’s second line of defense. A named product with a permission-narrowing function and a call log does. Whether the control works matters less in that conversation than whether it exists, and vendors know it.
Rivals are moving toward the same gap from different directions. Identity providers want the agent registry. Endpoint security companies want the runtime.
Network vendors want the traffic. The dispute is not about whether agents need supervision but about which layer owns the decision, and the answer will determine which of those businesses gets the next budget increase.
There is a tension in the design that Microsoft has not resolved in public. Narrowing permissions assumes the task can be specified precisely enough to know when an agent has left it. Most of the agents companies actually want operate in the space where the specification is loose, because that is where the labor savings are. An agent constrained tightly enough to satisfy Guardian may be an agent that cannot do the work it was bought for.
The other unresolved question is liability. If a supervised agent sends a payment it should not have sent, the customer will argue the supervision failed and the vendor will argue the customer set the permissions. Insurance markets have begun writing policies for automated decision-making, and they are pricing the ambiguity rather than resolving it.
Microsoft’s own Copilot agents are the largest test case, and the least discussed. They sit inside the productivity tools where the documents, the mail and the calendars already are, which is precisely the surface the framework describes as dangerous. The company is asking customers to trust a control it is still building, against a risk it has just finished describing in detail.
