On 19 October 2026 Microsoft introduced a set of security tools for AI agents. Its central point: an agent should not be treated as trusted software, but like an insider whose access is limited and monitored.
Why?
Agents are getting more and more access to email, files and company systems, and they often have more permissions than they need. According to Microsoft’s security chief, the problem is not hackers: models are trained to finish tasks rather than follow the organisation’s rules, and their behaviour is not always predictable.
What was announced?
- Dynamic Permissions: an agent starts with no access and gets limited, time-bound permissions for each task. High-impact actions need human approval.
- Dynamic Agent Risk: each agent’s risk score is updated continuously from its behaviour, data access and network activity.
- Graduated responses: as risk rises, write access can be removed, network paths restricted or human approval required; at the highest level the agent is stopped.
- Agent discovery: Microsoft Defender now recognises up to 60 kinds of local agents, including Claude Code, OpenAI Codex and GitHub Copilot. Each agent gets its own identity in Microsoft Entra, separate from its user.
- Guardian Agents: in Project Perception they explain to the security team why an agent’s risk went up and suggest or apply containment; important decisions stay with people.
Microsoft did not give exact availability dates for these capabilities in the announcement.
What does this mean for businesses?
If you connect an AI agent to company data, give it minimal access from the start, leave sensitive actions to human approval and log what it does. The AI agent development service explains this for real projects.
Photo: Jiaqian AirplaneFan, Microsoft Building 92 in Redmond, licensed under CC BY 3.0, via Wikimedia Commons; cropped.
Source: Microsoft Security Blog ↗
