What happened
Microsoft says it is extending Project Perception and Microsoft Security to govern AI agents as their behavior, context and access change. The company says the update adds support for 35 more local-agent types, expands Entra Agent ID, introduces Dynamic Permissions, Dynamic Agent Risk, Dynamic Conditional Access, and adds Playbooks and Guardian Agents for automated security operations.
Microsoft frames agents as capable tools that may become insider risks when they are given access to sensitive data, business applications, tools or other agents. The company says agents can make mistakes, be manipulated or compromised, and may behave differently as their context changes. It argues that models should provide intelligence but should not control their own security boundaries.
The announced changes cover the full agent lifecycle. Microsoft says discovery is expanding to 35 additional types of local agents, bringing the stated total to 60 and including Claude Code, OpenAI Codex and GitHub Copilot. It says these agents can be placed in a unified registry with information about ownership, activity and risk. Microsoft is also extending Entra Agent ID so local and previously unknown agents can receive distinct identities separate from the people who use or sponsor them.
Microsoft says Dynamic Permissions will give agents task-scoped, time-bound authority rather than automatically inheriting a user’s access. Dynamic Agent Risk will combine signals from identity, data, endpoints, cloud, network, runtime and agent activity. Dynamic Conditional Access is described as a graduated response that can reduce permissions, block writes while preserving reads, narrow reachable resources, require human approval, isolate a runtime or stop execution.
The company also says Project Perception will add Playbooks and Guardian Agents. According to Microsoft, people will define objectives, approval boundaries and delegation rules, while Guardian Agents investigate evidence, recommend or apply containment and help harden policy. The source describes these as announced or introduced capabilities, but does not establish their release status or availability.
Source details: microsoft.com ↗
Why it matters
AI agents can be granted access to company data, applications and tools, creating a security problem that differs from ordinary software because their outputs and plans can change as they work. Microsoft’s proposed architecture places authority outside the model, with independent identity, permission, monitoring and containment systems. If delivered as described, this could give organizations more granular ways to restrict an agent without immediately stopping every task. The source is Microsoft’s own announcement and provides no independent testing of effectiveness, false-positive rates or deployment outcomes.
The practical issue is control at machine speed. A conventional least-privilege setup may give an agent appropriate access at the start of a task, but a or untrusted document can change what the agent attempts. Microsoft’s proposed response is to continuously reassess risk and adjust authority, rather than relying only on onboarding checks or treating every change as an immediate shutdown.
The distinction between a person’s permissions and an agent’s permissions could improve attribution and reduce blast radius when agents act across enterprise systems. A narrowly scoped expense agent, for example, could retain permission to read submissions while losing approval or write access after suspicious behavior. That is Microsoft’s example and design claim, not an independently demonstrated result.
Microsoft also says model transparency, including and other model-level signals, may provide evidence about intent drift or influence from untrusted information. The source does not explain what signals are available to customers, how privacy is handled, or how reliable those signals are. Independent validation remains an important unknown.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
An agent must create a draft calendar event for Tuesday at 2 p.m. Which evidence would establish the requested result?
What to watch next
The source does not provide pricing, licensing, release dates, regional limits or clear general-availability status for the announced capabilities. It also does not specify which features require particular Microsoft products or how organizations can verify the claimed model-level signals. Customers should watch for technical documentation, availability notices, independent evaluations and evidence that Dynamic Agent Risk and Guardian Agents make reliable decisions at machine speed.
The announcement leaves access conditions and commercial terms unresolved. It does not state whether the features are experimental, preview, generally available or limited to specific Microsoft Security and Entra plans. It also gives no pricing, deployment schedule or supported-region information.
Security teams should look for documentation showing how the 60 supported local-agent types are detected, how identities are issued to previously unknown agents, and whether discovery works across non-Microsoft platforms. The effectiveness of connectors and sensors will determine whether the proposed unified registry is complete enough for operational use.
The main technical question is whether risk-based controls can respond quickly and accurately without interrupting legitimate work. Useful follow-up evidence would include independent testing, incident data, measurable false-positive and false-negative rates, and details on how human approvals are verified for consequential actions.
The source describes Guardian Agents as helping secure other agents. That creates a further governance question: what limits, evidence requirements and human review apply to the security agents themselves. Microsoft says people retain control over objectives and consequential decisions, but the implementation details are not provided.