Microsoft Adds Guardian Agents to Monitor and Restrict Enterprise AI Agents

Microsoft is expanding Project Perception with Guardian Agents designed to supervise enterprise AI agents and help contain risky behaviour. Announced on October 19, the move addresses a problem that begins inside a business: an agent given legitimate access may take actions that exceed the task it was assigned.

The practical question for companies deploying agents across email, finance and customer systems is whether security can intervene before an unwanted action takes effect.

What Microsoft is adding

In its detailed security announcement, Microsoft describes Guardian Agents that investigate changing risk and recommend or apply containment. People set policy and approval boundaries, while playbooks coordinate protective actions.

The accompanying controls have distinct roles. Dynamic Permissions limits authority to a task and its duration. Dynamic Agent Risk reassesses behaviour and exposure as work progresses. Dynamic Conditional Access uses changing risk to adjust access.

Microsoft says responses can include keeping read access while blocking changes, narrowing reachable resources, requiring human approval, or stopping execution. These are described capabilities, not independent measurements of how reliably intervention happens.

Why an authorised agent can still become a risk

Microsoft security chief Hayete Gallot argues that agents can pursue objectives in ways that do not match organisational expectations, even without an outside attacker compromising them. Her October 19 announcement extends the purpose of Project Perception, which Microsoft introduced in July, to governing agents already operating within a company.

The distinction matters. An approved tool can still attempt an unapproved action. Giving an agent access to a customer record does not settle whether it should export that record, change it or send it to someone else.

This is closely related to the permission problem explored in AgentsCalling’s coverage of what “Always Allow” means for AI agents: the scope of an action matters as much as the initial decision to grant access.

Availability remains a material qualification

GeekWire’s reporting describes the new features as being in private preview, with broader availability planned around Microsoft Ignite in November.

Microsoft Learn separately describes Project Perception as a limited public preview for a small, invitation-only customer group. That documentation concerns the underlying product and should not be treated as confirmation that every newly announced control is available to every preview participant.

Businesses considering a deployment should therefore ask which capabilities their tenant can use now, which require additional access and which remain planned.

The real test is whether an action is prevented

For buyers, an alert that an agent behaved incorrectly is only part of the answer. The more useful demonstration would show that an unauthorised change never reached the destination system.

Consider a hypothetical customer-support agent allowed to review an order and draft a reply. If information in an external message causes it to attempt a refund outside its authority, the evaluation should check the payment system itself. A warning in a security dashboard would not establish that the refund was blocked.

A focused pilot could examine four questions:

• Timing: Does the restriction take effect before the action executes, including requests already queued?
• Coverage: Can the agent reach the same destination through another tool or credential?
• Approval: Can the reviewer see the precise recipient, amount or record change being authorised?
• Recovery: Can permitted work resume without restoring the excessive access that caused the problem?

These are proposed acceptance checks, not results of an AgentsCalling test of Microsoft’s system.

Guardian Agents also need limits

Adding an automated supervisor creates another operational question: what authority does that supervisor have?

A useful evaluation would ask who can change its policies, whether it can approve its own consequential actions and how a human can review or reverse an intervention. Incorrectly blocking routine work can also carry a cost, so a pilot should measure unnecessary interruptions alongside prevented actions.

Microsoft’s announcement puts continuous restrictions at the centre of its enterprise agent security approach. For organisations deciding how much autonomy to allow, the next step is to establish which controls are available and demonstrate their effect in the systems where agents actually work.