Microsoft is giving businesses a new way to put AI agents on a shorter leash, automatically restricting their actions when their behavior raises security concerns.
Redmond on Monday unveiled a comprehensive suite of security controls designed to rein in rogue artificial intelligence agents, treating autonomous digital helpers not as trusted software, but as unpredictable "agentic insiders."
For IT and security teams, the development addresses a growing challenge: how to give AI agents enough autonomy to complete tasks without allowing them unrestricted access to corporate data and systems.
Restricting the agentic insider
The initiative directly addresses escalating enterprise anxieties over autonomous AI tools taking unauthorized actions. In a company post, Hayete Gallot, executive vice president of Microsoft Security, cautioned that internal agents are frequently overprivileged and inherently unpredictable.
"Frontier models, regardless of their origin, cannot be trusted," Gallot wrote. "This is not because models are inherently malicious. Models have been trained to attain results, which often leads to reward hacking, and models are not optimized around organizational norms or judgment."
Image: Microsoft
The new architecture is anchored by Dynamic Agent Risk, a tool that scores an agent's threat profile in real time based on signals from network activity, data access, and task drift. If that score climbs, Dynamic Conditional Access triggers step-by-step restrictions.
An errant agent might initially lose permission to modify files while retaining read access, require manual approval from a human for sensitive tasks, or be shut down completely inside its container sandbox.
To police this ecosystem, Microsoft is deploying "Guardian Agents" within Project Perception to supervise external agents around the clock. The company also expanded its local sensor footprint, discovering up to 60 distinct agent types on employee devices—up from 25—including Anthropic's Claude Code, OpenAI's Codex, and GitHub Copilot.
The emerging silicon bureaucracy
Treating autonomous software as an untrusted insider marks a pivotal inflection point in enterprise architecture: the rise of an internal silicon bureaucracy.
For years, cybersecurity focused on perimeter defense, keeping malicious outsiders from breaking into company databases. Microsoft is now effectively building an internal oversight framework to police non-human workers that possess legitimate system credentials. Rather than trusting frontier models to self-regulate, organizations are shifting toward external, deterministic governors.
The risk, however, is administrative friction. If automated safety systems become too aggressive in throttling permissions, the speed advantages that made autonomous workflows appealing in the first place could quickly erode.
What this means for everyday workers
For employees using AI agents to automate routine tasks, Microsoft's new security controls could introduce additional oversight into daily workflows.
Organizations adopting the tools may gain greater visibility into AI agents running on employee devices, including applications that have not been formally approved by IT departments. This could help security teams identify unauthorized AI use and assess potential risks before sensitive information is exposed.
Workers delegating complex tasks to AI agents may also encounter additional approval requirements when an agent attempts to access sensitive data or performs actions outside its expected behavior.
For businesses, the challenge will be balancing security with productivity. More restrictive controls could help prevent unauthorized actions, but excessive interruptions may reduce the efficiency gains that autonomous agents are intended to deliver.
According to GeekWire, the new capabilities are currently in private preview, with broader availability expected around Microsoft's Ignite conference in San Francisco from Nov. 17 to 19. Microsoft 365 E7, introduced in May, is priced at $99 per user per month.
Other news: Cybercriminals are exploiting Microsoft 365 calendar invitations as a phishing lure, using familiar workplace notifications to make malicious messages appear legitimate.