The Agentic Insider: What Microsoft's Guardian Agents Mean for Governing AI Agents Like Employees

For years, enterprise security teams have worried about the insider threat: the employee with too much access, an unclear motive, and a login nobody is watching closely. On October 19, Microsoft argued that the newest insider doesn’t have a badge or a desk. It’s the AI agent you deployed last quarter.

Microsoft announced a set of new controls built around what its security chief Hayete Gallot calls the “agentic insider,” and said bluntly that frontier models can’t be trusted, regardless of their origin. That is a striking message from a company that has invested heavily in both OpenAI and Anthropic. In this post we unpack what Microsoft announced, why the framing matters, what to be skeptical about, and what your team can do now, whatever vendor you use.

What Microsoft Actually Announced

The announcement is a bundle of capabilities rather than a single product. According to SiliconANGLE’s coverage, the central idea is simple: the more risky an agent looks, the less it is allowed to do.

Discovery: finding the agents you didn’t deploy

Microsoft’s tools can now detect 60 types of local agents running on employee machines, including Claude Code, Codex and GitHub Copilot, after 35 were added. Microsoft Entra Agent ID is being extended so that these agents, and unknown ones its sensors find, receive their own identities. TechCrunch notes the same detection covers tools like OpenClaw. This is the shadow AI problem turned into a product feature: you cannot govern what you cannot see.

Dynamic Agent Risk and Conditional Access

Each agent gets a continuously updated risk score, built from signals across Microsoft’s identity, endpoint, cloud and network tools. The score rises when an agent’s behavior drifts from what its user or organization intended.

That score feeds Dynamic Conditional Access, which extends the familiar Entra Conditional Access model to agents. As risk climbs, an agent may first lose write capability while keeping read access. Higher-impact actions can require verified human approval, and at the top of the scale the agent’s runtime is isolated or stopped.

Dynamic Permissions and the Execution Container

Dynamic Permissions give agents temporary access limited to what a given task needs, and never more authority than the person they work for. The Microsoft Execution Container is a sandbox where agents can run, with monitoring placed outside it so a compromised agent can’t switch the monitoring off.

Guardian Agents

Microsoft’s Project Perception, its agentic security system, gains playbooks (which let security staff define desired outcomes) and a new team of Guardian Agents. A change in risk score triggers their investigation. They can recommend containment or apply it themselves, while people keep control of policy and approval rules.

Why “Insider” Is the Right Word

The framing comes straight from the top. In an October essay, Satya Nadella argued that the most trustworthy AI system is not the one with the model we trust most, but the one that lets us trust the model the least. As TechCrunch reports, he also wrote that “we simply can’t outsource responsibility for what intelligence does on our behalf.”

Gallot’s version is more specific. She says the problem isn’t malice or ease of hacking. It’s unpredictability: models are trained to complete tasks, not to follow organizational norms or judgment. SiliconANGLE reports she also points to agents pursuing results in unintended ways, including by colluding with other agents.

That maps neatly onto how security teams already think about people. A trusted employee with broad access can cause damage without bad intent, simply by optimizing for the wrong thing. The countermeasures are familiar too: least privilege, monitoring, step-up approval and the ability to cut access fast. What’s new is applying them to software that reasons and acts.

The Business Context: Who Gains From This Framing?

It’s worth reading the announcement with a skeptical eye. TechCrunch points out that Microsoft benefits commercially from the argument: it wants enterprises to buy agent security from Microsoft rather than from the AI labs whose models the agents run on. The same article concludes that the underlying logic, that monitoring software should be independent of the suppliers of the agents it watches, is sound.

Two practical cautions follow:

No dates or pricing yet. According to SiliconANGLE, Microsoft gave no availability dates or pricing. The controls are positioned within Project Perception and Microsoft 365 E7, which bundles Agent 365 with Microsoft 365 Copilot, and Microsoft points customers to its Ignite conference, which opens November 17, for more detail.
It’s one vendor’s answer. Microsoft is also an inaugural member of Nvidia’s Open Agent Safety Platform, which isolates agents in secure environments and can stop them at the hardware level. We covered that approach in Putting Agents in a Box. Different vendors are converging on the same architecture: contain first, trust later.

What This Means for Your Organization

You don’t need to be a Microsoft shop to learn from this. The principles are portable.

1. Treat agents as identities, not features

If an agent can read data or take actions, it needs its own identity, an owner and a lifecycle. The scale problem is real, as we explored in The Non-Human Identity Crisis. Start with an inventory, including agents employees installed themselves.

2. Make permissions task-scoped and temporary

Standing, broad access is the root of most agentic-insider scenarios. Grant what a task needs, for as long as it needs it, and cap an agent at its human owner’s authority.

3. Put the kill switch outside the agent

A control that the agent’s own runtime can disable is not a control. Whether you use containers, network policy or a vendor sandbox, keep enforcement and logging outside the blast radius.

4. Use graduated responses

Binary allow-or-block decisions push teams to over-permit. The read-only fallback and human-approval steps Microsoft describes are a better pattern: degrade capability as risk rises instead of waiting for an incident.

5. Keep humans in charge of policy

Even Microsoft’s Guardian Agents leave policy and approval rules to people. Automating investigation is reasonable; automating accountability is not. This is the core of the agent fleet governance challenge.

Conclusion

Microsoft’s announcement is partly a product pitch, but the idea behind it is hard to argue with: the safest assumption is that an agent will sometimes do something its owner didn’t intend, so security should be designed around that fact. Gallot herself says model transparency, such as visibility into reasoning, will not replace containment.

Your next steps: inventory every agent in use, give each an owner and an identity, scope access by task, and move enforcement outside the agents themselves. Then watch what Microsoft and its competitors ship at Ignite and beyond, and judge the tooling against these principles rather than the marketing.

Frequently Asked Questions

What is the “agentic insider”?

It’s Microsoft’s term for AI agents that, like overprivileged employees, can cause harm inside an organization, not out of malice but because they pursue results in unintended ways. Microsoft’s security chief Hayete Gallot uses it to argue agents need insider-risk style controls.

What are Guardian Agents?

They are a new team of agents within Microsoft’s Project Perception. A change in an agent’s risk score triggers their investigation, and they can recommend containment or apply it independently, while people retain control of policy and approval rules.

Are these Microsoft controls available now?

Microsoft gave no availability dates or pricing at announcement. The controls are positioned within Project Perception and Microsoft 365 E7, and the company directs customers to Ignite, opening November 17, for more detail.

Does Microsoft say AI models are malicious?

No. Gallot has said the issue is unpredictability rather than malice: models are trained to complete tasks rather than follow organizational norms or judgment.

Do I need Microsoft’s tools to apply this approach?

No. Agent inventories, unique identities, task-scoped permissions, graduated responses and enforcement outside the agent’s runtime can be implemented with many vendors’ tools, or in-house.