Summary
- Microsoft's 19 October announcements extend agent discovery, distinct identities, and task-specific permission controls.
- Proposed capabilities include dynamic risk assessments and coordinated restrictions on agent activity.
- The approach treats AI model behaviour as untrusted and places security enforcement outside the model.
Microsoft has outlined an expanded approach to securing enterprise artificial intelligence agents, introducing controls intended to limit what autonomous software can access and do as its tasks and operating conditions change.
The announcements, published on 19 October, describe new agent identity capabilities, dynamic permissions, continuously updated risk assessments, and security processes designed to contain potentially unsafe behaviour.
Microsoft is extending its Project Perception initiative alongside capabilities associated with Microsoft Entra Agent ID and Agent 365.
The company’s underlying proposition is that organisations should not rely on an AI model to determine or enforce its own security boundaries.
Instead, agents should operate with independently defined identities, restricted permissions, and controls capable of limiting or stopping their actions when the observed risk changes.
Separate identities for autonomous software
AI agents differ from conventional software automation because they may select actions in response to changing information rather than execute only a predetermined sequence.
A coding assistant, research agent, or workflow system may begin with a legitimate task and subsequently encounter external content that changes the actions it proposes.
The same agent may also interact with multiple applications, tools, APIs, or data sources during a single workflow.
Microsoft argues that this creates risks when agents inherit broad permissions from the employees who use them.
Its proposed model assigns an agent an identity distinct from its sponsoring user. That identity provides a reference for ownership, access decisions, monitoring, and accountability.
The company says it is expanding discovery to 35 additional types of local agents, taking the total supported local agent types to 60.
These include tools such as Claude Code, OpenAI Codex, and GitHub Copilot, according to the announcement.
Discovery does not by itself establish effective security controls. It is intended to provide the inventory and attribution needed before access restrictions can be applied.
Permissions that change with the task
Microsoft has also introduced the concept of Dynamic Permissions for AI agents.
Under this approach, the agent receives authority appropriate to the task rather than automatically inheriting all the standing access of the user.
Permissions can be restricted by resource, operation, and duration, with higher-impact actions requiring verified human approval.
For example, an agent responsible for processing expenses might be allowed to read submissions and approve routine items without obtaining unrestricted access to payroll records or financial administration functions.
If the task changes, the permissions should be reassessed rather than assumed to remain appropriate.
Microsoft also describes Dynamic Agent Risk, which combines information from identity, endpoints, data, network, cloud, runtime, and agent activity to evaluate whether the agent’s current behaviour remains consistent with its intended role.
Dynamic Conditional Access is intended to translate changes in risk into proportionate restrictions.
An agent might retain the ability to read information while losing permission to write or approve transactions. More serious deviations could trigger runtime isolation or termination.
Containment outside the model
The architecture addresses a central problem in enterprise AI security: a model can produce useful decisions without being sufficiently predictable to serve as its own access-control authority.
Prompt injection, compromised tools, misleading external content, and ordinary model errors can all influence an agent’s behaviour.
If the model also controls the security restrictions around its work, a failure in its reasoning or instructions may undermine the safeguards intended to constrain it.
Microsoft therefore proposes boundaries implemented through systems independent of the model, including runtime isolation, network controls, data protection, and identity policy.
Its Project Perception initiative introduces Guardian Agents and associated playbooks intended to investigate signals and coordinate protective action at the pace of automated workflows.
These remain vendor-described capabilities. The announcement does not independently demonstrate their effectiveness across every supported environment, and the operational details of availability and licensing will matter to prospective customers.
The approach also raises integration questions for organisations using AI tools from multiple suppliers. Agent identity and permissions will need to remain meaningful when a workflow crosses platform boundaries.
For regulated businesses, the relevant outcome is not simply discovering more autonomous software. It is maintaining evidence about who authorised its activities, which systems it could reach, and what happened when its behaviour departed from the intended task.
Microsoft’s announcement develops a model of agent security based on independent enforcement, continuously assessed permissions, and explicit accountability. The extent to which those controls can be applied consistently to mixed enterprise AI environments remains a practical test for the technology.
