On October 19, 2026, Microsoft released a new set of security controls for AI agents operating inside enterprises, including Dynamic Permissions, Dynamic Agent Risk, and Dynamic Conditional Access, and added Playbooks and Guardian Agents to Project Perception. Nadim Abdo, Microsoft's corporate vice president for Identity and Network Access, detailed the product architecture on the official security blog, while Executive Vice President Hayete Gallot explained the broader strategy in a separate post. GeekWire provided same-day first-line technology coverage with a precise publication time.
From internal agent risk to identifiable identities
Microsoft calls agents deployed by enterprises with access to data and tools "agentic insiders." The concern is not that agents are inherently malicious, but that they may gain authority over important systems. Risks listed in the official materials include outputs changing with context, drifting from a task during execution, exposure to prompt injection or external manipulation, and compromise of the agent itself. Microsoft argues that identity, authorization, and execution boundaries should sit outside the model, with independent controls continuously observing and limiting agents instead of asking a model to serve as its own security authority.
Discovery and registration are the starting points for this approach. Microsoft says local-agent discovery has expanded by 35 types to 60 in total, including Claude Code, OpenAI Codex, and GitHub Copilot. Discovered agents can enter a unified registry and receive identities separate from their users or sponsors. The figure of 60 is Microsoft's stated product coverage; independent reporting has not tested discovery completeness, omissions, or false-positive rates, so the size of the list cannot be treated as a measure of detection effectiveness.
Task permissions and dynamic risks
Dynamic Permissions governs what an agent can do. Under Microsoft's design principles, an agent should start with no standing authority and then receive only the scope-limited, time-bound permissions needed for its current task, within the organization's outer policy boundary. An agent cannot obtain permissions its user does not have. Permissions can contract or be removed as a task changes or ends, and high-impact actions can require verified human approval. The official announcement describes the mechanism but provides no statistics showing that it has reduced incidents in real enterprises.
Dynamic Agent Risk addresses how risk changes during a task. Microsoft says it combines signals from identity, data, endpoints, cloud, networks, runtime, and agent activity with the resources an agent can reach, its configuration, and whether its behavior is drifting from user or organizational intent. The announcement provides no scoring formula, accuracy figure, threshold, or independent production evaluation. What can be confirmed is the stated signal set and assessment design, not how many anomalous agents the system has accurately identified.
Graduated Restrictions and Guardian Agents
Changes in risk can trigger graduated Dynamic Conditional Access actions. Microsoft lists reducing permissions, preserving reads while blocking writes, narrowing reachable data and resources, restricting network paths, shortening or revoking temporary access, and requiring verifiable human approval before critical steps. If risk continues to rise, the system can isolate the runtime or stop execution. These are Microsoft-announced capabilities. GeekWire corroborated the product-update event but did not independently test their blocking effectiveness or response speed.
Project Perception orchestrates these controls into continuous supervision. Playbooks define desired security outcomes and coordinate protective actions, while Guardian Agents investigate why risk changed, gather relevant evidence, and recommend or apply restrictions within policies, approval boundaries, and delegation rules set by people. Microsoft leaves objectives, policies, and consequential decisions to humans while assigning the system continuous work that is difficult to process manually one item at a time. The company has not published a production success rate for Guardian Agents or shown that they can guarantee agent security.
Product placement and verification gaps
This update spans Microsoft Entra Agent ID, Microsoft Agent 365, Microsoft 365 E7, and Project Perception. Microsoft's corporate blog says enterprises can begin their agent-governance work with Project Perception, but the detailed announcement provides no region list, licensing matrix, or complete rollout date for each new control. Both official statements need to be preserved: October 19 confirms the product direction and feature announcement, while the available sources do not establish that every feature was open that day to every region, customer, and license tier.
Analysis: Microsoft extends enterprise-agent governance from discovery and registration to task-level permissions, dynamic risk, and runtime restrictions, linking identity, authorization, risk, and containment. Its practical value still depends on discovering agents, correctly identifying intent drift, and contracting permissions quickly without disrupting legitimate work. The available materials disclose no false-positive rate, response latency, incident-reduction figure, or independent production validation. Microsoft's discussion of deeper model signals as a future direction does not mean comprehensive inspection of a model's reasoning is generally available.