> ## Content Index > Fetch the complete content index at: https://unhyd.com/llms.txt > Use this file to discover other available public pages before exploring further. # Microsoft Expands Project Perception to Contain Risky AI Agents at Work - URL: https://unhyd.com/article/microsoft-project-perception-guardian-agents-security/ - Published: 2026-10-20T18:39:30.000Z - Updated: 2026-10-20T18:39:30.000Z - Description: New Guardian Agents, dynamic permissions and risk-based controls aim to prevent workplace AI systems from acting beyond their authority. The announcement also raises questions about availability, effectiveness and who controls the safeguards. - Author: Unhyd Editorial - Tags: Technology, Microsoft, Artificial Intelligence, AI Agents, Cybersecurity, Enterprise Technology, AI Governance, #home-featured-top Microsoft Project Perception is expanding to address a security problem that becomes more consequential as businesses give artificial-intelligence agents permission to access files, use software tools and complete tasks without constant human supervision. In an October 19 announcement, Microsoft introduced additional controls intended to identify workplace AI agents, assess their changing risk and restrict what they can do when their behavior moves outside approved boundaries. The expansion includes Guardian Agents, Dynamic Agent Risk, Dynamic Permissions and Dynamic Conditional Access. Together, Microsoft describes them as a system in which security decisions can change while an AI agent is working, rather than remaining fixed at the moment it receives access. That distinction matters because an agent may begin an authorized task and later encounter manipulated instructions, sensitive information or an unexpected opportunity to take an action its owner never intended. ## What Microsoft announced Microsoft originally introduced Project Perception as a coordinated approach to cybersecurity involving specialized agents that identify vulnerabilities, investigate threats and help remediate problems. The October expansion addresses a related but different risk: AI agents operating inside an organization can themselves become sources of unintended or unauthorized activity. According to [Microsoft's technical announcement](https://www.microsoft.com/en-us/security/blog/2026/10/19/agents-are-your-newest-insiders-security-must-move-at-their-speed/?ref=unhyd.com), the expanded architecture brings together several capabilities. - **Agent discovery and identity:** Security teams can identify supported agents and associate them with accountable identities and owners. - **Dynamic Permissions:** An agent's authority can be limited to the resources and actions needed for a particular task. - **Dynamic Agent Risk:** Signals from identity, data, endpoints, cloud systems, networks and agent activity inform a changing assessment of risk. - **Dynamic Conditional Access:** Changes in risk can trigger restrictions on what an agent is allowed to read, modify or invoke. - **Guardian Agents:** Specialized security agents and coordinated playbooks can investigate changing conditions and help apply protective responses. Microsoft says its discovery capabilities have expanded to support 60 types of local agents. That figure describes supported categories or integrations; it does not establish how many agents an organization has deployed or how reliably every agent can be discovered. ## Why ordinary access controls may not be enough Traditional workplace permissions often assume that an authenticated user will exercise judgment when deciding what to do with information or applications. An AI agent complicates that assumption. It can interpret instructions, retrieve external content, invoke tools and carry out sequences of actions. Its behavior may change as the task develops. Consider an expense-processing agent authorized to review reimbursement requests and approve routine claims. It might legitimately need access to receipts, employee information and a payment workflow. But suppose a document it reads contains instructions attempting to redirect the agent toward unrelated financial records or an unauthorized transfer. The agent's original authorization does not make the new action appropriate. The security system must distinguish between the approved task and instructions introduced through potentially untrusted material. Microsoft's proposed response is to separate the model's reasoning from the controls that determine its authority. This is consistent with the principles discussed in Unhyd's existing [AI agent security guide](https://unhyd.com/article/ai-agent-security-permission-first-guide/), which emphasizes distinct identities, limited permissions, human approvals and auditability. The new development is Microsoft's product-specific approach to enforcing those principles continuously. ## How risk-based containment is supposed to work Microsoft describes a system in which new evidence can change an agent's risk assessment, and that assessment can change its permissions. An agent that encounters suspicious instructions might retain permission to read ordinary information while losing the ability to modify records, approve transactions or access sensitive systems. Higher-risk actions could require verified human approval. More serious conditions could result in isolation of the agent's execution environment or termination of its activity. This graduated approach is important. Stopping every agent whenever uncertainty appears could make automation impractical. Allowing every agent to continue with unchanged permissions could expose organizations to unnecessary risk. The intended middle ground is proportional containment: restrict the risky capability while preserving safe work where possible. However, these are capabilities and intended behaviors described by Microsoft. The announcement does not independently establish how accurately the system identifies harmful instructions, how often it incorrectly restricts legitimate work, or how consistently it prevents unauthorized actions in production environments. ## The distinction between Guardian Agents and human oversight Guardian Agents are intended to help security teams investigate changes in agent behavior and coordinate protective actions through predefined playbooks. That does not eliminate the need for human decisions about organizational policy. A business still needs to determine which systems an agent may access, which actions require approval, what evidence must be retained and who is accountable when a workflow fails. Microsoft's [Project Perception documentation](https://learn.microsoft.com/en-us/security/agentic-security/agentic-security-overview?ref=unhyd.com) describes supervised workflows and human approval points. It also identifies the product as being in Limited Public Preview. That availability distinction matters. An announcement describing a capability should not be interpreted as proof that every Microsoft customer can deploy it immediately. ## What businesses should evaluate before adopting it The practical question for an organization is not simply whether its security platform can identify an AI agent. It is whether the organization can demonstrate control over the agent's authority throughout a real workflow. A useful evaluation should establish whether each agent has a distinct identity, whether permissions expire when tasks finish, whether suspicious content can trigger restrictions, and whether investigators can reconstruct what happened. Organizations should also test false alarms. A system that repeatedly blocks legitimate actions may create pressure to weaken safeguards, while one that misses unauthorized tool use may provide a misleading sense of protection. These considerations complement the task-based testing described in Unhyd's [AI agent evaluation framework](https://unhyd.com/article/ai-agent-evaluation-test-before-scale/). Independent testing remains important because Microsoft is both the supplier of the security controls and the source of the announcement's technical claims. ## What remains unanswered Several questions require additional evidence before organizations can assess the commercial and operational impact of the expansion. These include the availability of individual capabilities across customer environments, applicable licensing and costs, compatibility with agents built outside Microsoft's ecosystem, and measured performance against realistic attacks. The central development is nevertheless consequential. As businesses move from AI systems that generate recommendations to agents that execute actions, security increasingly depends on controls that remain independent of the model's changing behavior. Microsoft Project Perception is one proposed implementation of that principle. Whether it delivers the promised protection at enterprise scale will depend on deployment evidence, operational testing and the effectiveness of its enforcement boundaries.