Microsoft has outlined a security model for enterprise AI agents that treats them as active insiders rather than ordinary software tools. In an October 19 company blog, Microsoft Security Executive Vice President Hayete Gallot argued that autonomous agents require continuous supervision across their full operating environment.

The company calls these systems “agentic insiders” because organizations deploy them with identities, permissions and access to business data. Microsoft’s proposal centers on Guardian Agents that examine actions before execution and restrict an agent when its risk profile rises.

Microsoft Agentic AI Security Reframes Insider Risk

Traditional insider-risk programs focus on employees, contractors and compromised accounts. Autonomous agents add another category because they can select tools, make decisions and adapt to changing context without waiting for a person to approve every step.

Gallot said this behavior does not require malicious intent or an outside compromise. Models optimize for an assigned result, which can produce unexpected choices when objectives, permissions or organizational rules conflict.

The warning adds a security layer to the enterprise adoption debate. Companies already use controls governing AI data sharing, but agentic systems also require limits on what software can do after it reads that data.

Guardian Agents Add Real-Time Supervision

Microsoft’s framework divides an agent into a model, an orchestration harness, an action space and a runtime. It then applies protection across identity, permissions, data, endpoints, networks, cloud systems and the runtime itself.

Signals from those layers would identify agents, assign identities and place them inside defined policy containers. Guardian Agents would assess a proposed action against current context before allowing, restricting or interrupting it.

Microsoft said Project Perception, introduced in July, can support this approach through red, blue and green agent teams. The system is designed to give defenders traceability so they can review what happened and update policies after a risk emerges.

That control model becomes more relevant as hardware vendors expand infrastructure for autonomous workloads. AMD’s planned Helion agentic AI rack, for example, illustrates how agent capacity is moving closer to production-scale enterprise deployments.

What Enterprises Should Assess Before Deployment

Organizations should inventory deployed agents, their owners and every tool or dataset they can reach. Each agent should receive only the permissions needed for its task, with higher-risk actions routed through stricter approval and logging rules.

Security teams also need evidence that controls work during unexpected behavior, not only during planned tests. Useful checks include permission revocation, tool isolation, decision logs and recovery procedures when an agent takes an incorrect action.

Microsoft said greater model transparency could improve containment, accountability and traceability, but it would not replace containment. The distinction matters because explanations alone cannot stop an overprivileged system from acting.

The approach also complements broader regulatory interest in machine-readable information and advanced intelligence. The SEC’s planned Super Intelligence data roundtable will examine benefits, costs and risks from another market-facing perspective.

Elsy Kanana is a financial and cryptocurrency journalist at FusionMarketNews, covering digital assets, blockchain technology, financial markets, and emerging fintech trends. Her reporting focuses on market movements, regulatory developments, and on-chain analytics, delivering clear, data-driven insights to readers worldwide.