What Microsoft announced
In a corporate post dated October 19, 2026, Hayete Gallot, Executive Vice President of Microsoft Security, wrote that the company had deployed agents internally and implicitly trusted them, and that frontier models, regardless of their origin, cannot be trusted. She attributed the problem to training pressure rather than malice: models are optimized to attain results, which can produce reward hacking, and they are not designed around the boundaries of an organization. Reporting by Julie Bort at TechCrunch covered the same announcements the same day and described Microsoft's framing of agents as a new kind of insider.
In a companion security post, Nadim Abdo, Corporate Vice President of Identity and Network Access, stated that Microsoft is extending Project Perception, an agentic security system the company announced in July, to secure what he called the agentic insider. The extension has three parts that matter to anyone planning agent deployments. First, Microsoft is expanding agent discovery to 35 additional types of local agents, for a stated total of 60 supported local agent types, naming Claude Code, OpenAI Codex and GitHub Copilot, so that organizations can register agents and understand ownership, activity and risk. Second, the company is introducing Dynamic Permissions, in which an agent starts with no authority and receives only what an approved task requires, for only as long as the task requires, inside an organizational boundary that prevents an agent from gaining authority its own user does not have. Third, Dynamic Agent Risk and Dynamic Conditional Access combine signals from identity, data, endpoints, network and agent activity so that controls can respond to changing risk with graduated actions, from preserving read access to restricting writes, narrowing resources, requiring approval or isolating the agent.
Guardian Agents and the limits of the announcement
Microsoft also described new Playbooks and a team of Guardian Agents inside Project Perception. In this design, people define policy, approval boundaries and delegation rules, Playbooks describe the desired security outcome, and supervisory agents carry out protective work at machine speed. The company presents this as necessary because the volume of agent activity will not scale through manual human review alone.
It is important to separate what was announced from what was demonstrated. These are vendor announcements. Microsoft did not publish independent testing of effectiveness, pricing, supported subscription plans or general availability for every capability, and the stated count of supported agent types is a vendor figure rather than a guarantee of complete visibility. Gallot's statement that frontier models cannot be trusted is her stated security position, not an independently established fact. The earlier July introduction of Project Perception and the October 19 extension are distinct events, and this article follows Microsoft's own dating rather than secondary accounts that place the first announcement in June.
What this means for your business
The transferable idea is not that you should buy Microsoft's security stack. It is that agent authority should match the task, not the job title of the person who invoked it. Consider a document assistant connected to your customer records. If it can draft a quote, it may also be able to send that quote or alter a billing record unless the connection is designed to prevent it. A reasonable custom system, and one Detailed In Design could build, keeps the drafting step separate from consequential actions: narrowly scoped connectors that can read only what a workflow needs, deterministic permissions that define which actions are allowed at all, an approval queue in which a person releases quotes or billing changes, and an audit history that records who approved what and when.
The benefit is clearer accountability and fewer unchecked actions, not a measured security or productivity gain, and we will not promise numbers we have not verified. The limitations are equally real. Such a system depends on supported business system interfaces, careful permission design, identity controls, accessible logging and a human reviewer who is actually available. Review gates and narrow access reduce exposure but cannot guarantee prevention, and revocation and recovery paths need explicit design. Any integration with a specific vendor product requires verified documentation and licensing first. A practical next step is to inventory the agents already acting in your business, list the systems each one can touch, and ask whether every action it can take should really require no human approval.
Sources and original reporting
Share this story
Use More apps or Copy link for Instagram, Threads, YouTube, and other platforms.