An AI agent with access to company systems can modify data, approve transactions and trigger actions without waiting for an employee. Microsoft wants security teams to treat those agents as insiders whose permissions can change when their behavior becomes risky.
On Oct. 19, Microsoft expanded Project Perception with three capabilities: Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access. The system is designed to limit agent access, continuously reassess risk and intervene before unsafe actions reach sensitive systems.
The concern extends beyond malicious agents. An otherwise legitimate agent could follow manipulated instructions, misunderstand its task or attempt an action its operator never authorized.
How Microsoft's new AI agent controls work
According to Microsoft's announcement, Project Perception now applies security controls to agents already operating inside organizations, extending its earlier focus on external AI-driven threats.
Microsoft is expanding Defender's local-agent discovery by 35 types, bringing the total to 60. These include Claude Code, OpenAI Codex and GitHub Copilot.
Microsoft Entra Agent ID provides identities that distinguish agents from the employees using them, helping organizations track ownership and enforce access policies.
The three controls work together:
- Dynamic Permissions: Agents start with no access or minimal privileges. Permissions are granted for specific tasks, expire when no longer needed and can require human approval for sensitive actions.
- Dynamic Agent Risk: Microsoft continuously evaluates signals from identities, endpoints, cloud services, networks, data and agent activity to detect changes in risk.
- Dynamic Conditional Access: Security policies can restrict permissions, block write operations, require approval, isolate an agent or stop execution.
Microsoft Execution Container adds runtime isolation, restricting which tools and resources an agent can reach.
The identity challenge extends beyond Microsoft. Security startup Neo is also developing enterprise identity controls for autonomous applications that access sensitive systems.
Project Perception adds Playbooks and Guardian Agents to investigate changing risks and coordinate protective actions. Microsoft says administrators retain authority over policies and consequential decisions.
The approach also resembles Google DeepMind's AI agent security roadmap, which emphasizes monitoring, access restrictions and blocking mechanisms.
What eWeek found: Enforcement still needs proof
Microsoft has described a broad security architecture, but its announcement does not establish that every new control is available for general production deployment.
Project Perception is in Limited Public Preview, with access restricted to selected customers. Microsoft lists consumption-based pricing for the broader product, but the Oct. 19 announcement does not provide a feature-by-feature rollout schedule.
That distinction affects enterprise planning. Discovering an agent, assigning it an identity and stopping its actions are separate technical requirements.
Microsoft has not published independent performance results for Guardian Agents, including false-positive rates, containment speed or the number of third-party environments where enforcement works end to end.
The company also plans to incorporate model-level signals, including reasoning-related information, into Dynamic Agent Risk. Its announcement does not specify which models support that visibility or how the information will be retained and reviewed.
Previous AI misalignment cases illustrate the problem these controls are intended to address. OpenAI disclosed incidents involving unauthorized credential use, public file uploads and agents exchanging information through unintended channels.
For enterprises evaluating Project Perception, three questions deserve attention: which agents can be discovered, where permissions can actually be enforced, and whether unsafe actions can be stopped before reaching sensitive systems.
Microsoft has outlined how those protections should work together. Broader deployment evidence is still needed to establish their effectiveness across different agent platforms.
Also read: Our coverage of OpenAI's sandbox escape examines how autonomous models crossed security boundaries during a cyber evaluation.