Microsoft wants AI agent permissions to shrink as risks change
Project Perception expands with dynamic agent risk and task-scoped access. What Microsoft announced, what Guardian Agents do and what needs independent testing.
Microsoft is extending Project Perception to protect AI agents operating inside organizations. Its October 19 announcement describes Dynamic Agent Risk, task-scoped authority and Conditional Access that can restrict unsafe actions while a workflow runs. The approach puts access enforcement outside the AI model. It does not establish universal availability or independently measured protection effectiveness.
Organizations could register agents and record activity, but an initially authorized agent might encounter manipulated content or a new risk halfway through a task.
Microsoft outlines distinct agent identities and risk-adaptive permissions: allow safer read access, block writes or require a verified human approval for consequential actions.
Agents need their own identity, not an employee's entire account
Microsoft calls agents acting inside a company agentic insiders. They can process expenses, modify software or access sensitive information. That does not mean agents are inherently malicious. Their output can vary, external content can be manipulated, and a workflow can evolve beyond its original instructions. The company argues that an agent should have its own accountable identity and only the authority needed for the current assignment.
Project Perception is being connected with Microsoft Agent 365, Entra Agent ID and signals spanning identities, data, endpoints, cloud, networks and runtime. Microsoft says discovery expands by 35 additional local agent types to 60 in total, including Claude Code, OpenAI Codex and GitHub Copilot. This is a vendor-reported discovery scope, not proof that 60 independent agent integrations have passed complete security tests.
Risk and permissions can change during execution
Dynamic Agent Risk is intended to assess configuration, reachable resources and observed actions throughout a task, rather than assigning a one-time trust score. Dynamic Permissions would restrict authority by purpose and duration. Dynamic Conditional Access could remove write access while preserving reads, narrow available systems or demand verified human approval before a high-impact step. The proposed response is graduated, not always a complete shutdown.
Microsoft also describes Guardian Agents and playbooks that collect evidence, investigate changes and initiate policy-bounded measures. Humans continue to define approval boundaries and security objectives. The underlying principle is that a model cannot be its own security authority: independent enforcement must remain effective even if the agent misunderstands instructions or encounters adversarial content. More monitoring features alone do not demonstrate successful containment.
How an enterprise should test the architecture
Microsoft uses an expense-processing agent as an illustration. A narrowly authorized agent encounters untrusted text and attempts an unrelated action. In the intended architecture, changed risk could cause the system to block writes, limit access or require a human decision. This is an example of desired behavior, not a controlled benchmark proving the detection of every prompt-injection attempt.
A practical pilot would compare a legitimate workflow with a deliberately forbidden tool call. Check whether the agent has its own identity, whether authorization can be revoked mid-task, and what happens if the policy service becomes unavailable. Also examine enforcement at external MCP servers and verify entitlements for each product component. Microsoft has outlined a direction for adaptive security; the article does not prove that every capability is broadly deployed or that it works unchanged across vendors.
AgentenCode assessment
The important change is not another dashboard. It is the proposal that an agent's authority remain separate from its sponsor and adjustable during execution. Whether a disallowed tool call actually fails is more informative than a vendor's feature diagram. ServiceNow AI Passport emphasizes signed authority; Microsoft's latest announcement emphasizes continuous risk-adaptive containment.
Sources and verification
Reviewed October 20, 2026 against two official Microsoft announcements dated October 19. Product capabilities and the 60-agent discovery figure are vendor statements; no independent deployment test.