MICROSOFT is expanding Project Perception to treat AI agents as insiders, with Guardian Agents added to watch and contain anomalous AI entities that roam organised environments. The aim is to assign each agent a distinct identity separate from the user, start it with no permissions, and allow it to up‑scope only as necessary. If an agent behaves unexpectedly, Perception can cut off its access.
The update broadens Perception from its original defensive focus to securing AI insiders within an organisation, and is designed to run alongside existing Defender, Entra, Intune and Purview signals.
Microsoft says the Guardian Agents can detect 60 agent types locally on devices (up from 25 previously), including Claude Code, OpenAI Codex and GitHub Copilot.
New capabilities include extending Entra Agent ID to agents never built to work with Entra, a Dynamic Agent Risk score that aggregates input from Entra, Defender, Intune, Purview, Sentinel and SSE signals, Dynamic Conditional Access to block writes or adjust network paths, and Microsoft Execution Container, a sandbox that keeps credentials outside the agent’s reach. In practice, the system can interrupt live sessions or runtimes without interrupting the user, or suspend an agent’s activity as risk rises.
However, security experts warn that managing agents with agents could introduce new, unpredictable failure modes, and question whether Guardian Agents themselves could become overprivileged or compromised.