MICROSOFT has laid out a security framework that treats AI agents as insider threats, arguing that safe operation requires ongoing containment and real-time governance rather than trusting them at onboarding. In a detailed blog post, Microsoft describes AI agents as capable of accessing critical systems and potentially drifting from their authorised task once context changes, even without traditional signs of compromise.
The core idea is to move at machine speed: define permissible actions before an agent executes them, monitor what it does during execution, and adjust permissions dynamically as risk varies.
The framework introduces Dynamic Permissions, which give agents the least-privilege access needed for their current task and restrict or remove permissions once the task ends or if the agent tries something outside its scope. Paired with Dynamic Agent Risk, the model aggregates signals from identity, endpoints, network, cloud, runtime, and the agent’s own behaviour to continuously reassess whether current activity still aligns with the granted authority.
If risk rises, responses are graduated rather than binary—ranging from preserving reads while blocking writes to narrowing resources, requiring human approval for high-impact steps, or stopping execution altogether. Microsoft also notes a need to discover and register agents—estimating around 60 types of local agents, including Claude Code, OpenAI Codex, and GitHub Copilot—and to use Guardian Agents to handle continuous monitoring and response.
The article highlights concerns about Guardian Agents themselves being AI and stresses that security controls must operate outside the AI model to remain trustworthy.