Microsoft announced this Monday (19) an expansion of Project Perception to monitor artificial intelligence agents inside companies, treating these systems as potential insider threats. The new approach introduces the so-called Guardian Agents, responsible for continuously supervising the behavior of other agents and intervening when their actions represent risks.
The change starts from an unusual premise for one of the world's largest AI providers: not even the most advanced models should receive unrestricted trust. In a statement, Hayete Gallot, Microsoft's executive vice president of security, argued that agents can make unexpected decisions, circumvent restrictions to fulfill objectives and even collaborate with each other in unforeseen ways, even without suffering external attacks.
The problem lies in the permissions granted to these systems. Corporate agents can consult confidential information, execute code, access tools and make operational decisions. Microsoft argues that these capabilities need to be subject to controls independent of the model itself, capable of assessing risks before actions are executed.
Guardian Agents can block operations without shutting down the agent
Project Perception, originally presented in July to combat cyberattacks, now incorporates protection mechanisms aimed at the very agents used by organizations.
The Guardian Agents continuously analyze signals of identity, permissions, data, network, cloud and execution environment. With this information, the system calculates the risk associated with each agent's behavior and can recommend or apply containment measures.
The response does not have to be simply shutting down the system. If an agent responsible for approving expenses starts executing operations incompatible with its task, the controls may preserve read access, block changes, require human approval or completely interrupt its execution, depending on the severity identified.
Another change involves the identification of agents installed on corporate computers. Microsoft is expanding the detection from 25 to 60 types of local agents, including Claude Code, OpenAI Codex and GitHub Copilot. The proposal is to assign their own identities to these systems and limit their permissions to authorized tasks, without automatically granting all the privileges of the employee responsible.
Automated supervision will also have limits. The most important policies and decisions will remain under human control, while Guardian Agents will perform checks and operational responses at a speed compatible with the activity of the monitored systems.
Microsoft acknowledges, however, an important limitation: observing what an agent does does not yet mean understanding why it made a given decision. Gallot advocates greater transparency about the models' internal processes, including information about their reasoning steps, to improve the identification of behaviors incompatible with the tasks received. This deeper capability is still presented as a necessary evolution.
The implementation is also not widely available. Project Perception remains in a testing phase with limited access for invited customers. According to GeekWire, the new features are in private preview, with expanded availability planned for November, during Microsoft Ignite.
