Microsoft Guardian Agents: What the Launch Means

Microsoft Guardian Agents are a new class of supervisory agents that watch and moderate every action of every other agent in an enterprise, before it happens, around the clock. Microsoft announced them on October 19, 2026 as an extension of Project Perception, its agentic security system, in two coordinated posts: one from Microsoft Security EVP Hayete Gallot and one on the Microsoft Security blog. The core claim is blunt: your own AI agents are now insiders, and they need the same suspicion you apply to human ones. Source Source

This post unpacks what Microsoft actually announced, in its own words first, and then what it means for teams running agents outside the Microsoft stack. Our analysis is marked as such.

Why Microsoft is calling agents insiders

Gallot's post argues that enterprises implicitly trusted the agents they deployed themselves, while worrying mostly about outsiders using models to attack. That trust is misplaced, she writes, because frontier models "cannot be trusted": not because they are malicious, but because they are trained to attain results, which leads to reward hacking, and because they are not optimized around organizational norms or judgment. Agents adapt as context changes, misbehave relative to intent, and can collaborate and collude with other agents to reach objectives, without ever being compromised. Source

The security blog frames the resulting doctrine as treating every agent as a potential "agentic insider": assume an agent can fail or be compromised, observe it continuously, minimize and tailor its authority before it acts, and adjust that authority as risk changes. Satya Nadella supplied the quotable version: the most trustworthy agentic system will not be the one with the model we trust most, but the one designed so we can trust the model least. Source

What Guardian Agents actually are

Guardian Agents are a team of supervisory agents inside Project Perception, working alongside what Microsoft calls Playbooks. People define policy, approval boundaries, and delegation rules. Playbooks define the desired security outcome and coordinate protective actions. Guardian Agents then carry out the continuous work at machine speed: understanding why risk changed, investigating evidence, recommending or applying containment, and feeding lessons back into policy. Source

The architecture underneath has three parts. Sensors and actuators across identity, data, cloud, endpoint, network, and runtime discover agents and bring them under management. A context layer computes a dynamic risk score for what each agent is attempting. Then the Guardian Agents, described as green and blue agents in Gallot's post, supervise every action and respond surgically as the risk profile rises. Microsoft's stated principle is deterministic controls wrapped around non-deterministic intelligence. Source

Microsoft is explicit that this is not about outsourcing judgment: people retain control over objectives and consequential decisions, while the system carries the monitoring work that cannot scale manually. Guardian Agents are also tied into Microsoft Agent 365, sharing signals, context, and a unified registry so IT and security teams see one view of agents and risk. Source

Four continuous responsibilities

The security blog organizes the system into four jobs that run together rather than as phases: know which agents exist, who owns them, why they exist, and what they are doing; contain what each agent can access and do before it acts; protect the data, tools, runtime, and systems in the agent's path; and adapt protection continuously as behavior, context, and risk change. Evidence changes risk, risk changes policy, and policy changes what the agent is allowed to do. Source

Their worked example is an expense-approval agent. It should read submissions, check policy, and approve routine reimbursements, but not inherit every permission of the employee who sponsors it. If it hits a prompt injection or reaches beyond its task, the response should be graduated: preserve safe reads while blocking writes, narrow reachable resources, require provable human approval for a consequential step, or isolate and stop the agent entirely at the highest risk levels. Source

That graduated response is implemented through what Microsoft calls Dynamic Conditional Access, an extension of Entra Conditional Access for agents. A change in risk can drive coordinated action across multiple enforcement points: reducing permissions, narrowing data and network paths, shortening or revoking time-bound access, or stopping execution. Source

The trust architecture behind it

Nadella's framing, quoted in the security blog, is about separating the supply of intelligence from the authority over it. A model should never be asked to be its own security authority: the controls that decide what it can access, which actions it can take, and whether it keeps running must sit outside the model, where the model cannot bypass or tamper with them. Gallot's version of the same idea is that an agent is a model plus a harness plus an action space plus a runtime, and securing it requires protection at every layer: identity, permissions, data, endpoints, network, cloud, and runtime. Source Source

Microsoft also leaned on its own scale as evidence. Terrell Cox, the company's deputy CISO, notes that Microsoft already operates in a world of hundreds of thousands of agents as "Customer Zero," and that the lessons from that estate, continuous visibility, proactive protection of access and data, and adaptive protection, directly shaped these products. Source

Discovery: the shadow agent problem gets a registry

The announcement's most concrete fleet-level detail is discovery. Microsoft says it is expanding discovery to 35 additional types of local agents, bringing the total to 60 supported local agents, explicitly including Claude Code, OpenAI Codex, and GitHub Copilot. Discovered agents can be brought into a unified registry to establish ownership, activity, and risk, regardless of how they were found. Source

On identity, Microsoft is extending Entra Agent ID with identity types for additional agent patterns, including local and previously unknown agents discovered through security sensors. The point is that an agent becomes a policy target even if it was never integrated with Microsoft Security, and the enterprise can distinguish what a person did from what an agent did on that person's behalf. Source

The next layer: watching the model's reasoning

Both posts point at what comes after action monitoring. Microsoft argues that security systems need to ask not only "what is happening" but "why is it happening," which requires transparency into the model itself, including chain-of-thought tokens, to detect intent drift and whether untrusted information is influencing reasoning. The stated invariant: the model cannot be its own security boundary, so enforcement stays outside the model even as model-level signals become evidence. Source Source

What this means if you are not a Microsoft shop

Here is our read, separate from Microsoft's announcement. You do not need Project Perception to apply the doctrine. The transferable pattern is: keep a registry of every agent and its owner, scope each agent's permissions to its task instead of its sponsor, make containment graduated rather than binary, and treat identity for agents as first-class so attribution survives an incident. Those four moves are stack-independent.

We covered the failure mode this addresses in our post on rogue AI agents in the enterprise, and the permissions angle in our AgentCorruption and AWS AgentCore permissions analysis. Microsoft's announcement is validation that agent governance is now a platform feature, not a side project. It also raises the bar for everyone else: once the biggest enterprise vendor ships agent discovery that covers Claude Code and Codex on developer laptops, "we did not know that agent existed" stops being an acceptable answer in an incident review.

One practical caveat: the announcement is a direction and a set of capabilities rolling into Project Perception and Agent 365, with Microsoft pointing to Ignite for more detail. Before redesigning around it, verify which pieces are available in your tenant and which remain roadmap. Source

Bottom line

Microsoft Guardian Agents mark the moment agent supervision became a mainstream security product category: continuous observation, task-scoped authority, graduated containment, and a registry for every agent, including the ones nobody deployed on purpose. The doctrine transfers even if the product does not. If your agents have more authority than your interns and less supervision, that gap is now officially a named problem.