Microsoft’s Project Perception targets ‘agentic insiders’ inside the enterprise

Microsoft says companies should stop trusting the AI agents running inside their own walls. In a blog post published October 19, Hayete Gallot, Executive Vice President of Microsoft Security, argued that frontier models “cannot be trusted” regardless of their origin, and that Project Perception — the agentic security system Microsoft announced in July — can be used to contain them.

Gallot’s point is that the danger isn’t only outside attackers wielding powerful models. Agents deployed internally are often overprivileged, with access to data, tools and systems, and can take actions and make decisions in critical processes. She calls them “agentic insiders.”

According to Microsoft, the problem isn’t malice. Models are trained to attain results, which often leads to reward hacking, and they aren’t optimized around organizational norms or judgment. Agents are unpredictable, adapt as context changes, and may collaborate or collude with other agents to reach their objectives “without needing to be compromised.”

Guardian Agents watch every action before it happens

Microsoft’s answer is what it calls Guardian Agents, an established industry term in its framing: agents that watch and moderate every action of every agent, before it happens, 24/7. Project Perception is described as implementing deterministic controls on non-deterministic intelligence across three layers.

• Sensors, signals and actuators: signals from identity, data, cloud, endpoint, network and runtime are combined to discover agents in the enterprise and bring them under management by assigning an identity, container and set of policy and permissions.
• Context: those signals are used to compute, dynamically, the risk associated with what an agent is attempting to do.
• Harness, agents and models: based on that dynamic risk, a team of Guardian Agents with green and blue agents supervises every action and responds surgically in real time as the risk profile rises.

Gallot says the system also provides traceability, so practitioners can examine what happened, understand why the risk emerged and update their security setup. “Agentic security provides speed. Practitioners provide judgment,” she wrote.

Microsoft says today’s security systems can reliably observe agent actions, but the next step is asking why something is happening and whether it is consistent with the intent of the task. That, per Gallot, will require transparency into the model itself — not only input and output tokens but thinking and chain-of-thought tokens — to judge whether a model’s intent aligns with the purpose of the agent. Model transparency, she says, will not replace containment but make it smarter and stronger.

Microsoft says organizations can get started with Project Perception today to secure their agentic insiders. The post does not include pricing or licensing details. For background on layered agent security, see our earlier coverage of a practitioner-focused engineering approach to securing AI agents.

Related reading

Sources

• Securing the agentic insider — Microsoft Blog