Microsoft is adding a layer of AI agents whose only job is to watch other AI agents, and it wants businesses to treat the watched agents as a new kind of insider threat.
The company calls the supervisors Guardian Agents and the risky workers "agentic insiders". In a blog post, Nadim Abdo, Microsoft's Corporate VP for Identity and Network Access, wrote that agents are not inherently malicious but can make mistakes or be manipulated, and that they need broad permissions to be useful. Abdo's central rule: "We should not ask a model to be its own security authority." Controls over access and actions must sit outside the model, where it cannot bypass them.
The Guardian Agents extend Project Perception, Microsoft's system that coordinates red agents (probe for weaknesses), blue agents (investigate threats) and green agents (apply fixes). Microsoft also said it is expanding discovery to 35 more types of local agents, including Claude Code, OpenAI Codex and GitHub Copilot. Entra Agent ID, its identity system, gains identity types for local agents and for previously unknown agents that security sensors find.
Three controls do the enforcing. Dynamic Permissions limit an agent to the access a specific task needs. Dynamic Agent Risk checks for threats. Dynamic Conditional Access can then restrict permissions, block certain operations, ask for human approval or, in extreme cases, stop and isolate the agent.
Microsoft's argument for using agents as the overseers is that they work at a speed humans cannot match. That is a vendor's framing, though it is not an unreasonable one.
The design borrows old ideas: least privilege and separation of duties, applied to software staff. Abdo describes surrounding non-deterministic intelligence (output that can vary run to run) with deterministic controls (rules that behave the same every time). How much of the Guardian layer falls into each camp is the useful test. Fixed rules are predictable. Model judgment inherits the same weaknesses the design is meant to contain.