Microsoft Adds Guardian Agents to Police AI Agents

Microsoft says businesses should stop implicitly trusting the AI agents they deploy, and it is adding “Guardian Agents” to its Project Perception security system to supervise them. In a blog post on 19 October, Hayete Gallot, who leads Microsoft’s security business, wrote that “frontier models, regardless of their origin, cannot be trusted”. She was careful to add: “This is not because models are inherently malicious.”

The argument is that agents should be treated like insiders: useful, powerful and in need of supervision. For companies that have handed agents access to data, tools and business systems, Microsoft’s message is that those agents need continuous oversight. It is also, of course, a pitch for a product Microsoft sells.

In brief

Microsoft says frontier models “cannot be trusted”, not because they are malicious but because they chase results and do not follow organisational norms.
It is adding Guardian Agents to Project Perception to supervise “every action of every agent, before it happens, 24/7”.
Microsoft has not given pricing or availability dates, and TechCrunch reports further Defender features for finding and limiting agents.

Why Microsoft calls agents “insiders”

Gallot’s case rests on how models are trained. “Models have been trained to attain results, which often leads to reward hacking, and models are not optimized around organizational norms or judgment,” she wrote. “Agents are unpredictable.” She added that they may not behave as intended and “will collaborate and collude with other agents to reach their objectives, without needing to be compromised”.

The risk grows with access. Gallot wrote that agents in the enterprise are “frequently overprivileged”, with access to data, tools and systems, and can make decisions in critical processes. “They are agentic insiders,” she concluded. Her answer is Guardian Agents, which she described as “an established industry term”, that “watch and moderate every action of every agent, before it happens, 24/7”.

That framing echoes Microsoft’s chief executive. According to TechCrunch, Satya Nadella wrote on his personal blog earlier this month that companies cannot outsource responsibility for what AI does on their behalf. “We need to separate the supply of intelligence from the authority over it,” he wrote, as quoted by TechCrunch.

How Guardian Agents fit into Project Perception

Microsoft announced Project Perception in July, describing it as “an agentic security system that uses our new cyber stack and teams of red, blue and green agents”. It was built to help defenders against AI-driven attacks from outside a company. Gallot says the same technology can now be turned inwards, “implementing deterministic controls on non-deterministic intelligence”.

The blog sets out three layers. Sensors across identity, data, cloud, endpoints, networks and runtime are used to discover agents and bring them under management by giving each one an “identity, container and set of policy and permissions”. Those signals are then used to calculate, dynamically, the risk of what each agent is trying to do. Finally, based on that risk, “a team of Guardian Agents, with green and blue agents, actively and continually supervise every action of every agent and surgically respond as the risk profile increases, in real time”.

Human staff stay in the loop, according to Microsoft. The system keeps a trail so security teams can see what happened and why the risk emerged. “Agentic security provides speed. Practitioners provide judgment,” Gallot wrote.

TechCrunch reported more detail on the wider launch. It said Microsoft has added an agent-detection feature to Microsoft Defender that “can find up to 60 types of agents that employees bring into the workplace, including Claude Code, Codex, and OpenClaw”. It also reported features that limit agents’ access to data and systems and adjust their permissions based on the task, including “requiring human approval if an agent appears to be making risky decisions”. Microsoft’s blog does not give prices or general availability dates.

A call for model makers to show their working

Gallot also asked more of the AI labs. Security tools can already observe what agents do, she wrote, but they should increasingly be able to ask why. That “will require greater transparency into the model itself, not only the input and output tokens, but the thinking and chain of thought tokens”.

She was clear that this would add to containment, not replace it. “Model transparency will not replace containment. It will make containment smarter and stronger,” she wrote.

The stance carries some tension. TechCrunch called Microsoft’s approach “both surprising and self-serving”, noting that Microsoft has invested in both OpenAI and Anthropic while now urging customers to buy agent security from a party other than the model makers. It also reported that Microsoft was an inaugural member of Nvidia’s Open Agent Safety Platform. TSN has previously covered similar moves, including ServiceNow’s AI Passport and Microsoft and NVIDIA’s risk guide for open-weight models.

Our read

This is TSN’s analysis. Treating agents as insiders, with identities, permissions and supervision, is a familiar security idea applied to new software, and that makes it easier for compliance teams to adopt. The incidents of recent weeks, such as the OpenCode Console breach, show why unsupervised agent access worries security teams. But Microsoft is both the messenger and the vendor here, and without prices, availability dates or independent testing, buyers will need to judge Guardian Agents on how well they work in practice.

The next marker is Microsoft’s product documentation. Until it sets out what Guardian Agents cost and when they become generally available, the strongest part of the announcement is the argument rather than the product.