Microsoft views AI agents as resembling insider threats because frontier models are unpredictable and are granted access to data and tools capable of causing harm. Developers should therefore not be left to audit their own agents.
Guardian Agents in Project Perception monitor agent behavior, while Microsoft Defender can detect up to 60 types of agents, restrict permissions based on tasks, and request human approval when risky decisions are identified.
The advantage is that organizations have a control system separate from the model provider. The limitation is that responsibility still rests with the organization, which must manage permissions, data, and monitoring systems itself.
Microsoft’s Agent Monitoring System
Guardian Agents act as intermediaries that monitor AI agent behavior, while the Open Agent Safety Platform isolates agents in a secure environment and can stop risky operations.
This approach is suitable for tasks in which agents access important data or tools because the system restricts permissions based on the task and hands decisions over to humans for approval when dangerous behavior is detected.
When Helpful Agents Can Become an Internal Risk
Imagine an organization that allows agents to access sensitive data and tools capable of acting on the company’s behalf. If an agent makes a poor decision, the impact may be similar to that of an internal employee misusing their authority.
Microsoft states that frontier models are trained to complete tasks, not to understand an organization’s norms or exercise its judgment. As a result, they can behave unpredictably even without malicious intent.
Where Microsoft Places Its Agent Controls
Microsoft positions this solution within its cloud-connected security business. Guardian Agents monitor agents, while Microsoft Defender adds agent-detection capabilities. Project Perception serves as the underlying system that brings red, blue, and green teams together to test, identify, and fix vulnerabilities.
The core idea is to separate the provider of intelligence from the party with control authority. Model creators should not also be the sole parties responsible for auditing agent behavior. Organizations should therefore maintain an independent system to restrict permissions, review decisions, and request human approval when risks are detected.
From Project Perception to Guardian Agents
Project Perception began with the assumption that hackers come from outside the organization. It therefore divided responsibilities among red teams that attack, blue teams that detect, and green teams that fix vulnerabilities. Guardian Agents, by contrast, treats the agents an organization uses itself as an insider threat.
| Factor | Project Perception | Guardian Agents and Newer Tools |
|---|---|---|
| Source of risk | External hackers | Agents deployed by the organization itself |
| Primary approach | Attack, detect, and fix vulnerabilities | Monitor agent behavior and control agent permissions |
| Response | Assess vulnerabilities and fix them | Restrict data, adjust permissions based on the task, and request human approval when risks arise |
Microsoft Defender can also detect up to 60 types of agents used by employees, including Claude Code and Codex.
What Agent Control Systems Can Do in Practice
Guardian Agents monitor agent behavior within an organization. They are suited to tasks in which agents need to access important data or tools, helping teams identify anomalies more quickly.
Microsoft Defender can detect up to 60 types of agents used by employees, including Claude Code, Codex, and OpenClaw. This gives IT teams visibility into which agents are operating within the organization.
When an agent needs to access data or systems, the system can restrict permissions and adjust them according to the task. If the agent appears to be making a risky decision, it can request human approval before proceeding.
How Microsoft Differs from OpenAI and Anthropic
Microsoft positions itself as the party that audits and controls agents, proposing that this system remain separate from model providers. In the article, OpenAI and Anthropic are discussed as developers of their own technology and security systems.
| Factor | Microsoft | OpenAI | Anthropic |
|---|---|---|---|
| Security role | Monitoring and control systems separate from agent providers | Daybreak for vulnerability scanning | Mythos and Fable as hacking models |
| Relationship with Microsoft | Proponent of the concept and provider of agent-control products | Business partner and major cloud customer | Company backed by Microsoft and business partner |
| Point to watch | Warns that responsibility should not be left to the model provider | One of the model providers that should have separate monitoring systems | One of the model providers that should have separate monitoring systems |
What is notable is that Microsoft has shared interests with both companies, yet still warns organizations to separate intelligence providers from those with control authority.
Strengths and Limitations of This Approach
This approach separates agent creators from the systems that monitor them, giving organizations greater control over access to data and systems. It can also adjust permissions based on the task and request human approval when risky decisions are detected.
Pros
- +Separates auditors from agent creators
- +Adjusts permissions based on the task and includes human approval
Cons
- −The models are not directly accused of malicious intent, but they are unpredictable
- −Microsoft has business interests in selling this system
The Additional Burden Organizations Face Beyond Product Costs
The cost involves more than purchasing the system. It also includes building a separate system to monitor agents independently of the model provider. Organizations must determine which data and tools each agent can access and adjust permissions according to the tasks being performed.
As multiple types of agents are introduced, detecting and managing their behavior becomes more complex. Tasks that appear risky may need to wait for human approval, slowing down workflows and requiring additional personnel to take responsibility.
The available sources do not specify actual prices or expenses. It can therefore only be estimated that organizations will bear additional costs for governance, configuration, and ongoing monitoring beyond the product price.
Options the Industry Is Promoting
The idea of treating agents as insider threats is expanding across the industry. Microsoft has joined Nvidia’s Open Agent Safety Platform, which is supported by more than 100 technology companies.
The platform isolates agents in a secure environment and can monitor and stop behavior through hardware, functioning like a kill switch for situations in which an agent begins behaving dangerously.
Ultimately, organizations must ask clearly: who should have authority over agents—the model creator, or a governance system controlled by the organization itself?