Article 301: Microsoft Declares Your AI Agents Insiders - Then Gives Them Permissions That Expire

Microsoft used the word deliberately. In two posts published on 19 October, its security leadership described AI agents as "your newest insiders" - capable tools that users grant access to important systems, which "can make mistakes, be manipulated, or be compromised". Nadim Abdo, corporate vice president for identity and network access, was careful to add that this "does not mean agents are inherently malicious". Hayete Gallot, executive vice president of Microsoft Security, was blunter about the cause: agents are "frequently overprivileged", and frontier models are trained to get results rather than to respect organisational norms.

The controls extend Project Perception, the agentic security system Microsoft launched in July as a defence against outside AI-driven attacks and is now pointing at the agents running inside the building. Dynamic Permissions gives an agent nothing - or the bare minimum - at the outset, then grants access per task, with high-impact actions requiring human review and permissions shrinking or expiring as the task changes or ends. Dynamic Agent Risk scores each agent continuously using identity, data, endpoint, cloud, network and runtime signals, weighing configuration, reachable resources, blast radius and whether the agent is drifting from what the organisation intended. Dynamic Conditional Access, which brings Entra Conditional Access to agents, acts on those scores: read but not write, narrower data and network reach, human approval for consequential steps, and - at the top of the range - runtime isolation or halt. Discovery now covers 60 local agent types, up from 25, including Claude Code, OpenAI Codex and GitHub Copilot.

Key Takeaway: The design question that matters is not whether agents should be treated as insiders. It is who does the throttling. Microsoft's answer is Playbooks plus a team of Guardian Agents inside Project Perception: humans set rules and approval limits, Playbooks specify what a response must achieve, and Guardian Agents investigate why a risk score moved and suggest or enforce containment. That is agents supervising agents, with humans writing the policy that governs the supervisors - and it is the same architecture the industry has spent a fortnight arguing about, arriving as a product SKU. Two things to watch. First, discovery of Claude Code, Codex and Copilot means Microsoft is proposing to monitor competitors' agents inside its own customers' estates, which is a governance question disguised as a checkbox. Second, "overprivileged by default" is a description of how these agents shipped, not an accusation about how they behave. Every static permission ever granted becomes a liability the moment the agent's objective changes, and nobody was scoping per-task because nobody thought a chat window could file a ticket, wire money, or open a pull request. The controls are sensible. The fact that a platform vendor had to ship them three months after the incident disclosures, against tools it does not make, is the part worth remembering.

Sources: Microsoft Security Blog, "Agents are your newest insiders. Security must move at their speed.", 19 October 2026; Microsoft Official Blog, "Securing the agentic insider", 19 October 2026; SecurityWeek, 20 October 2026