Microsoft Project Perception adds Guardian Agents to limit AI permissions

Microsoft has announced Guardian Agents as an extension of Project Perception, its agentic security system, designed to limit the permissions of artificial intelligence agents when their activity deviates from assigned tasks. These agents help security teams investigate evidence, recommend containment measures, and strengthen policies while ensuring people retain control over consequential decisions.

Root cause

The initiative addresses the challenge of managing non-deterministic intelligence by surrounding it with deterministic controls and containment boundaries. Microsoft treats frontier models as potential insider risks, not necessarily because they are malicious, but because capable actors with system access can make mistakes or become compromised. The architecture aims to account for these possibilities through structured oversight.

Attack path

Project Perception shares signals and a unified registry with Microsoft Agent 365, providing IT teams with a consistent view of agents and associated risks. The system spans identity, permissions, data, endpoints, networks, and cloud infrastructure. It maintains four ongoing responsibilities: knowing agent details, containing access before action, protecting resources, and adapting safeguards as behaviour and risk change.

Affected versions

Microsoft is expanding discovery capabilities to include thirty-five additional types of local agents, bringing the total supported count to sixty. This list includes specific tools such as Claude Code, OpenAI Codex, and GitHub Copilot. The company is also extending Microsoft Entra Agent ID with identity types for local and previously unknown agents discovered via security sensors.

Mitigation

• Integrate native connectors and sensors across the security stack to gather information about agent activity.
• Bring discovered agents into the unified registry to track ownership, activity, and risk levels.
• Use Playbooks to define desired security outcomes and coordinate protective actions automatically.

Why it matters

Organisations deploying AI agents must treat them as dynamic entities that require continuous monitoring rather than static configurations. Security teams should establish clear boundaries for agent permissions and ensure that human oversight remains central to critical decisions. Understanding the distinction between deterministic controls and non-deterministic behaviour helps in designing effective containment strategies. Regularly reviewing agent activity against organisational policy prevents unintended access to sensitive resources and reduces the risk of accidental data exposure or system compromise.

What to do and how to stay safe: Microsoft

• Review current agent deployments to ensure they are registered in a central inventory.
• Define specific permission boundaries for each agent based on its intended purpose.
• Monitor agent activity logs for deviations from expected behaviour patterns.
• Establish clear protocols for human intervention when agents encounter ambiguous situations.

Step-by-step guide: Password Policies Examples That Reduce Password Fatigue

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the purpose of Microsoft's Guardian Agents?

They adapt to changing risk contexts, help security teams investigate evidence, and recommend containment measures while keeping humans in control.

How many agent types does Project Perception now support?

Microsoft has expanded discovery to sixty types, including local agents like Claude Code and GitHub Copilot.

Does the system allow AI agents to make final decisions?

No, people retain control over objectives and consequential decisions, with the system focusing on containment and policy strengthening.