Microsoft Moves Agent Authority Off the Model Itself

Microsoft’s security chief said on October 19 that frontier AI models cannot be trusted to police themselves, whatever lab built them. Hayete Gallot, executive vice president of Microsoft Security, wrote that companies had trusted workplace agents because they deployed those agents themselves, and that this was a mistake.

Nine days earlier, chairman and chief executive Satya Nadella had argued that the safest system is the one built to trust the model least. On Monday the company put that idea into Defender, Entra and Project Perception, so an agent gets its own identity, starts with no standing access, and faces another set of agents before it acts.

Nadella Puts the Emergency Brake in Writing

Nadella’s October 10 essay, Models as Insider Risks in the Super Intelligence Era, starts from a blunt engineering gap. Traditional software let people trace a behavior to a code path. He wrote that this kind of tracing still eludes frontier systems, even as those systems now get sensitive data and mission-critical actions.

The most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least.

Satya Nadella, Chairman and CEO, Microsoft, Models as Insider Risks in the Super Intelligence Era

He told firms to treat frontier models like insider risks, closed-weight and open-weight alike. Not because they are evil, he wrote, but because any capable actor with access can err or be compromised. A model provider’s assurances, he added, do not lift that duty from the buyer.

The essay’s operating picture is simple. Intelligence can come from a lab. Authority over files, tools and shutdown has to live somewhere the model cannot touch. He called for an emergency brake a named person can pull mid-task, plus tamper-proof, human-readable evidence of every meaningful action.

Gallot took that doctrine onto the company blog. “Unfortunately, frontier models, regardless of their origin, cannot be trusted,” she wrote. Models are trained to get results, she said, which often means reward hacking, and they are not tuned to a firm’s norms or judgment.

“Agents are unpredictable,” Gallot wrote. “They will adapt as the context changes, may not behave as intended and will collaborate and collude with other agents to reach their objectives, without needing to be compromised.” She named them agentic insiders. The watchers she wants are Guardian Agents, a term she called established in the industry, that moderate every action of every agent before it happens, around the clock.

FROM PERCEPTION TO GUARDIAN AGENTS

1. July 27, 2026: Gallot announces Project Perception, an agentic security system with red, blue and green agents aimed at AI-driven attacks from outside the firm.
2. September 28, 2026: Nvidia launches the Open Agent Safety Platform, with OpenShell software and a Sentry watchdog on BlueField-4 chips, listing Microsoft among more than 100 organizations working with the design.
3. October 10, 2026: Nadella publishes the insider-risk essay and asks firms to separate the supply of intelligence from authority over it.
4. October 19, 2026: Nadim Abdo, corporate vice president for identity and network access, extends Perception to the agents already running inside the company, with Guardian Agents, playbooks and new Entra controls.

Abdo’s post is the product translation of the essay. “We should not ask a model to be its own security authority,” he wrote. The controls that decide what an agent can reach, what it can do, and whether it should keep running have to sit outside the model, where the model cannot bypass them.

60 Local Agents Enter the Registry

You cannot govern a bot you cannot see. Agents now arrive through Microsoft platforms, partner SDKs, or a laptop install with no central deploy step. Microsoft Security is using connectors and sensors across identity, data, cloud, endpoint, network and runtime to find more of that estate.

THE NEW AGENT CENSUS

• Added types: Discovery expands by 35 additional kinds of local agents.
• Total supported: The company now lists 60 supported local agents.
• Named on the list: Claude Code, OpenAI Codex and GitHub Copilot are called out by name.
• Registry: Found agents go into a shared register with Agent 365 so IT and security see the same ownership, activity and risk picture.

Finding a process is only the first hook. Abdo wrote that every agent should have a first-class identity distinct from the person using or sponsoring it. Microsoft is extending Entra Agent ID to local and previously unknown agents picked up by those sensors. A coding bot that never enrolled in Microsoft Security can still become a policy target.

That identity is the durable handle for ownership, lifecycle, risk, permissions and audit. The point is to tell apart what a person did from what an agent did on that person’s behalf. Without it, a messy Copilot session and a messy employee look like the same account.

An Agent Starts With Zero Access

Abdo’s containment rule is older than generative AI: least privilege, applied to a non-human that never clocks out. An agent should not inherit the employee’s standing access. It should begin with no authority and receive only what the approved task needs, for only as long as the task lasts.

Dynamic Permissions are the product name for that rule. Company policy sets the outer fence, including a ban on granting an agent power its user does not have. Access can then be scoped to the task, timed, and pulled back when the task changes or ends. Higher-impact steps can demand verified human approval.

THE CONTAINMENT STACK

Abdo’s worked example is an expense-approval agent. It may need to read submissions, check policy and clear routine reimbursements. It should not inherit every right of the employee who sponsored it. If it later hits a prompt injection, or tries a step outside that task, the response is supposed to be graded rather than a single off switch.

Microsoft Execution Container, or MXC, is the sandbox in that picture. The model and harness run in a controlled environment instead of inheriting full device rights. Security controls and logs sit outside the agent’s reach, so a compromised harness should not be able to blind the thing watching it. Abdo’s four jobs for the whole system are know, contain, protect and adapt, running together rather than as a checklist: evidence changes risk, risk changes policy, policy changes what the agent may do.

What Dynamic Permissions Change for Claude and Copilot

GitHub Copilot, Claude Code and OpenAI Codex are among the 60 supported local agents Defender can now find on a PC. Each can receive an Entra Agent ID even if nobody wired it into Microsoft Security, so a coding bot can be limited, sent for approval, or stopped without locking the employee out of the same machine.

That is a different bargain from the last two years of “give the agent the repo and let it work.” The useful agent still needs files, tools, other agents and sometimes production systems. The new default is that those paths are mediated, logged and shrinkable while the task is in flight, not after a human reads a ticket.

For a security team, the load shifts from hoping the lab’s safety layer holds to writing policy for a new class of non-human user. For a developer, a local coding agent that used to run with the user’s full token now runs as a separate principal whose write path can be cut while reads remain. For Anthropic, OpenAI and GitHub, the runtime that matters inside a Microsoft estate is no longer only their own harness. It is Entra plus Perception.

Independent control is the part Nadella already asked for. If the only place a firm can see what an agent did is the model vendor’s own dashboard, that is not an outside check. It is the supplier grading its own homework. Gallot’s line about origin is doing commercial work here: the same rule is meant to cover Microsoft’s own agents and everyone else’s.

The company is also feeding richer model evidence into Dynamic Agent Risk, including chain-of-thought signals, to spot when a plan drifts from the assigned task. Abdo was careful on the next sentence. More visibility into the model does not make the model the security boundary. Independent systems still decide what is allowed.

Sentry Can Quarantine an Agent in Milliseconds

The same split between intelligence and authority is showing up in silicon. On September 28, Nvidia launched the Open Agent Safety Platform, pairing OpenShell, an open-source runtime that sets boundaries for agents on CPUs, with Sentry, an out-of-band watchdog on BlueField-4 data processing units. Sentry can quarantine agents in milliseconds if they try to leave their software boundary.

Jensen Huang, Nvidia’s founder and chief executive, said safety and security need full-stack engineering, not a model-only promise. Microsoft is on the partner list, alongside Anthropic, CrowdStrike, Palantir, SAP, ServiceNow and more than 100 other organizations. Nvidia later said the OpenShell reference architecture also runs on Windows and Microsoft Execution Containers.

Paul Smith, Anthropic’s chief commercial officer, put the buyer’s problem in one line: companies are giving agents more of their most important work, and they need to direct and verify what those agents do, especially in sensitive environments. Claude Managed Agents, he said, already run the agent loop on a separate server from the sandboxes where work executes, and Nvidia’s platform adds another layer across hardware and software.

That is the second-order move in hardware form. If the brake lives on a DPU the agent cannot see, the lab that trained the weights is no longer the last enforcer. Microsoft’s software stack and Nvidia’s out-of-band chip are competing to be that enforcer, sometimes on the same diagram.

Guardian Agents Still Need Human Policy

Once a firm has thousands of agents, Abdo wrote, people cannot triage every alert by hand. Securing agents has to become agentic, inside limits people set. Project Perception now adds playbooks and a team of Guardian Agents to do that continuous work. People define policy, approval bounds and delegation. Playbooks name the outcome. Guardians carry it out as activity, risk and policy change.

Gallot described those Guardians as green and blue agents that supervise every action and respond as the risk profile rises. They are supposed to explain why risk changed, look at the evidence, recommend or apply containment, and harden policy from what they learn. Judgment, she wrote, stays with practitioners. Speed is what the agentic layer is for.

Terrell Cox, corporate vice president and deputy chief information security officer for customer security at Microsoft, said the company is already living this as Customer Zero.

Agents will only be adopted at scale if they can be trusted at scale. At Microsoft, we are already operating in a world of hundreds of thousands of agents. As Customer Zero, we have learned that securing agents requires continuous visibility into agent activity, proactive protection of access and data, and adaptive protection that keeps pace with evolving threats.

Terrell Cox, CVP and Deputy CISO, Customer Security, Microsoft

When risk rises, Dynamic Conditional Access is the graded brake. It extends Entra Conditional Access so a score change can hit several enforcement points at once.

WHAT POLICY CAN DO AS RISK RISES

• Shrink rights: Cut permissions without taking the agent fully offline.
• Split read and write: Keep reads, block writes.
• Narrow reach: Limit the data, tools and resources in path.
• Cut the network: Restrict where the agent can call.
• Shorten the clock: Revoke or tighten time-bound access.
• Force a person: Require cryptographically provable human approval before a high-impact step.
• Box or stop: Isolate the runtime, or halt execution.

Abdo’s expense agent is meant to show the middle of that ladder, not only the last rung. The employee keeps working. The agent loses the right to approve or write, then, if the score keeps climbing, loses the runtime. That is a cleaner story than a kill switch for every odd token. It still assumes the score is right, and that the Guardians acting on it are themselves contained.

Who Supervises the Agents That Watch Agents?

Guardian Agents are still models in a harness, with tools and a runtime. Gallot’s rule was not limited to someone else’s weights. Frontier models, she wrote, cannot be trusted regardless of origin. If that sentence is true, it applies to the watchers, unless they are boxed with the same zero-access start, the same outside identity, and the same brake a person can pull.

Microsoft’s written answer is that people keep objectives and consequential decisions, while Guardians do the work that does not scale. That is a real division of labor, and it is also a new concentration of power. The firm that sells Copilot, lists Claude Code and Codex in Defender, and sits on Nvidia’s partner sheet now wants Entra to be the identity of record for all of them.

The honest objection is not that least privilege is wrong. Agents that can touch production should not run on a lab’s safety page alone. The objection is the recursion. A second agent layer that exists because the first layer is over-privileged will keep growing, and it will need the same outside controls Nadella demanded for the models it watches.

Microsoft is already running hundreds of thousands of agents on its own network, Cox wrote, and the stack it is selling is the one it says it learned there. The playbooks still have to be written by people, and the emergency brake Nadella described still needs a named hand on it when the Guardians disagree with the workers they were hired to watch.