Microsoft says Project Perception will use agent identities, risk signals and supervisory agents to adjust enterprise permissions as behavior and context change.
Microsoft is extending Project Perception, its agentic security system, to help organizations govern AI agents operating inside their own environments. In an October 19 Microsoft Security Blog post, the company described agents as potential “insiders”: software with access to company data and systems that may make mistakes, be manipulated or change course as their context evolves.
The approach combines signals from identity, data, cloud, endpoint, network and runtime systems to discover agents and assess their changing risk. Microsoft says supervisory “Guardian Agents” can monitor actions and adapt protections, while deterministic controls outside the model set boundaries on what an agent can access or do. Project Perception will share signals, context and an agent registry with Microsoft Agent 365, giving IT and security teams a consolidated view, according to the company.
Microsoft describes responses that could include allowing safe read access while blocking writes, narrowing the systems an agent can reach, requiring human approval for consequential actions, or isolating and stopping the agent. The company also said it is expanding discovery to 35 additional types of local agents, bringing its supported total to 60; examples include Claude Code, OpenAI Codex and GitHub Copilot. That reflects a practical governance challenge: agents may be introduced through different platforms, software development kits or local installations, rather than through one centrally managed deployment.
The announcement is a product and security strategy update, not independent evidence that the system prevents agent incidents. Organizations will still need to determine whether its coverage, integrations and controls fit their environments, and how to manage agents outside Microsoft’s ecosystem. But the emphasis on separate identities, limited permissions and continuous monitoring reflects a broader shift in enterprise security: rather than treating an AI agent as a passive assistant, companies must account for its ability to act across systems. The operational test will be whether monitoring and containment can keep pace with agents that work continuously and at machine speed.