Microsoft expands Project Perception to treat AI agents as insider risks, with risk scores and permissions that shrink when an agent drifts
I recently wrote about why we need to treat models as insider risks, with security controls sitting outside the model itself. Today, we're putting that principle into practice by expanding Project Perception with new capabilities to help continuously assess agent risk, adapt permissions, and contain threats.
Context
Microsoft is building agent security controls that sit outside the model and can cut an agent's access, require human approval or shut it down as its risk changes.
Satya Nadella argued in an October 10 blog post that controls on AI models must come from outside the models themselves. Project Perception is the AI security system Microsoft unveiled in July, according to GeekWire, and the new features sit in Microsoft 365 E7 and Project Perception.
- Microsoft Security Blog: Agents are your newest insiders. Security must move at their speed.
- Official Microsoft Blog: Securing the agentic insider
- GeekWire: Microsoft unveils tools to monitor and corral rogue AI agents
- The Next Web: Microsoft adds tools to limit and monitor AI agents in Microsoft 365 E7
Deep dive
On October 19, Satya Nadella posted that he recently wrote about treating models as insider risks, with security controls sitting outside the model itself, and that Microsoft is now putting that principle into practice by expanding Project Perception with new capabilities to continuously assess agent risk, adapt permissions and contain threats.
In a Microsoft Security Blog post the same day, Nadim Abdo, a corporate vice president for identity and network access, wrote that agents can make mistakes, be manipulated or be compromised, and that a model should not be its own security authority. He described four continuous jobs: know which agents exist and who owns them, contain what each can do before it acts, protect the data and tools in its path, and adapt protection as risk changes.
GeekWire reported that each agent gets a continuously updated risk assessment based on signals such as what data it can reach and whether its actions depart from its task. When risk rises, the system can remove the agent's ability to make changes while still letting it read, require a person to approve a high stakes step, or shut it down. Microsoft is also raising the number of agent types it can detect on employee computers to 60 from 25, including Claude Code, Codex and GitHub Copilot, and adding Guardian Agents that investigate why another agent's risk changed. The Next Web said a feature called Dynamic Permissions starts an agent with no access of its own and grants only what one task needs, for as long as it lasts.
GeekWire said the features are in private preview, with broader availability planned for Microsoft's Ignite conference on November 17 to 19.
What to expect next
Watch whether broader availability arrives at Ignite in November as GeekWire reported, and how the risk scores hold up against real agents such as Claude Code and Codex running on employee machines. GeekWire framed this as competition with Google, Amazon Web Services, CrowdStrike and Okta to become the system businesses use to control their agents, so expect rival announcements. The key open question is how often automatic permission cuts interrupt legitimate work.