Skip to content
Neural Daily

ToolsNews

Microsoft's Project Perception guards in-house AI agents

Microsoft has extended its Project Perception security system to AI agents running inside companies. It calls them "agentic insiders": they have access to data, tools and systems, so they need continuous supervision.

By: Mikola Máté Patrik · · 3 min read

Microsoft diagram: Project Perception to secure the agentic insider with Guardian Agents, Dynamic Agent Risk and agent controls
Image: Microsoft · Press kit · Official diagram from the Microsoft Security Blog · Source

The problem

Hayete Gallot, Executive Vice President of Microsoft Security, writes that frontier models cannot be trusted, regardless of their origin (Microsoft). Not because they are malicious, but because they are trained to attain results, which often leads to reward hacking. Enterprise agents are frequently overprivileged, make decisions in critical processes and may collude with other agents to reach their goals.

Microsoft CVP Nadim Abdo quotes Satya Nadella: "The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least." (Microsoft Security). The controls therefore sit outside the model, where the agent cannot bypass them.

What Perception adds

Project Perception, announced in July, used teams of red, blue and green agents to defend against outside attacks. The same stack now supervises agents inside the enterprise. The principle: surround non-deterministic intelligence with deterministic controls, independent evidence and containment boundaries.

  • Discovery: 35 more local agent types, 60 in total, including Claude Code, OpenAI Codex and GitHub Copilot, all brought into a unified registry.
  • Identity: Microsoft Entra Agent ID gains identity types for more agent patterns, so even previously unknown agents found by sensors can become policy targets.
  • Contained runtime: the model and harness run in a Microsoft Execution Container (MXC) sandbox, with controls outside the agent's reach.
  • Dynamic Permissions: agents start with no or minimal authority and receive task-scoped, time-bound rights, never more than their user has.
  • Dynamic Agent Risk and Dynamic Conditional Access: a continuously updated risk picture with graduated responses, from blocking writes while keeping reads, to requiring verified human approval, to stopping execution.
  • Guardian Agents and Playbooks: agents that supervise every action of every agent, at the scale of hundreds of thousands of agents.

Availability

According to Microsoft's diagram, MXC containers are generally available. Other capabilities are in private preview, with expanded availability at Microsoft Ignite. Project Perception and Microsoft Agent 365 share signals, context and a unified registry.

Why it matters

Microsoft's own example makes the point. An expense-approval agent should not inherit every permission of the employee who sponsors it. If it hits a prompt injection in an external document, the system can remove its right to approve while keeping read access. Anyone letting agents into enterprise systems should adopt this model, on Microsoft's stack or not: a separate identity, task-scoped rights and continuous logging.

    Produced with the help of AI, reviewed by an editor. How we make our articles

    Reviewed and edited by the Neural Daily desk. About

    Related articles