Microsoft announced Guardian Agents on October 19, 2026, as supervisory agents within Project Perception, designed to investigate changing risks in enterprise agents and recommend or apply containment under rules set by people. Microsoft’s approach puts the controls over an agent’s access and actions outside the model itself.
What Guardian Agents are designed to do
Microsoft says agents can make mistakes, be manipulated or compromised, and change course as their context changes. Guardian Agents are intended to investigate why an agent’s risk has shifted, then recommend or apply containment within human-defined policies.
That risk can change even when an agent’s configuration stays the same. In Microsoft’s example, an expense agent may encounter a prompt injection in an external document and begin to act outside its assigned task. Continuous risk assessment is meant to catch that change while the agent is working, rather than rely on a one-time check at setup.
Identity, permissions and runtime boundaries
Microsoft says each agent should have an identity distinct from the employee who sponsors it. It should begin with no authority, or with the least privilege needed, then receive access only for the approved task and only as long as that task requires. Permissions can be narrowed or removed as the task changes or ends, instead of automatically inheriting the employee’s standing access.
Microsoft Execution Containers (MXC) are sandboxes with policy-controlled access to resources. Microsoft describes their enforcement boundary as outside the agent’s reach. That boundary is designed to let security controls observe and restrict the runtime even if the agent or its harness, the software that orchestrates it, is compromised.
How changing risk can alter access
Dynamic Agent Risk is Microsoft’s continuously updated assessment of an agent’s security configuration, reachable resources, potential impact, and drift from the user’s or organization’s intent. It combines signals from identity, data, endpoints, cloud, network, runtime, and the agent’s activity.
Dynamic Conditional Access uses changes in that assessment to adjust permissions and containment. Microsoft describes these possible responses:
| Response | Effect in Microsoft’s design |
| Preserve reads while blocking writes | Let the agent continue reading permitted information while preventing changes. |
| Narrow access | Restrict the data or resources the agent can reach. |
| Restrict network paths | Limit the routes the agent can use to reach resources. |
| Shorten or revoke access | Reduce or remove time-bound permissions. |
| Require human approval | Hold a consequential action for verified approval. |
| Isolate the runtime | Contain the agent’s execution environment. |
| Stop execution | Halt the agent when the assessed risk warrants it. |
The choices are proportional to the assessed risk. An organization could preserve safe reads while blocking an agent from approving or changing an expense; isolation or stopping execution are further options when risk warrants them.
People set the rules for Project Perception
People define the objectives, policies, approval boundaries, and delegation rules. Guardian Agents are described as handling continuous monitoring and response within those limits, while people retain control over consequential decisions. That division of authority also connects to NeoTeo’s earlier coverage of Satya Nadella’s proposal for a human-operated AI emergency brake.
Project Perception is the broader system. Microsoft describes red agents that probe, blue agents that investigate, and green agents that remediate and harden. Microsoft’s product page labels Project Perception as in preview, and the company says it shares signals, context, and an agent registry with Microsoft Agent 365.
