On October 19, 2026, Microsoft announced new enterprise AI-agent security controls for Project Perception and Microsoft 365 E7. The company describes them as a continuous control loop: signals inform risk, risk informs policy, and policy changes what an agent is allowed to do. Microsoft’s announcement lays out the intended design, not independently measured security results.
The announcement covers Guardian Agents and Playbooks, plus Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access. The key idea is how these parts connect, rather than a standalone list of features.
A continuous feedback loop, not a setup checklist
Microsoft says agent discovery, containment, protection and adaptation work together, not as sequential phases. New signals can change an agent’s assessed risk; a changed risk assessment can inform policy; and policy can change the agent’s permitted actions. That makes the announced approach a recurring feedback loop rather than a one-time permissions check.
Project Perception provides the wider context. Microsoft described it as a way to help defenders respond to AI-driven attacks from outside an organization, and its October announcement extends the security effort to agents operating inside organizations. Microsoft’s overview of Project Perception also discusses Guardian Agents in that context.
Discovery and identity give policies a target
Microsoft says its discovery coverage is expanding by 35 local-agent types to a stated total of 60. The examples include Claude Code, OpenAI Codex and GitHub Copilot. Microsoft also says Microsoft Entra Agent ID is being extended to additional patterns, including local agents and previously unknown agents detected by security sensors.
That matters to the proposed control loop because a policy needs to identify the agent it governs. Microsoft says Project Perception and Microsoft Agent 365 share signals, context and a unified agent registry, giving the services a consistent view of agents and risk.
Permissions and risk responses work together
In Microsoft’s description of Dynamic Permissions, an agent starts with no authority and receives permissions limited to its task and duration. Organization-wide policy sets outer limits, and the agent cannot receive authority its user does not have. The intended effect is to keep an agent’s access narrower than a broad, standing grant.
Dynamic Agent Risk is designed to update continuously using signals from identity, data, endpoints, cloud, networks, runtime and agent activity. Microsoft says the assessment also considers configuration, reachable resources, potential impact and deviations from the agent’s intended task. The company has not published a scoring formula in the announcement; the practical point is that the risk assessment is meant to change as the agent’s context changes.
Dynamic Conditional Access is intended to turn those changes into graduated responses. Depending on policy, an organization could preserve read access while blocking writes, narrow the resources or network paths available to an agent, shorten or revoke access, require verified human approval, isolate the runtime, or stop execution. This gives administrators options between leaving an agent untouched and shutting it down.
Guardian Agents coordinate protections
Microsoft says people define policies, approval boundaries and delegation rules, while Playbooks coordinate actions toward those security goals. Guardian Agents are intended to investigate why an agent’s risk changed and recommend or apply containment. The distinction matters: the agent can help carry out security work, while people define the boundaries for that work.
Microsoft also describes the Microsoft Execution Container (MXC) as a sandbox for policy-controlled access, with security enforcement kept beyond the agent’s reach. Model-level signals, including chain-of-thought signals, may contribute to risk assessment, according to Microsoft; enforcement remains independent of the model.
