Microsoft’s Guardian Agents are designed to tighten access as risk rises

Microsoft announced Guardian Agents on October 19, 2026, as supervisory agents within Project Perception. The company says they are designed to respond as an enterprise AI agent’s risk changes: access can be narrowed, human approval required, and, at higher risk, the agent’s runtime isolated or its execution stopped.

Guardian Agents sit between agents and their authority

Microsoft describes Guardian Agents working alongside Playbooks, which coordinate protective actions. People set the policies, approval boundaries, and delegation rules; Guardian Agents monitor changes in risk and can recommend or apply containment within those boundaries.

The aim is to separate an agent’s ability to reason from its authority to act. Microsoft frames workplace agents as potential insider risks because they can make mistakes, be manipulated, encounter changing context, or be compromised. It does not characterize them as inherently malicious.

Microsoft groups the system’s ongoing work into knowing agents and their owners, containing access and actions, protecting data and systems, and adapting controls as behavior or risk changes. Those responsibilities span identity, permissions, data, endpoints, networks, cloud services, and runtime environments.

What can change when an agent’s risk rises

Microsoft says Dynamic Agent Risk continually assesses signals from security systems and agent activity. Dynamic Conditional Access applies policy in response. The controls are graduated, so the described response need not begin by stopping an agent outright.

For example, access could be narrowed by blocking writes while preserving safe read access, limiting the resources or network paths an agent can reach, or shortening or revoking its access. Microsoft also says higher-impact actions can require verified human approval. At higher levels of risk, the response can extend to isolating the runtime or stopping execution.

A Microsoft Execution Container (MXC) is described as a policy-controlled boundary around an agent’s runtime and resource access. That boundary is meant to keep enforcement outside the agent itself. People retain control of the objectives and consequential decisions. This connects with Satya Nadella’s earlier call for human control of advanced AI, while Guardian Agents apply that principle to the management of agents inside organizations.

What Microsoft’s 60-agent figure covers

Microsoft says its discovery support is expanding by 35 local-agent types, bringing the total to 60 supported types. The company names Claude Code, OpenAI Codex, and GitHub Copilot as examples. The figure counts supported types; it does not mean every agent in an organization will be discovered.

Microsoft also says it is extending Microsoft Entra Agent ID to additional patterns, including local agents and previously unknown agents detected through security sensors. The stated purpose is to let organizations make an agent a policy target even when it was not previously integrated with Microsoft Security.

What Microsoft says is available

In its October 19 infographic, Microsoft labels MXC containers generally available. It places other capabilities in Private Preview and says expanded availability is planned at Microsoft Ignite. The availability wording applies to the broader capability set; it does not assign a separate status or release date to each named feature.