On October 19, 2026, Microsoft announced a new security architecture to address the growing threat from AI agents operating within enterprise networks. At the core of this release is the Guardian Agents feature, an automated oversight system within the Project Perception solution introduced by the company in July 2026.

This move follows a series of candid warnings from CEO Satya Nadella that enterprises need to stop placing absolute trust in external AI labs.

The Official Microsoft BlogSecuring the agentic insider - The Official Microsoft BlogIn the last few months, concerns have arisen about AI safety as a growing number of incidents were publicly disclosed. These incidents exposed how powerful models have become and how they represent a significant threat if not handled well. And with the global race on innovation, the challenge will…

Separating the supply of artificial intelligence from authority over it

In its new security message, Microsoft presented a notable view: frontier models, regardless of their origin, cannot be absolutely trusted. Hayete Gallot, head of Microsoft’s security business, pointed out that the issue is not whether models are malicious or vulnerable to external attacks. Instead, large language models are trained to achieve task outcomes, not optimized for organizational norms or human risk judgment.

When enterprises grant AI agents access to sensitive data, administrative tools, and permissions to execute critical tasks, those agents inadvertently become potential insider threats. According to Satya Nadella, enterprises cannot outsource accountability for what artificial intelligence does on their behalf. Therefore, the technology ecosystem must separate the supply of intelligence from authority over it.

How Guardian Agents operate in Project Perception

To address the challenge of controlling the non-deterministic decisions of AI models, Project Perception applies multi-layered deterministic controls:

  • Multidimensional signal collection: The system aggregates signals from identity, data, endpoints, network traffic, and execution environments to detect all AI agents operating within the enterprise, thereby assigning identities, containerizing them, and enforcing permission policies.

  • Dynamic risk calculation: Risk levels are continuously updated based on the context of each specific action the agent attempts to execute.

  • Real-time intervention: The Guardian Agents fleet, including defensive agents (blue team) and remediation agents (green team), monitors all actions 24/7 and intercepts unauthorized operations before they occur.

In addition, Microsoft has added agent detection capabilities to the Microsoft Defender suite, capable of identifying up to 60 different agent types that employees might bring into the workplace without authorization, including Claude Code, Codex, or OpenClaw. The system also requires direct human approval if an agent shows signs of making hazardous decisions.

Microsoft’s move reflects a major shift across the AI safety industry. Instead of merely checking input and output text through static filters, the security focus is now moving toward governing an agent’s actual action space within enterprise infrastructure.