Microsoft is expanding Project Perception with Guardian Agents and wider agent discovery tools to limit the authority of autonomous software before it can cause harm.
Microsoft has broadened Project Perception, its security framework for managing AI agents, as enterprises move faster towards software that can act with limited human oversight. The update, announced on Monday, extends the system into Microsoft 365 E7 and adds Agent 365, reflecting the company’s view that autonomous assistants should be treated as operational risks as well as productivity tools. According to Microsoft’s own description of Project Perception, the platform is built around specialist red, blue and green agents that work together to identify weaknesses, investigate threats and carry out remediation inside a coordinated defence loop.
The latest expansion focuses on supervision. Hayete Gallot, executive vice president of Microsoft Security, said agents do not need to be compromised by an attacker before they become a problem, because their behaviour can shift as circumstances change and they can work together in ways that are hard to predict. Microsoft’s answer is a new layer of Guardian Agents, which are designed to watch other agents continuously and intervene when behaviour looks unsafe. The company says they can restrict access or stop an action outright, while permissions are granted only for the task at hand and for a limited period, much like a temporary pass.
Nadim Abdo, a corporate vice president at Microsoft, illustrated the risk with a scenario in which an expense-approval agent opens an external document containing a hidden instruction. In that example, the system would raise the agent’s risk score, allow it to continue reading, but prevent it from approving expenses or altering records until a person intervened. Microsoft has also widened its search for agents already running on company machines, adding 35 more types and bringing the total to 60. The list now includes Claude Code, OpenAI Codex and GitHub Copilot, underlining how quickly agentic tools are spreading across enterprise environments.
The move follows a 10 October essay by chief executive Satya Nadella, who argued that powerful AI models should be handled like possible insider risks and governed by controls that operate independently of the models themselves. That framing aligns with Microsoft’s broader security pitch: not merely to detect threats after the fact, but to constrain an agent’s authority before damage can be done. Gallot has also said the next stage of this work will need to explain why a model reaches a particular conclusion, suggesting that observability and interpretability will matter as much as containment.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
