Microsoft 為 Project Perception 加入 Guardian Agents，應對企業 AI 智能體內部風險

Microsoft on October 19, 2026, announced new security capabilities in Project Perception and Microsoft 365 E7 that treat enterprise AI agents as potential insider threats, introducing Guardian Agents that supervise agent actions continuously and policy controls that adjust what each agent is allowed to do as its risk changes.

Nadim Abdo, corporate vice president for identity and network access at Microsoft, wrote that AI agents are taking on a growing share of everyday work and often need access to company data, applications, tools, and other agents to be useful. The same access that makes agents useful also creates insider risk, he wrote: agents can be manipulated, make mistakes, or be compromised, and they can run continuously at machine speed.

Abdo said Microsoft is extending Project Perception, introduced in July 2026 with teams of red, blue, and green agents to defend against AI-driven attacks from outside the enterprise, to secure the agents now running inside it. Project Perception and Microsoft Agent 365 share signals, context, and a unified registry so IT and security teams see the same picture of agents and their risk. Microsoft describes four continuous responsibilities for the system: knowing which agents exist, containing what each agent can access and do before it acts, protecting data, tools, and systems in the agent’s path, and adapting protection as behavior, context, and risk change.

In a companion post on The Official Microsoft Blog, Hayete Gallot, whose scope at Microsoft includes identity, threat protection, compliance, and data security, wrote that enterprises deployed agents internally and therefore implicitly trusted them, even though those agents are frequently overprivileged and hold access to data, tools, and systems. She described them as “agentic insiders” and said containing them will require Guardian Agents that supervise and moderate each agent action, around the clock and before it happens. The same cyber stack behind Project Perception, she wrote, can also be turned inward to manage and govern agents operating inside the enterprise, placing rule-based controls around model intelligence that does not behave predictably.

Discovery, Identity, and Containment

Microsoft is expanding agent discovery to 35 additional types of local agents, bringing the total to 60 supported local agents, including Claude Code, OpenAI Codex, and GitHub Copilot. Organizations can bring these agents into a unified registry regardless of how they were discovered, to understand ownership, activity, and risk.

Microsoft is also extending Microsoft Entra Agent ID with identity types for additional agent patterns, including local and previously unknown agents discovered through security sensors, so an agent can become a policy target even when it was not originally integrated with Microsoft Security. A first-class agent identity anchors attribution, authorization, lifecycle, ownership, permissions, policy, and risk, Abdo wrote, so the enterprise can tell apart what a person did from what an agent did for that person.

For containment, Microsoft said sandboxes such as Microsoft Execution Container (MXC) give agents policy-controlled access to the resources a task requires and create an enforcement boundary where controls operate beyond the agent’s reach, so a compromised agent or harness cannot disable the controls watching it. Agents likewise should not be free to call any tool, API, Model Context Protocol server, resource, or other agent they can find, Abdo wrote; local, network, and data controls must mediate those paths, observe the calls, and enforce enterprise policy.

New Dynamic Permissions start an agent with no authority and grant only task-scoped, time-bound permissions. Organization-wide policy sets the outer boundary, including preventing an agent from obtaining authority its user does not have, and higher-impact actions can require verified human approval.

Dynamic Risk and Guardian Agents

Dynamic Agent Risk combines signals from the agent’s own activity alongside identity, data, endpoint, cloud, network, and runtime signals, weighing the agent’s configuration, the resources within its reach, the damage a failure could cause, and any drift between its actions and the user’s or organization’s intent. Microsoft described the result as a continuously updated understanding of an agent’s current risk, showing whether the authority it holds still matches that risk.

Dynamic Conditional Access extends Microsoft Entra Conditional Access for agents so a change in risk can drive coordinated action across multiple enforcement points. The response is graduated: a policy can keep an agent’s read access while blocking writes, narrow the data and resources the agent can reach, restrict network paths, shorten or revoke time-bound access, reduce permissions, or require provable human approval before a consequential step proceeds. At the highest risk levels, the system can isolate the agent’s runtime or stop execution entirely. Abdo gave the example of an expense-approval agent that encounters a prompt injection in an external document: new evidence raises its Dynamic Agent Risk, and policy responds by preserving read access while removing the ability to approve or write, with cryptographically verifiable human approval required for a high-impact step.

Microsoft is also introducing Playbooks and a team of Guardian Agents in Project Perception: people define policy, approval boundaries, and delegation rules, Playbooks define the desired security outcome and coordinate protective actions, and Guardian Agents carry out the work at machine speed. Terrell Cox, Microsoft’s corporate vice president and deputy chief information security officer for customer security, said Microsoft is already operating in a world of hundreds of thousands of agents as Customer Zero, and that the lessons learned there directly inform the capabilities now being delivered.

Microsoft said it is bringing chain-of-thought and other model-level signals into Dynamic Agent Risk to help identify intent drift, spot when untrusted information is influencing an agent’s reasoning, and detect when planned actions diverge from the assigned task, while keeping enforcement independent of the model. “The most trustworthy agentic system will not be the one with the model we trust most,” Chairman and Chief Executive Officer Satya Nadella wrote in remarks cited in Microsoft’s Security Blog announcement. “It will be the one designed that enables us to trust the model least.”

Microsoft 365 E7 and Agent 365 Background

Microsoft’s Security Blog describes the October 19 announcement as new capabilities in Microsoft 365 E7 and Project Perception. Microsoft detailed the bundle in a March 2026 Security Blog post. Microsoft 365 E7: The Frontier Suite became generally available on May 1, 2026, at a retail price of $99 per user per month, and includes Microsoft 365 Copilot, Agent 365, Microsoft Entra Suite, and Microsoft 365 E5 with advanced Defender, Entra, Intune, and Purview capabilities. Microsoft Agent 365, the control plane for observing, governing, and securing agents across an organization, became generally available the same day, priced at $15 per user per month.