Microsoft (Nasdaq: MSFT) is arguing that enterprises need to treat autonomous AI agents as a distinct insider-risk category as those systems gain access to data, tools and critical business processes. The company’s position is that security controls must monitor an agent’s behavior continuously, rather than assuming a properly authorized agent is automatically safe to operate without supervision.
The strategy addresses a new operational reality. An AI agent can retrieve information, make a recommendation, call an application programming interface or complete a workflow step at machine speed. That capacity can create useful automation, but it also means a poorly scoped agent, an unexpected model behavior or an inappropriate permission can produce a security or business-process problem without an outside attacker first taking control of an account.
Microsoft calls this risk category the “agentic insider.” The company notes that frontier AI models are optimized to pursue an objective, but do not inherently understand an organization’s norms or judgment. As agents receive broader permissions, Microsoft says organizations should assess their activity as a security risk even if the agent has not been compromised. That framing shifts governance from a one-time approval of an AI use case to ongoing supervision of how it behaves in production.
The company says controls need to extend across identity, permissions, data, endpoints, networks, cloud infrastructure and runtime environments. Each layer can answer a different question: whether an agent should have access, what it can reach, whether its actions match policy and whether its behavior is creating a new risk. This also means an AI security program cannot live solely with a model-development team; it needs coordination among identity, application, cloud, security-operations and business-process owners.
Microsoft’s Perception system is intended to bring those signals together to discover and manage agents, assess risk dynamically and use Guardian Agents to supervise activity as conditions change. The company says its approach combines deterministic controls with non-deterministic AI systems. The distinction is significant because a security policy can set a hard boundary, while an AI model may behave differently as the context, tools or user request changes.
Continuous supervision does not replace human judgment. Microsoft describes a model in which Perception provides real-time supervision and traceability, while security practitioners investigate incidents, understand why a risk emerged and adjust policies. For enterprise teams, that implies defining which agent actions require human approval, who can alter permissions and how an organization preserves evidence when an agent makes an unexpected call or accesses data outside its expected pattern.
Greater model transparency is the next issue, according to Microsoft. Visibility into what an agent did is valuable; visibility into why it selected an action and whether it remained aligned with the task would strengthen containment and accountability. That will be difficult to achieve consistently, but it is becoming necessary as agents move from answering questions to taking action in operational systems.
The broader trend is clear: AI-agent governance is moving beyond acceptable-use policy and model testing. Compared with legacy identity and access management, enterprises will need controls that evaluate a principal’s behavior after access is granted, combining automated speed with traceable human oversight.