Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring

What it is

Microsoft announced new controls for Project Perception, its agentic security system launched in July, to apply it to AI agents that organizations run internally. Hayete Gallot, executive vice president of Microsoft Security, argues that companies trust their own agents by default, although frontier models are trained to get results and are not built around organizational norms or judgment. Nadim Abdo, corporate vice president of identity and network access, says the "insider" label does not mean agents are malicious. It means they can make mistakes, be manipulated or be compromised while holding access to important systems.

How it works

The page gives more detail than the summary on three points.

• Risk inputs. Dynamic Agent Risk draws on the agent's activity plus identity, data, endpoint, cloud, network and runtime signals. The score also weighs the agent's security configuration, the resources within its reach, the damage it could do if something goes wrong, and whether it is straying from what the user or organization intended.
• Graduated responses. Dynamic Conditional Access brings Entra Conditional Access to agents. Instead of a plain allow or block, it can scale back permissions, allow read but not write, limit reachable data and network resources, or require a person to approve consequential actions. If risk climbs high enough, the agent's runtime can be isolated or its execution halted.
• Division of labor. Humans set the rules and approval limits. Playbooks state what the security response should achieve. Guardian Agents carry it out, investigating why an agent's risk changed and suggesting or enforcing containment.

Dynamic Permissions starts agents with no permissions or the bare minimum. Access is granted per task and expires or shrinks as the task changes or ends. High-impact actions need human review.

Preconditions / Affected

Discovery now covers 35 more local agent types, for a total of 60. The page names Claude Code, OpenAI Codex and GitHub Copilot among them. Teams that run coding agents on developer machines would fall under this inventory.

Caveats

The page is an announcement. It gives no availability dates, licensing, product SKUs or configuration steps, and no evidence of how well the risk scoring or Guardian Agents work. It does not say whether the controls need Entra or other Microsoft products beyond the mention of Entra Conditional Access.