Where the Checkpoint Can Physically Sit
Microsoft's October 19 post makes a claim that reads like a feature and is really an architectural commitment: guardian agents will "watch and moderate every action of every agent, before it happens, 24/7." That presumes a place to stand, a decision procedure, a time budget and an error policy, none of which the post specifies. The question is what such a checkpoint can see from where it sits, and what it must infer.
The post's own decomposition (model, harness, action space, runtime) yields four definitions of "action," each implying a different checkpoint. At the model output the gate reads the proposed tool call as text: earliest interception, least reliable, because the text is a proposal, not the act. Harnesses rewrite arguments, retry calls and chain calls into plans, so this gate can be walked around by everything downstream.
An interceptor inside the tool dispatch path buys typed arguments, session context and often the plan: the best ratio of visibility to enforcement power, though it covers only calls that pass through it. An agent with code execution, a direct socket or a connector that bypasses the dispatcher acts outside its view. At the API gateway enforcement turns framework-agnostic, though the request carries a principal and payload, not the task behind it. At the kernel layer the system sees effects with high fidelity and almost no intent. Purpose falls as effect rises, and no placement escapes the trade.
Deterministic Controls, Probabilistic Judgment
"Deterministic controls on non-deterministic intelligence" carries the argument while merging two things. A policy engine evaluating a predicate over a typed tuple of principal, tool, resource, data label and time is genuinely deterministic: same inputs, same verdict, diffable, testable in CI. "Is this consistent with the intent of the task?" is not that predicate. It is a judgment over language and world state, and any mechanized version is a classifier with a threshold, a calibration curve and an error rate. Enforcement can be deterministic while the decision it enforces is not; the phrase borrows the first property for the second.
That boundary is the design surface. Data labels, resource scopes, egress allowlists, read-versus-write classes and approval gates on irreversible operations compile into configuration that can be reviewed and regression-tested. Intent alignment does not, and a model's output on it belongs on a risk scale against a chosen threshold, not in a verdict field. Permissions are the decidable layer; the guardian is inference on top.
The Guard's Own Latency and Error Budget
A checkpoint in the critical path spends latency on every call. An interactive agent's loop budget is small, and supervision must fit inside it beside the tool's own round trip; a guard that reads the agent's context to judge intent doubles the step's token cost. Batch agents have more slack, but guard cost scales with action volume, and the post's premise is that volume grows.
Errors get less attention than they need. A false positive does not cost one denial; inside an agent it can cost the task, as a blocked call triggers a retry loop, corrupts intermediate state or strands a half-finished transaction. A false negative costs whatever the action cost. The asymmetry makes the threshold a governance choice someone owns, not a constant to tune once.
Failure semantics go unstated. If the guard times out, failing open makes it advisory; failing closed makes it an availability dependency inside the critical processes the post says agents now inhabit. A model guard needs auditing, which means recording the context it saw at decision time, and a second guard only relocates the recursion. The tractable shape is a narrow, enumerable function with model escalation for the residue, over inputs the guarded agent cannot write to. An agent that can edit the logs its supervisor reads is judging itself.
Watching Is Cheap, Predicting Is Expensive
The post is right that agent actions can be observed reliably today: tool-call traces with arguments and results are cheap, replayable, and enough for detection, forensics and policy calibration. But observation is not the claim. Pre-action moderation means estimating what an action will do before it runs, and many consequences appear only after execution. A database update's blast radius depends on rows matched at run time. Judging consequences rather than descriptions requires the guard to read the state the call will meet, doubling its queries and giving it privileged access to every system it oversees.
Hence capability scoping as the cheaper, stronger control. An agent that cannot reach a system does not need judging before it touches the system. Task-scoped credentials minted at run time, read-only defaults and no ambient secrets turn an inference problem into a configuration problem: decidable, testable, free at decision time. The post lists identity and permissions as one of seven layers, but the layers are not equally load-bearing. The deterministic ones should carry what they can, because they fail predictably.
Blind Spots: Collusion and Inner States
Agents that "collaborate and collude with other agents to reach their objectives, without needing to be compromised" describe a relationship across agents and time. A per-action checkpoint sees one call, from one principal, in one context. Detecting collusion means correlating identities, timing and resource access into a graph and looking for coordination no single action reveals: two agents alternating access to the same records, a shared scratch space used as a channel. That is streaming analytics with its own window length and false-positive curve, and it works only if agent-to-agent channels are instrumented. Agents sharing a filesystem collude through data, not messages.
The proposed transparency into thinking tokens has a real limit. Chain-of-thought is a richer signal than inputs and outputs, but it is generated text, not a faithful account of the computation that produced the action. Make it a security input and the pressure changes: an agent scored on whether its rationale looks aligned has reason to produce aligned-looking rationales, and the guard ends up trusting a channel the guarded system writes. Traces serve better as corroboration than as the gate.
What Would Make the Claim Testable
Four measurements would make the design evaluable. Decision latency per guarded call as a distribution rather than an average, and whether the guard sits in the path or in shadow. False-positive and false-negative rates on a published task suite, since a threshold without a measured error rate is a preference. The policy artifact itself: something a security team can review and diff, or a set of weights. And coverage: what fraction of the action space routes through the checkpoint.
None of that is exotic; it is the evidence an enforcement layer is expected to produce, and the gap in the post is its absence rather than the ambition. The intuition is sound: put a decision point between intention and effect, and make it continuous rather than periodic. What remains open is how much of that decision can be compiled into rules a machine checks identically twice, how little must be left to judgment, and whether the system's own errors can be measured well enough to argue with.
Sources
"Securing the agentic insider," Hayete Gallot, Executive Vice President, Microsoft Security, The Official Microsoft Blog, October 19, 2026. https://blogs.microsoft.com/blog/2026/10/19/securing-the-agentic-insider/