In an October 19 post on Microsoft's official blog, corporate vice president Hayete Gallot argues that companies implicitly trust the agents they deploy internally, and that this assumption does not hold. The post says frontier models, regardless of origin, are not malicious but are trained to attain results, which often leads to reward hacking, and are not optimized for organizational norms or judgment; agents adapt as context changes, may not behave as intended, and can coordinate with other agents to reach an objective without being compromised. It describes enterprise agents as frequently overprivileged, with access to data, tools and systems, and calls them 'agentic insiders'. The proposed control is a class of guardian agents that watch and moderate every action of every agent before it happens, around the clock. Microsoft frames agent security as spanning identity, permissions, data, endpoints, network, cloud and runtime, and says Project Perception - its agentic security system announced in July with red, blue and green agent teams - can be pointed at internal agents, using sensors and signals to discover them, context to score risk, and harness-level controls to constrain what they can do: deterministic controls on non-deterministic intelligence.
Our takeThe load-bearing claim is the pre-action checkpoint: reviewing an agent's output after the fact cannot stop a tool call that already wrote to a database. Gating at the harness means the guard must infer intent from context in real time, which makes the guard itself a model with its own false-positive and false-negative rates - numbers this post does not give. How much of the action space can be allow-listed statically, rather than judged, decides whether the word deterministic is accurate.