Microsoft Now Calls AI Agents Your Newest Insiders: A Five-Rung Ladder for Keeping Your Company’s Agents on a Short Leash

Here Is How Layered Defenses Help When the Insider Is Software

For years insider risk meant people: a careless employee, a disgruntled contractor. Microsoft is now arguing that the AI agents businesses are rolling out belong in the same category. They read company data, use tools and take actions, they are often given more access than they need, and they do not always behave the way they did when the task started.

The company laid out the idea in two posts on Monday: a Microsoft Security blog by Nadim Abdo, corporate vice president for identity and network access, and an essay on the official Microsoft Blog by Hayete Gallot, executive vice president of Microsoft Security.

The argument in brief

Gallot writes that frontier models, wherever they come from, cannot be trusted, not because they are malicious but because they are trained to reach results, which can lead to “reward hacking,” and are not tuned to an organization’s norms or judgment. Abdo frames it more gently: agents can make mistakes, be manipulated or be compromised, and their behavior can shift as their inputs change. Both point to the same answer, which Abdo sums up with a line from CEO Satya Nadella:

“The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least.”

In other words, the controls on what an agent can see and do have to sit outside the agent, where it cannot switch them off.

What Microsoft announced

Project Perception, the agent-based security system Microsoft introduced in July, is being extended to watch and contain the agents running inside a company, using a team of “Guardian Agents” and new playbooks that work within policies people set.
Discovery is expanding by 35 types of locally run agents to a total of 60, including Claude Code, OpenAI Codex and GitHub Copilot, feeding a shared registry with Microsoft Agent 365.
Microsoft Entra Agent ID gains identity types for more kinds of agents, including ones found by security sensors rather than formally deployed.
Dynamic Permissions start an agent with no authority and grant only what a task needs, for only as long as it needs it, with verified human approval for higher-impact steps.
Dynamic Agent Risk and Dynamic Conditional Access adjust what an agent may do as its risk changes, from blocking writes while allowing reads up to isolating or stopping it.

The ladder: five rungs any business can climb

You do not need a large security team, or any particular vendor, to apply these ideas. Think of them as rungs. Each one makes the next safer.

Rung 0: You do not know which agents you have

This is where most small companies start. Staff may be running coding assistants, browser extensions or automation tools connected to email and files without anyone keeping track. As Microsoft puts it, you cannot secure what you cannot see.

Rung 1: Every agent is listed and has an owner

Keep a simple register: what the agent is, who is responsible for it, why it exists and what it is connected to. Where your platform allows it, give each agent its own identity instead of letting it act entirely through a person’s account, so you can tell what the person did from what the agent did on their behalf.

Rung 2: Every agent starts with nothing

Apply least privilege the way you would for a new hire, only stricter. Microsoft’s example is an expense-approval agent: it needs to read submissions, check policy and approve routine claims, but it should not inherit every permission of the employee who set it up. Run agents in a sandbox or separate environment where possible, and limit which tools, connectors and data sources they can call.

Rung 3: Access is time-boxed, and big actions need a human

Grant access for a task and take it back when the task ends. Anything consequential, such as sending money, deleting records, emailing customers or changing permissions, should wait for a person to approve it.

Rung 4: Agents are watched, and the response is graduated

Log what agents do and alert on activity that drifts from their job, for example an agent that suddenly reaches for unrelated data after reading an outside document that may contain hidden instructions. The response does not have to be all or nothing: keep read access while blocking changes, narrow what it can reach, or pause it entirely when the risk is high.

Rung 5: You test and tune

Periodically try to trick your own agents, review the logs, and tighten the rules based on what you learn. Microsoft’s point that automated guardians should carry the routine work while people keep the judgment calls applies at any size.

Products are examples, not the answer

For Microsoft 365 shops, the announced tools such as Entra Agent ID, Conditional Access for agents and Project Perception are one way to climb these rungs, and Microsoft’s posts do not spell out availability or licensing for every piece. Identity providers, endpoint security tools, data loss prevention and the admin controls built into AI platforms themselves can fill the same roles. The protection comes from the layers working together, not from any single product.

What this means for your company

If your business has started using AI tools that can read your files or act on your behalf, start with Rung 1 this month: make the list. It will probably surprise you. Then pick the one agent with the most access and walk it up to Rung 3, with its own narrow permissions and a human approval step before anything irreversible. That alone puts you ahead of most companies adopting agents today.

Need help taking stock of the AI agents in your business and putting sensible limits around them? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.