On October 19, 2026, Microsoft outlined an extension of Project Perception aimed at agents operating inside an enterprise. Its announcement describes Guardian Agents supervising agent activity and responding as risk changes. The important shift is the target: software a business has authorized, not just attackers trying to get in.
For buyers, the useful question is not whether another AI can watch the first. It is whether enforcement remains independent of the agent being watched.
What changed, and what already existed
Project Perception is not a newly introduced platform. Microsoft's July 27 announcement described a coordinated system of red agents finding attack paths, blue agents assessing risk, and green agents taking corrective action. It scheduled public preview for August 3.
The October update applies that security architecture to internal agents. Microsoft argues that deploying an agent yourself does not make its future behavior predictable. That is a vendor's security position, not evidence that every agent is malicious.
Permissions that change during a task
The technical announcement introduces Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access. Microsoft describes task-scoped authority, continuously updated risk signals, and responses that can narrow access rather than simply stop all work.
Its proposed responses include retaining read access while blocking writes, requiring verified human approval, or isolating execution. These are announced capabilities and architectural claims, not independently demonstrated protection rates.
Discovery is not runtime protection
Microsoft's Defender support matrix separates agent discovery from runtime protection. Discovery is activity-based: installation alone does not guarantee an agent will appear in inventory. Support also varies by operating system and integration method.
The documentation explicitly says runtime support does not mean protection is enabled on a device. Teams must configure the relevant mode. Consequently, an inventory screenshot should not be accepted as proof that an unsafe tool call will be blocked.
Check identity and entitlement separately
Entra Agent ID documentation describes a framework for managing agent identities across Microsoft and third-party platforms. It also distinguishes access to Agent ID from extending Entra security features to agents, which requires Microsoft Agent 365. Check current product terms for your deployment rather than assuming identity registration includes every announced control.
A bounded pilot before wider deployment
Our recommendation is to test one low-impact workflow with explicit acceptance criteria:
- Record which identity owns each action and who can revoke it.
- Attempt a harmless action outside the approved task and verify the enforcement result.
- Confirm that a denied write does not unintentionally prevent permitted reads.
- Measure added latency, approval workload and recovery behavior.
The commercial implication is straightforward: evaluate the control path alongside task performance. A successful demonstration should show both useful work and a verifiable boundary when the agent attempts something outside its authority.