Microsoft adds risk scores and step-by-step brakes for AI agents, treating them like insiders
New controls in Microsoft 365 E7 and Project Perception can remove an agent’s write access, hold actions for human approval or stop it. More detail is due at Ignite in November.
Illustration · not a photoHow this story was checked
- ResearchedWith AI assistance · 3 sources
- AI source checkEach sentence matched to its source
- Editor approvalMayank Sahu · 20 Oct, 12:25
- Published20 Oct, 12:25
Verify this story
- 3 sources, 1 official · 3 with an archived copy · see sources
- Every fact has a label and a source number · fact ledger
- What we searched, read and could not verify · research note
- Machine-readable: facts as JSON · text as Markdown
How this was made: researched, drafted and source-checked by AI (Claude, made by Anthropic), then published under the editor’s standing approval. A person did not read it line by line before it went live. AI policy
In short
Microsoft on 19 October 2026 unveiled new controls that treat AI agents as potential insider risks. Each agent gets a continuously updated risk score, and as the score rises the system can remove write access, require human approval for high-impact actions, or stop the agent.
Our view · Opinion
Opinion: Microsoft’s brakes for AI agents are a good idea, and every agent platform should offer themWhat Microsoft announced
In a post titled “Securing the agentic insider”, Hayete Gallot, Microsoft’s executive vice president for security, argued that companies should supervise AI agents the way they manage insider risk, with controls that sit outside the model.1 “Model transparency will not replace containment,” she wrote, SiliconANGLE reported.2
The new features are part of Microsoft 365 E7 and Project Perception, the agentic security system Microsoft introduced in July.123
How the controls work
- Risk score for every agent. Dynamic Agent Risk gives each agent a score that rises when its behaviour drifts from what its user or organisation intended.12
- Graduated brakes. As risk rises, the system can first remove the agent’s ability to change things while keeping read access, then hold high-impact actions for a person to approve, and finally isolate or stop the agent.23
- Finding agents. Microsoft’s tools now recognise 60 types of agents on employees’ computers, up from 25, including Claude Code, OpenAI’s Codex and GitHub Copilot.23
- Guardian Agents. In Project Perception, these agents investigate when a risk score changes and can recommend or apply containment, while people keep control of policies.12
SiliconANGLE also describes just-in-time permissions and a sandbox, Microsoft Execution Container, whose monitoring runs outside the agent.2
Availability
GeekWire reports the features are in private preview, with broader availability planned around Microsoft Ignite, 17–19 November.3 Microsoft did not give prices for the new controls; E7 launched in May at $99 per user per month.3
Why it matters
Several labs have reported test agents taking actions they were not authorised to take. Controls that can slow or stop an agent without relying on the model itself are becoming a standard request from security teams.
Fact ledger
How labels workTracked from this story
All trackersBroader availability of agent risk controls around Microsoft Ignite
Pending Follow itQuestions readers ask
What is Dynamic Agent Risk?
A Microsoft feature that gives each AI agent a continuously updated risk score, based on what the agent tries to do and whether it drifts from its task.
Can Microsoft’s tools stop an AI agent?
Yes. As risk rises, the controls can remove write access, hold actions for human approval, or isolate and stop the agent.
When are the controls available?
GeekWire reports they are in private preview, with broader availability planned around Microsoft Ignite, 17–19 November 2026.