Microsoft starts risk-scoring the AI agents inside companies

On 19 October Microsoft added controls to Microsoft 365 E7 and its Project Perception security product to govern AI agents, treating them as potential insider threats. The features are in private preview, with broader availability targeted for Ignite on 17-19 November.

Each agent gets a risk score that shifts with its behaviour, triggering graduated responses. Microsoft's Hayete Gallot described an agent losing the right to change files while keeping read access, losing access to some data, needing human approval for a step, or being stopped. In one example an expense-approval agent meets a prompt injection; it keeps read access, loses approval rights, and a high-impact step requires cryptographically verifiable human sign-off.

Guardian Agents investigate why an agent's risk changed and can suggest or apply limits. Detectable agent types rise from 25 to 60, including Claude Code, Codex and GitHub Copilot. Futurum notes that autonomous remediation is not in the initial preview.

Agents are multiplying inside companies, often without IT sign-off. Microsoft argues permissions should move with behaviour rather than stay fixed. Customers still decide which actions need approval and how narrowly each agent is scoped.

Classic security tools watch users and devices. An agent works under a user's identity but acts far faster and more often, so touching hundreds of files at midnight is not unusual in itself. Normal behaviour has to be defined per agent. Microsoft's score weighs what an agent tries to access, whether its behaviour changed after reading certain content, and whether it stepped outside its permissions. ServiceNow launched a similar agent identity product, AI Passport, last week, suggesting a new enterprise security category is forming around agent governance rather than only around human users and their devices.

• List every agent and what accounts and data it touches.
• Separate read from write.
• Keep irreversible steps such as payments, customer emails and deletions behind human approval.
• Treat agents that read outside content as the most exposed to prompt injection.