Microsoft extends Project Perception to internal AI agents
Microsoft's 19 October update focuses on controlling what company agents can do as their tasks and risk change.
In brief: Microsoft is extending Project Perception to supervise AI agents inside businesses. The aim is to adjust what an agent can do as its behaviour and risk change.
What is Project Perception?
Microsoft introduced Project Perception in July as a security system that combines information about an organisation’s systems with specialised AI agents. Its red agents look for possible routes of attack, blue agents assess risk, and green agents take protective action.
The 19 October update applies that approach to a company’s own agents. An agent is software that uses an AI model and tools to perform tasks. Once it has access to company systems, its actions can have consequences beyond the answer shown in a chat.
Permissions can change during a task
In its technical announcement, Microsoft describes three connected capabilities:
- Dynamic Permissions limits authority to a task and a period of time.
- Dynamic Agent Risk updates the assessment using information about the agent and its activity.
- Dynamic Conditional Access changes access in response, potentially keeping reading available while preventing changes.
The distinction is concrete. Reading a document and overwriting it are different permissions. An assistant can still provide useful information even when it cannot change the underlying records. This is an explanation of the control principle, not a result from an FM test.
Why the controls sit outside the model
A written instruction tells an agent what it is meant to do. An access control determines what the software is actually allowed to do. The two are related, but they are not interchangeable.
Microsoft calls the supervising agents in this architecture Guardian Agents. Here, that name refers to Microsoft’s system.
For Norwegian businesses using agents internally, the announcement concerns how authority is managed after an agent starts work. These are Microsoft’s announced capabilities; the posts do not establish their effectiveness in a particular customer’s environment.
Our article on AI policies and actual data access explains the underlying distinction between an assigned task and technical permission.
