Guardian Agents: a supervisor for enterprise agents
Microsoft has introduced Guardian Agents, a feature designed to observe the behavior of AI agents used by enterprises. The new feature is part of Project Perception, an initiative announced in June to simulate and defend corporate networks against attacks. The project was organized around “red team” agents that simulate attackers, “blue team” agents that detect weak points, and “green team” agents that try to fix them.
The new approach extends the problem: an AI agent is not only a tool that defends the company against external attacks, but can itself become an entity with access and operational capabilities that must be controlled. Microsoft also announced features in Defender to identify agentic tools installed by employees and limit access to data and systems. The company says it can recognize up to 60 types of agents and apply dynamic permissions, with human approval when behavior appears risky.
Why a model should not authorize itself
An agent can read documents, call APIs, modify files, or perform operations on behalf of a person. If the model misinterprets the objective, follows malicious instructions contained in a document, or acts on incomplete information, the consequences can exceed those of an erroneous response in chat. Microsoft argues that advanced models are unpredictable and do not automatically know an organization’s internal rules.
The proposal to separate intelligence from authority is a concrete architectural principle: the model can suggest or request an action, while an independent layer verifies identity, permissions, context, and thresholds before authorizing it. Logs must then make it possible to reconstruct which tools were used and why. This approach does not eliminate errors, but it can limit their impact and facilitate investigation.
The vendor also has a commercial interest
Microsoft sells cloud and security products and develops its own models; it also has close relationships with OpenAI and Anthropic. The company is therefore both a party that describes a risk and a supplier of tools to address it. TechCrunch highlights this dual role. The conflict of interest does not automatically make the concerns unfounded, but it makes it important to evaluate the features with independent testing and compare them with alternatives.
Protection will also depend on how the organization configures controls. A monitoring system cannot compensate for excessive permissions, shared credentials, or the absence of revocation procedures. What is needed is an inventory of agents, minimum permissions, oversight of irreversible actions, and testing with realistic scenarios.
Guardian Agents is an announcement, not proof that every agent can be made safe. The question for companies is practical: who controls an agent that has access to systems, and who can stop it when it acts outside the assigned task?
