Microsoft proposes treating AI agents as insider threats with Dynamic Permissions, Dynamic Agent Risk and Guardian Agents
Microsoft published a blog post arguing that organizations should treat AI agents as a present insider threat rather than a future risk. Agents with access to critical systems can fail, be manipulated or be compromised, and their behavior can drift mid-run through prompt injection in external documents or untrusted data. Microsoft's answer is continuous containment instead of upfront trust: define permitted actions before the agent acts, monitor what it does, and adjust permissions in real time. This is a vendor framework and guidance, not a reported incident or vulnerability.
Detalhes técnicos
- Dynamic Permissions: applies least privilege to agents. An agent gets its own identity and starts with no permissions. It receives only the access needed for its approved task, and only for the duration of that task. It does not inherit the deploying employee's access.
- Dynamic Agent Risk: a continuously updated score combining signals from identity, data, endpoints, cloud, network, runtime and the agent's own activity. It assesses configuration, reachable resources, potential impact and drift from intent. Graduated responses include preserving reads while blocking writes, narrowing resources, requiring human approval for high-impact steps, or stopping execution.
- Discovery: Microsoft is expanding discovery to 60 types of local agents, including Claude Code, OpenAI Codex and GitHub Copilot, to build a unified registry with accountable identities.
- Guardian Agents: security-focused AI agents that follow human-written playbooks, investigate risk changes, and apply or recommend controls. The article notes that they can also fail or be manipulated, so controls must operate outside the AI model and not be changeable by it.
Remediação
- Register all agents, including locally run and third-party ones, in a central inventory with accountable identities.
- Scope agent permissions to the specific task and time window rather than reusing user access.
- Monitor agent behavior continuously and enforce graduated containment.
- Require human approval for high-impact actions.
- Keep enforcement controls independent of the model.
Linha do tempo
-
Microsoft proposes treating AI agents as insider threats with Dynamic Permissions, Dynamic Agent Risk and Guardian Agents
ler a análise desta fonte ocultar
Microsoft published a blog post arguing that organizations should treat AI agents as a present insider threat rather than a future risk. Agents with access to critical systems can fail, be manipulated or be compromised, and their behavior can drift mid-run through prompt injection in external documents or untrusted data. Microsoft's answer is continuous containment instead of upfront trust: define permitted actions before the agent acts, monitor what it does, and adjust permissions in real time. This is a vendor framework and guidance, not a reported incident or vulnerability.
Technical Details
- Dynamic Permissions: applies least privilege to agents. An agent gets its own identity and starts with no permissions. It receives only the access needed for its approved task, and only for the duration of that task. It does not inherit the deploying employee's access.
- Dynamic Agent Risk: a continuously updated score combining signals from identity, data, endpoints, cloud, network, runtime and the agent's own activity. It assesses configuration, reachable resources, potential impact and drift from intent. Graduated responses include preserving reads while blocking writes, narrowing resources, requiring human approval for high-impact steps, or stopping execution.
- Discovery: Microsoft is expanding discovery to 60 types of local agents, including Claude Code, OpenAI Codex and GitHub Copilot, to build a unified registry with accountable identities.
- Guardian Agents: security-focused AI agents that follow human-written playbooks, investigate risk changes, and apply or recommend controls. The article notes that they can also fail or be manipulated, so controls must operate outside the AI model and not be changeable by it.
Remediation
- Register all agents, including locally run and third-party ones, in a central inventory with accountable identities.
- Scope agent permissions to the specific task and time window rather than reusing user access.
- Monitor agent behavior continuously and enforce graduated containment.
- Require human approval for high-impact actions.
- Keep enforcement controls independent of the model.