---
title: Microsoft extends Project Perception to treat AI agents as insiders: Dynamic Permissions, Dynamic Agent Risk scoring, Conditional Access for agents and discovery of 60 local agent types including Claude Code and Codex | ctxsec
url: https://ctxsec.com/items/microsoft-project-perception-agents-as-insiders
description: ""
status: "vendor announcement (Microsoft Security blog, Oct 19); availability dates not stated"
published: 2026-10-20
---

> 

[← AI](/ai) · [markdown](/items/microsoft-project-perception-agents-as-insiders.md)

vendor announcement (Microsoft Security blog, Oct 19); availability dates not stated

2026-10-20

### Microsoft extends Project Perception to treat AI agents as insiders: Dynamic Permissions, Dynamic Agent Risk scoring, Conditional Access for agents and discovery of 60 local agent types including Claude Code and Codex

In an Oct 19 post, Microsoft's Nadim Abdo (CVP, Identity and Network Access) says agents should be secured as potential _insiders_. That doesn't mean they're malicious. They can make mistakes, be manipulated or be compromised while holding real access. The design principle Microsoft quotes from Satya Nadella is that the model must not be its own security authority: access, action and kill-switch controls sit outside the model. Announced pieces:

- **Discovery and identity:** discovery of 35 more local agent types, bringing the total to 60, including Claude Code, OpenAI Codex and GitHub Copilot, feeding a registry shared with Agent 365. Entra Agent ID is extended to local and previously unknown agents, so they can become policy targets.
- **Containment:** run the model and harness in sandboxes such as the Microsoft Execution Container (MXC), and mediate agent calls to tools, APIs and MCP servers.
- **Dynamic Permissions:** agents start with no or minimal permissions, get task-scoped and time-bound access, and need verified human approval for high-impact actions.
- **Dynamic Agent Risk** plus **Dynamic Conditional Access** for agents: a continuously updated risk score that can preserve reads while blocking writes, narrow resources, require approval, or isolate and stop the agent. Microsoft says chain-of-thought and other model-level signals will feed the score.
- **Guardian Agents and Playbooks** in Project Perception to investigate risk changes and recommend or apply containment within limits people set.

**Our read (opinion):** the architecture matches what agent-incident write-ups keep pointing to: untrusted input reaching an agent that holds standing, user-equivalent authority. The post gives no release dates, licensing or preview status, and points readers to Ignite. Treat it as direction, not something you can deploy today. The practical takeaway works with any vendor: give each agent its own identity, start it with no standing permissions, and enforce controls outside the model.

Sources: [Microsoft Security blog: Agents are your newest insiders (Oct 19)](https://www.microsoft.com/en-us/security/blog/2026/10/19/agents-are-your-newest-insiders-security-must-move-at-their-speed/) · [SecurityWeek (Oct 20)](https://www.securityweek.com/microsoft-targets-rogue-ai-agents-with-dynamic-permissions-risk-scoring/)