What Microsoft Is Announcing for AI Agent Security
Microsoft is expanding its Project Perception framework to better control autonomous AI agents within businesses. According to ICTjournal, new capabilities will enable continuous risk assessment and dynamically adjusted access rights.
The company warns against "Agentic Insiders": AI systems capable of autonomously accessing data and applications, and potentially carrying out unwanted actions. Even an agent deployed for legitimate purposes can, Microsoft cautions, make errors, be manipulated, or deviate from its intended mission.
The Three Pillars of the Announced Framework
Microsoft structures its response around three main mechanisms. Guardian Agents are specialized security agents that monitor the activities of other AI agents, analyze evolving risks, and implement protective measures when needed.
The Dynamic Permissions concept aims to prevent an AI agent from automatically inheriting all the authorizations of the employee it acts on behalf of. Each agent will have its own identity through Microsoft Entra Agent ID, with access limited in time and to specific functions only.
Finally, Dynamic Agent Risk continuously evaluates each agent's risk level by aggregating varied signals (identities, data access, endpoints, cloud environments). In case of suspicious behavior, Dynamic Conditional Access triggers graduated measures: restriction of rights, additional human validation, or complete shutdown of the agent.
What This Actually Means for a Swiss SME
Who is affected? Primarily SMEs already using autonomous AI agents or planning to deploy them: an agent that drafts and sends quotes on its own, a system that adjusts inventory without human validation, a tool that accesses accounting systems to generate reports.
Who is not affected yet? SMEs that only use conversational AI assistants without access to internal systems (Copilot in Word, ChatGPT in draft mode). As long as a tool cannot act independently on your data, the "Agentic Insider" risk remains theoretical.
| Scenario | Current Risk | Priority |
|---|---|---|
| AI agent that reads emails to suggest replies | Low | Standard |
| AI agent that sends QR-bills and updates accounting | High | Urgent |
| AI agent that accesses complete client files | Very High | Immediate |
Hypothetical Scenario: An Accounting Firm in Martigny
Imagine a 12-person fiduciary in Martigny deploying an AI agent to prepare 8.1% VAT declarations for its clients. The agent accesses bank statements, categorizes transactions, and generates reports.
Without adapted security, this agent could theoretically: modify a rate by error, access a non-relevant client's file, or continue operating after receiving contradictory instructions. With Microsoft's announced framework, the fiduciary could limit the agent to one client at a time, require human validation for any modification, and automatically shut down the agent if its behavior deviates from the norm.
In practice, these functions are not yet available. Microsoft states that Project Perception is in limited public preview, accessible by invitation to selected customers only. Features are likely to evolve before any general availability.
Watchpoints for Your SME
Vendor Dependency and Data Hosting
Microsoft's framework relies on centralized cloud infrastructure. For a Swiss SME concerned with confidentiality, this raises questions about data hosting and compliance with the Swiss nFADP (nLPD). The security information exchanged between Project Perception and Microsoft Agent 365 transits through servers whose precise location is not specified in the announcement.
Hidden Costs and Complexity
Assigning a unique identity to each agent, defining security playbooks, maintaining approval thresholds: these tasks require time and expertise. A 15-person SME typically has no dedicated security officer. The risk is deploying sophisticated tools without the resources to operate them properly.
Maturity and Overconfidence
"Reactive security is generally not effective," Microsoft notes. This is true. But a system promising to monitor everything continuously can also create false reassurance. The Guardian Agents themselves are AI agents: they can theoretically have flaws, blind spots, or be overwhelmed by unexpected behaviors.
What Not to Automate
Fund transfers, contract modifications, access to sensitive medical or AVS (social security) data: these actions still merit systematic human validation. An AI agent should never have irreversible powers without supervision.
What to Do Now
- Inventory your existing AI agents. Which tools have access to your data? What actions can they perform independently? List them as you would list employees with privileged access.
- Apply least-privilege principles manually. Even without Dynamic Permissions, limit each agent to strictly what is necessary. An agent that generates drafts does not need to send emails. An agent that reads spreadsheets does not need to write in your accounting software.
- Require human validation for sensitive actions. Configure your current tools so a person verifies before sending a QR-bill, modifying inventory, or accessing an unusual client file.
- Document who does what. Note which agents are attached to which employees, what their authorizations are, and how to shut them down in an emergency. This documentation will be essential when Microsoft Entra Agent ID becomes available.
- Test your knowledge and needs. The 2-minute AI quiz from FlowBiz.ai can help you assess where you stand. For concrete examples of secure automations, see our automation use cases.
FlowBiz.ai supports French-speaking Swiss SMEs in Sion and Valais in deploying AI assistants and Switzerland-hosted automations, in small steps and at fixed prices. If you would like to discuss the security of your existing AI agents, contact us.
