Microsoft has detailed controls that would let companies tighten an AI agent’s access during a task, giving security teams a way to curb risky actions without necessarily ending the work.
In an Oct. 19 security post, the company said an agent could retain permission to read company data after losing permission to change it. A person could also be required to approve a consequential action. At the highest risk levels, a company could isolate or stop the agent.
The controls address a problem that can arise after an agent begins an authorized task. Microsoft said the agent might encounter untrusted material or move beyond its assignment, making its original level of access inappropriate as work continues.
Dynamic Permissions would tie an agent’s authority to its assignment and the time needed to complete it. Company rules and the sponsoring employee’s access rights would set the limit: The agent could not receive authority the employee lacks. Microsoft described this as an application of least-privilege access, which limits permissions to those needed for a task.
Dynamic Agent Risk would continually assess the agent’s activity alongside signals from identity, data, endpoints, cloud services and networks. Dynamic Conditional Access would use that assessment to narrow access or seek human approval during the task. Together, the controls would give security teams a way to respond as an agent’s behavior or inputs change.
These are details from the same Oct. 19 announcement that outlined Microsoft’s broader plan to oversee workplace AI agents. The company introduced Project Perception, the security effort behind the controls, on July 27. Its initial focus was external attacks; the work described in October also addresses agents operating inside organizations.
Microsoft is also adding discovery support for 35 additional types of local agents, bringing the total to 60 supported local agents. The discovery system covers products including GitHub Copilot, Claude Code and OpenAI Codex. Discovery depends on observed activity, rather than installation alone.
